/* pngrutil.c - utilities to read a PNG file

 *

 * Last changed in libpng 1.2.55 [December 6, 2015]

 * Copyright (c) 1998-2002,2004,2006-2015 Glenn Randers-Pehrson

 * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)

 * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)

 *

 * This code is released under the libpng license.

 * For conditions of distribution and use, see the disclaimer

 * and license in png.h

 *

 * This file contains routines that are only called from within

 * libpng itself during the course of reading an image.

 */

#define PNG_INTERNAL

#define PNG_NO_PEDANTIC_WARNINGS

#include "png.h"

#ifdef PNG_READ_SUPPORTED

#if defined(_WIN32_WCE) && (_WIN32_WCE<0x500)

#  define WIN32_WCE_OLD

#endif

#ifdef PNG_FLOATING_POINT_SUPPORTED

#  ifdef WIN32_WCE_OLD

/* The strtod() function is not supported on WindowsCE */

__inline double png_strtod(png_structp png_ptr, PNG_CONST char *nptr,

    char **endptr)

{

   double result = 0;

   int len;

   wchar_t *str, *end;

   len = MultiByteToWideChar(CP_ACP, 0, nptr, -1, NULL, 0);

   str = (wchar_t *)png_malloc(png_ptr, len * png_sizeof(wchar_t));

   if ( NULL != str )

   {

      MultiByteToWideChar(CP_ACP, 0, nptr, -1, str, len);

      result = wcstod(str, &end;;

      len = WideCharToMultiByte(CP_ACP, 0, end, -1, NULL, 0, NULL, NULL);

      *endptr = (char *)nptr + (png_strlen(nptr) - len + 1);

      png_free(png_ptr, str);

   }

   return result;

}

#  else

#    define png_strtod(p,a,b) strtod(a,b)

#  endif

#endif

png_uint_32 PNGAPI

png_get_uint_31(png_structp png_ptr, png_bytep buf)

{

#ifdef PNG_READ_BIG_ENDIAN_SUPPORTED

   png_uint_32 i = png_get_uint_32(buf);

#else

   /* Avoid an extra function call by inlining the result. */

   png_uint_32 i = ((png_uint_32)((*(buf    )) & 0xff) << 24) +

                   ((png_uint_32)((*(buf + 1)) & 0xff) << 16) +

                   ((png_uint_32)((*(buf + 2)) & 0xff) <<  8) +

                   ((png_uint_32)((*(buf + 3)) & 0xff)      );

#endif

   if (i > PNG_UINT_31_MAX)

      png_error(png_ptr, "PNG unsigned integer out of range.");

   return (i);

}

#ifndef PNG_READ_BIG_ENDIAN_SUPPORTED

/* Grab an unsigned 32-bit integer from a buffer in big-endian format. */

png_uint_32 PNGAPI

png_get_uint_32(png_bytep buf)

{

   png_uint_32 i = ((png_uint_32)((*(buf    )) & 0xff) << 24) +

                   ((png_uint_32)((*(buf + 1)) & 0xff) << 16) +

                   ((png_uint_32)((*(buf + 2)) & 0xff) <<  8) +

                   ((png_uint_32)((*(buf + 3)) & 0xff)      );

   return (i);

}

/* Grab a signed 32-bit integer from a buffer in big-endian format.  The

 * data is stored in the PNG file in two's complement format, and it is

 * assumed that the machine format for signed integers is the same.

 */

png_int_32 PNGAPI

png_get_int_32(png_bytep buf)

{

   png_int_32 i = ((png_int_32)((*(buf    )) & 0xff) << 24) +

                  ((png_int_32)((*(buf + 1)) & 0xff) << 16) +

                  ((png_int_32)((*(buf + 2)) & 0xff) <<  8) +

                  ((png_int_32)((*(buf + 3)) & 0xff)      );

   return (i);

}

/* Grab an unsigned 16-bit integer from a buffer in big-endian format. */

png_uint_16 PNGAPI

png_get_uint_16(png_bytep buf)

{

   png_uint_16 i = ((png_uint_16)((*(buf     )) & 0xff) << 8) +

                   ((png_uint_16)((*(buf +  1)) & 0xff)     );

   return (i);

}

#endif /* PNG_READ_BIG_ENDIAN_SUPPORTED */

/* Read the chunk header (length + type name).

 * Put the type name into png_ptr->chunk_name, and return the length.

 */

png_uint_32 /* PRIVATE */

png_read_chunk_header(png_structp png_ptr)

{

   png_byte buf[8];

   png_uint_32 length;

   /* Read the length and the chunk name */

   png_read_data(png_ptr, buf, 8);

   length = png_get_uint_31(png_ptr, buf);

   /* Put the chunk name into png_ptr->chunk_name */

   png_memcpy(png_ptr->chunk_name, buf + 4, 4);

   png_debug2(0, "Reading %s chunk, length = %lu",

      png_ptr->chunk_name, length);

   /* Reset the crc and run it over the chunk name */

   png_reset_crc(png_ptr);

   png_calculate_crc(png_ptr, png_ptr->chunk_name, 4);

   /* Check to see if chunk name is valid */

   png_check_chunk_name(png_ptr, png_ptr->chunk_name);

   return length;

}

/* Read data, and (optionally) run it through the CRC. */

void /* PRIVATE */

png_crc_read(png_structp png_ptr, png_bytep buf, png_size_t length)

{

   if (png_ptr == NULL)

      return;

   png_read_data(png_ptr, buf, length);

   png_calculate_crc(png_ptr, buf, length);

}

/* Optionally skip data and then check the CRC.  Depending on whether we

 * are reading a ancillary or critical chunk, and how the program has set

 * things up, we may calculate the CRC on the data and print a message.

 * Returns '1' if there was a CRC error, '0' otherwise.

 */

int /* PRIVATE */

png_crc_finish(png_structp png_ptr, png_uint_32 skip)

{

   png_size_t i;

   png_size_t istop = png_ptr->zbuf_size;

   for (i = (png_size_t)skip; i > istop; i -= istop)

   {

      png_crc_read(png_ptr, png_ptr->zbuf, png_ptr->zbuf_size);

   }

   if (i)

   {

      png_crc_read(png_ptr, png_ptr->zbuf, i);

   }

   if (png_crc_error(png_ptr))

   {

      if (((png_ptr->chunk_name[0] & 0x20) &&                /* Ancillary */

          !(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)) ||

          (!(png_ptr->chunk_name[0] & 0x20) &&             /* Critical  */

          (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_USE)))

      {

         png_chunk_warning(png_ptr, "CRC error");

      }

      else

      {

         png_chunk_error(png_ptr, "CRC error");

      }

      return (1);

   }

   return (0);

}

/* Compare the CRC stored in the PNG file with that calculated by libpng from

 * the data it has read thus far.

 */

int /* PRIVATE */

png_crc_error(png_structp png_ptr)

{

   png_byte crc_bytes[4];

   png_uint_32 crc;

   int need_crc = 1;

   if (png_ptr->chunk_name[0] & 0x20)                     /* ancillary */

   {

      if ((png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_MASK) ==

          (PNG_FLAG_CRC_ANCILLARY_USE | PNG_FLAG_CRC_ANCILLARY_NOWARN))

         need_crc = 0;

   }

   else                                                    /* critical */

   {

      if (png_ptr->flags & PNG_FLAG_CRC_CRITICAL_IGNORE)

         need_crc = 0;

   }

   png_read_data(png_ptr, crc_bytes, 4);

   if (need_crc)

   {

      crc = png_get_uint_32(crc_bytes);

      return ((int)(crc != png_ptr->crc));

   }

   else

      return (0);

}

#if defined(PNG_READ_zTXt_SUPPORTED) || defined(PNG_READ_iTXt_SUPPORTED) || \

    defined(PNG_READ_iCCP_SUPPORTED)

static png_size_t

png_inflate(png_structp png_ptr, const png_byte *data, png_size_t size,

        png_bytep output, png_size_t output_size)

{

   png_size_t count = 0;

   png_ptr->zstream.next_in = (png_bytep)data; /* const_cast: VALID */

   png_ptr->zstream.avail_in = size;

   while (1)

   {

      int ret, avail;

      /* Reset the output buffer each time round - we empty it

       * after every inflate call.

       */

      png_ptr->zstream.next_out = png_ptr->zbuf;

      png_ptr->zstream.avail_out = png_ptr->zbuf_size;

      ret = inflate(&png_ptr->zstream, Z_NO_FLUSH);

      avail = png_ptr->zbuf_size - png_ptr->zstream.avail_out;

      /* First copy/count any new output - but only if we didn't

       * get an error code.

       */

      if ((ret == Z_OK || ret == Z_STREAM_END) && avail > 0)

      {

         if (output != 0 && output_size > count)

         {

            png_size_t copy = output_size - count;

            if ((png_size_t) avail < copy) copy = (png_size_t) avail;

            png_memcpy(output + count, png_ptr->zbuf, copy);

         }

         count += avail;

      }

      if (ret == Z_OK)

         continue;

      /* Termination conditions - always reset the zstream, it

       * must be left in inflateInit state.

       */

      png_ptr->zstream.avail_in = 0;

      inflateReset(&png_ptr->zstream);

      if (ret == Z_STREAM_END)

         return count; /* NOTE: may be zero. */

      /* Now handle the error codes - the API always returns 0

       * and the error message is dumped into the uncompressed

       * buffer if available.

       */

      {

         PNG_CONST char *msg;

         if (png_ptr->zstream.msg != 0)

            msg = png_ptr->zstream.msg;

         else

         {

#if defined(PNG_STDIO_SUPPORTED) && !defined(_WIN32_WCE)

            char umsg[52];

            switch (ret)

            {

               case Z_BUF_ERROR:

                  msg = "Buffer error in compressed datastream in %s chunk";

                  break;

               case Z_DATA_ERROR:

                  msg = "Data error in compressed datastream in %s chunk";

                  break;

               default:

                  msg = "Incomplete compressed datastream in %s chunk";

                  break;

            }

            png_snprintf(umsg, sizeof umsg, msg, png_ptr->chunk_name);

            msg = umsg;

            png_warning(png_ptr, msg);

#else

            msg = "Damaged compressed datastream in chunk other than IDAT";

#endif

         }

#ifndef PNG_STDIO_SUPPORTED

         png_warning(png_ptr, msg);

#endif

      }

      /* 0 means an error - notice that this code simple ignores

       * zero length compressed chunks as a result.

       */

      return 0;

   }

}

/*

 * Decompress trailing data in a chunk.  The assumption is that chunkdata

 * points at an allocated area holding the contents of a chunk with a

 * trailing compressed part.  What we get back is an allocated area

 * holding the original prefix part and an uncompressed version of the

 * trailing part (the malloc area passed in is freed).

 */

void /* PRIVATE */

png_decompress_chunk(png_structp png_ptr, int comp_type,

    png_size_t chunklength,

    png_size_t prefix_size, png_size_t *newlength)

{

   /* The caller should guarantee this */

   if (prefix_size > chunklength)

   {

      /* The recovery is to delete the chunk. */

      png_warning(png_ptr, "invalid chunklength");

      prefix_size = 0; /* To delete everything */

   }

   else if (comp_type == PNG_COMPRESSION_TYPE_BASE)

   {

      png_size_t expanded_size = png_inflate(png_ptr,

                (png_bytep)(png_ptr->chunkdata + prefix_size),

                chunklength - prefix_size,

                0/*output*/, 0/*output size*/);

      /* Now check the limits on this chunk - if the limit fails the

       * compressed data will be removed, the prefix will remain.

       */

      if (prefix_size >= (~(png_size_t)0) - 1 ||

         expanded_size >= (~(png_size_t)0) - 1 - prefix_size

#ifdef PNG_USER_CHUNK_MALLOC_MAX

         || ((PNG_USER_CHUNK_MALLOC_MAX > 0) &&

          prefix_size + expanded_size >= PNG_USER_CHUNK_MALLOC_MAX - 1)

#endif

          )

         png_warning(png_ptr, "Exceeded size limit while expanding chunk");

      /* If the size is zero either there was an error and a message

       * has already been output (warning) or the size really is zero

       * and we have nothing to do - the code will exit through the

       * error case below.

       */

      else if (expanded_size > 0)

      {

         /* Success (maybe) - really uncompress the chunk. */

         png_size_t new_size = 0;

         png_charp text = png_malloc_warn(png_ptr,

             prefix_size + expanded_size + 1);

         if (text != NULL)

         {

            png_memcpy(text, png_ptr->chunkdata, prefix_size);

            new_size = png_inflate(png_ptr,

                (png_bytep)(png_ptr->chunkdata + prefix_size),

                chunklength - prefix_size,

                (png_bytep)(text + prefix_size), expanded_size);

            text[prefix_size + expanded_size] = 0; /* just in case */

            if (new_size == expanded_size)

            {

               png_free(png_ptr, png_ptr->chunkdata);

               png_ptr->chunkdata = text;

               *newlength = prefix_size + expanded_size;

               return; /* The success return! */

            }

            png_warning(png_ptr, "png_inflate logic error");

            png_free(png_ptr, text);

         }

         else

          png_warning(png_ptr, "Not enough memory to decompress chunk.");

      }

   }

   else /* if (comp_type != PNG_COMPRESSION_TYPE_BASE) */

   {

#if defined(PNG_STDIO_SUPPORTED) && !defined(_WIN32_WCE)

      char umsg[50];

      png_snprintf(umsg, sizeof umsg, "Unknown zTXt compression type %d",

          comp_type);

      png_warning(png_ptr, umsg);

#else

      png_warning(png_ptr, "Unknown zTXt compression type");

#endif

      /* The recovery is to simply drop the data. */

   }

   /* Generic error return - leave the prefix, delete the compressed

    * data, reallocate the chunkdata to remove the potentially large

    * amount of compressed data.

    */

   {

      png_charp text = png_malloc_warn(png_ptr, prefix_size + 1);

      if (text != NULL)

      {

         if (prefix_size > 0)

            png_memcpy(text, png_ptr->chunkdata, prefix_size);

         png_free(png_ptr, png_ptr->chunkdata);

         png_ptr->chunkdata = text;

         /* This is an extra zero in the 'uncompressed' part. */

         *(png_ptr->chunkdata + prefix_size) = 0x00;

      }

      /* Ignore a malloc error here - it is safe. */

   }

   *newlength = prefix_size;

}

#endif

/* Read and check the IDHR chunk */

void /* PRIVATE */

png_handle_IHDR(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

{

   png_byte buf[13];

   png_uint_32 width, height;

   int bit_depth, color_type, compression_type, filter_type;

   int interlace_type;

   png_debug(1, "in png_handle_IHDR");

   if (png_ptr->mode & PNG_HAVE_IHDR)

      png_error(png_ptr, "Out of place IHDR");

   /* Check the length */

   if (length != 13)

      png_error(png_ptr, "Invalid IHDR chunk");

   png_ptr->mode |= PNG_HAVE_IHDR;

   png_crc_read(png_ptr, buf, 13);

   png_crc_finish(png_ptr, 0);

   width = png_get_uint_31(png_ptr, buf);

   height = png_get_uint_31(png_ptr, buf + 4);

   bit_depth = buf[8];

   color_type = buf[9];

   compression_type = buf[10];

   filter_type = buf[11];

   interlace_type = buf[12];

   /* Set internal variables */

   png_ptr->width = width;

   png_ptr->height = height;

   png_ptr->bit_depth = (png_byte)bit_depth;

   png_ptr->interlaced = (png_byte)interlace_type;

   png_ptr->color_type = (png_byte)color_type;

#ifdef PNG_MNG_FEATURES_SUPPORTED

   png_ptr->filter_type = (png_byte)filter_type;

#endif

   png_ptr->compression_type = (png_byte)compression_type;

   /* Find number of channels */

   switch (png_ptr->color_type)

   {

      case PNG_COLOR_TYPE_GRAY:

      case PNG_COLOR_TYPE_PALETTE:

         png_ptr->channels = 1;

         break;

      case PNG_COLOR_TYPE_RGB:

         png_ptr->channels = 3;

         break;

      case PNG_COLOR_TYPE_GRAY_ALPHA:

         png_ptr->channels = 2;

         break;

      case PNG_COLOR_TYPE_RGB_ALPHA:

         png_ptr->channels = 4;

         break;

   }

   /* Set up other useful info */

   png_ptr->pixel_depth = (png_byte)(png_ptr->bit_depth *

   png_ptr->channels);

   png_ptr->rowbytes = PNG_ROWBYTES(png_ptr->pixel_depth, png_ptr->width);

   png_debug1(3, "bit_depth = %d", png_ptr->bit_depth);

   png_debug1(3, "channels = %d", png_ptr->channels);

   png_debug1(3, "rowbytes = %lu", png_ptr->rowbytes);

   png_set_IHDR(png_ptr, info_ptr, width, height, bit_depth,

      color_type, interlace_type, compression_type, filter_type);

}

/* Read and check the palette */

void /* PRIVATE */

png_handle_PLTE(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

{

   png_color palette[PNG_MAX_PALETTE_LENGTH];

   int max_palette_length, num, i;

#ifdef PNG_POINTER_INDEXING_SUPPORTED

   png_colorp pal_ptr;

#endif

   png_debug(1, "in png_handle_PLTE");

   if (!(png_ptr->mode & PNG_HAVE_IHDR))

      png_error(png_ptr, "Missing IHDR before PLTE");

   else if (png_ptr->mode & PNG_HAVE_IDAT)

   {

      png_warning(png_ptr, "Invalid PLTE after IDAT");

      png_crc_finish(png_ptr, length);

      return;

   }

   else if (png_ptr->mode & PNG_HAVE_PLTE)

      png_error(png_ptr, "Duplicate PLTE chunk");

   png_ptr->mode |= PNG_HAVE_PLTE;

   if (!(png_ptr->color_type&PNG_COLOR_MASK_COLOR))

   {

      png_warning(png_ptr,

        "Ignoring PLTE chunk in grayscale PNG");

      png_crc_finish(png_ptr, length);

      return;

   }

#ifndef PNG_READ_OPT_PLTE_SUPPORTED

   if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)

   {

      png_crc_finish(png_ptr, length);

      return;

   }

#endif

   if (length > 3*PNG_MAX_PALETTE_LENGTH || length % 3)

   {

      if (png_ptr->color_type != PNG_COLOR_TYPE_PALETTE)

      {

         png_warning(png_ptr, "Invalid palette chunk");

         png_crc_finish(png_ptr, length);

         return;

      }

      else

      {

         png_error(png_ptr, "Invalid palette chunk");

      }

   }

   /* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */

   num = (int)length / 3;

   /* If the palette has 256 or fewer entries but is too large for the bit

    * depth, we don't issue an error, to preserve the behavior of previous

    * libpng versions. We silently truncate the unused extra palette entries

    * here.

    */

   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)

      max_palette_length = (1 << png_ptr->bit_depth);

   else

      max_palette_length = PNG_MAX_PALETTE_LENGTH;

   if (num > max_palette_length)

      num = max_palette_length;

#ifdef PNG_POINTER_INDEXING_SUPPORTED

   for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)

   {

      png_byte buf[3];

      png_crc_read(png_ptr, buf, 3);

      pal_ptr->red = buf[0];

      pal_ptr->green = buf[1];

      pal_ptr->blue = buf[2];

   }

#else

   for (i = 0; i < num; i++)

   {

      png_byte buf[3];

      png_crc_read(png_ptr, buf, 3);

      /* Don't depend upon png_color being any order */

      palette[i].red = buf[0];

      palette[i].green = buf[1];

      palette[i].blue = buf[2];

   }

#endif

   /* If we actually NEED the PLTE chunk (ie for a paletted image), we do

    * whatever the normal CRC configuration tells us.  However, if we

    * have an RGB image, the PLTE can be considered ancillary, so

    * we will act as though it is.

    */

#ifndef PNG_READ_OPT_PLTE_SUPPORTED

   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)

#endif

   {

      png_crc_finish(png_ptr, (int) length - num * 3);

   }

#ifndef PNG_READ_OPT_PLTE_SUPPORTED

   else if (png_crc_error(png_ptr))  /* Only if we have a CRC error */

   {

      /* If we don't want to use the data from an ancillary chunk,

         we have two options: an error abort, or a warning and we

         ignore the data in this chunk (which should be OK, since

         it's considered ancillary for a RGB or RGBA image). */

      if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_USE))

      {

         if (png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN)

         {

            png_chunk_error(png_ptr, "CRC error");

         }

         else

         {

            png_chunk_warning(png_ptr, "CRC error");

            return;

         }

      }

      /* Otherwise, we (optionally) emit a warning and use the chunk. */

      else if (!(png_ptr->flags & PNG_FLAG_CRC_ANCILLARY_NOWARN))

      {

         png_chunk_warning(png_ptr, "CRC error");

      }

   }

#endif

   png_set_PLTE(png_ptr, info_ptr, palette, num);

#ifdef PNG_READ_tRNS_SUPPORTED

   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)

   {

      if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_tRNS))

      {

         if (png_ptr->num_trans > (png_uint_16)num)

         {

            png_warning(png_ptr, "Truncating incorrect tRNS chunk length");

            png_ptr->num_trans = (png_uint_16)num;

         }

         if (info_ptr->num_trans > (png_uint_16)num)

         {

            png_warning(png_ptr, "Truncating incorrect info tRNS chunk length");

            info_ptr->num_trans = (png_uint_16)num;

         }

      }

   }

#endif

}

void /* PRIVATE */

png_handle_IEND(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

{

   png_debug(1, "in png_handle_IEND");

   if (!(png_ptr->mode & PNG_HAVE_IHDR) || !(png_ptr->mode & PNG_HAVE_IDAT))

   {

      png_error(png_ptr, "No image in file");

   }

   png_ptr->mode |= (PNG_AFTER_IDAT | PNG_HAVE_IEND);

   if (length != 0)

   {

      png_warning(png_ptr, "Incorrect IEND chunk length");

   }

   png_crc_finish(png_ptr, length);

   PNG_UNUSED(info_ptr) /* Quiet compiler warnings about unused info_ptr */

}

#ifdef PNG_READ_gAMA_SUPPORTED

void /* PRIVATE */

png_handle_gAMA(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

{

   png_fixed_point igamma;

#ifdef PNG_FLOATING_POINT_SUPPORTED

   float file_gamma;

#endif

   png_byte buf[4];

   png_debug(1, "in png_handle_gAMA");

   if (!(png_ptr->mode & PNG_HAVE_IHDR))

      png_error(png_ptr, "Missing IHDR before gAMA");

   else if (png_ptr->mode & PNG_HAVE_IDAT)

   {

      png_warning(png_ptr, "Invalid gAMA after IDAT");

      png_crc_finish(png_ptr, length);

      return;

   }

   else if (png_ptr->mode & PNG_HAVE_PLTE)

      /* Should be an error, but we can cope with it */

      png_warning(png_ptr, "Out of place gAMA chunk");

   if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA)

#ifdef PNG_READ_sRGB_SUPPORTED

      && !(info_ptr->valid & PNG_INFO_sRGB)

#endif

      )

   {

      png_warning(png_ptr, "Duplicate gAMA chunk");

      png_crc_finish(png_ptr, length);

      return;

   }

   if (length != 4)

   {

      png_warning(png_ptr, "Incorrect gAMA chunk length");

      png_crc_finish(png_ptr, length);

      return;

   }

   png_crc_read(png_ptr, buf, 4);

   if (png_crc_finish(png_ptr, 0))

      return;

   igamma = (png_fixed_point)png_get_uint_32(buf);

   /* Check for zero gamma */

   if (igamma == 0)

      {

         png_warning(png_ptr,

           "Ignoring gAMA chunk with gamma=0");

         return;

      }

#ifdef PNG_READ_sRGB_SUPPORTED

   if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB))

      if (PNG_OUT_OF_RANGE(igamma, 45500L, 500))

      {

         png_warning(png_ptr,

           "Ignoring incorrect gAMA value when sRGB is also present");

#ifdef PNG_CONSOLE_IO_SUPPORTED

         fprintf(stderr, "gamma = (%d/100000)", (int)igamma);

#endif

         return;

      }

#endif /* PNG_READ_sRGB_SUPPORTED */

#ifdef PNG_FLOATING_POINT_SUPPORTED

   file_gamma = (float)igamma / (float)100000.0;

#  ifdef PNG_READ_GAMMA_SUPPORTED

     png_ptr->gamma = file_gamma;

#  endif

     png_set_gAMA(png_ptr, info_ptr, file_gamma);

#endif

#ifdef PNG_FIXED_POINT_SUPPORTED

   png_set_gAMA_fixed(png_ptr, info_ptr, igamma);

#endif

}

#endif

#ifdef PNG_READ_sBIT_SUPPORTED

void /* PRIVATE */

png_handle_sBIT(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

{

   png_size_t truelen;

   png_byte buf[4];

   png_debug(1, "in png_handle_sBIT");

   buf[0] = buf[1] = buf[2] = buf[3] = 0;

   if (!(png_ptr->mode & PNG_HAVE_IHDR))

      png_error(png_ptr, "Missing IHDR before sBIT");

   else if (png_ptr->mode & PNG_HAVE_IDAT)

   {

      png_warning(png_ptr, "Invalid sBIT after IDAT");

      png_crc_finish(png_ptr, length);

      return;

   }

   else if (png_ptr->mode & PNG_HAVE_PLTE)

   {

      /* Should be an error, but we can cope with it */

      png_warning(png_ptr, "Out of place sBIT chunk");

   }

   if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT))

   {

      png_warning(png_ptr, "Duplicate sBIT chunk");

      png_crc_finish(png_ptr, length);

      return;

   }

   if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)

      truelen = 3;

   else

      truelen = (png_size_t)png_ptr->channels;

   if (length != truelen || length > 4)

   {

      png_warning(png_ptr, "Incorrect sBIT chunk length");

      png_crc_finish(png_ptr, length);

      return;

   }

   png_crc_read(png_ptr, buf, truelen);

   if (png_crc_finish(png_ptr, 0))

      return;

   if (png_ptr->color_type & PNG_COLOR_MASK_COLOR)

   {

      png_ptr->sig_bit.red = buf[0];

      png_ptr->sig_bit.green = buf[1];

      png_ptr->sig_bit.blue = buf[2];

      png_ptr->sig_bit.alpha = buf[3];

   }

   else

   {

      png_ptr->sig_bit.gray = buf[0];

      png_ptr->sig_bit.red = buf[0];

      png_ptr->sig_bit.green = buf[0];

      png_ptr->sig_bit.blue = buf[0];

      png_ptr->sig_bit.alpha = buf[1];

   }

   png_set_sBIT(png_ptr, info_ptr, &(png_ptr->sig_bit));

}

#endif

#ifdef PNG_READ_cHRM_SUPPORTED

void /* PRIVATE */

png_handle_cHRM(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

{

   png_byte buf[32];

#ifdef PNG_FLOATING_POINT_SUPPORTED

   float white_x, white_y, red_x, red_y, green_x, green_y, blue_x, blue_y;

#endif

   png_fixed_point int_x_white, int_y_white, int_x_red, int_y_red, int_x_green,

      int_y_green, int_x_blue, int_y_blue;

   png_uint_32 uint_x, uint_y;

   png_debug(1, "in png_handle_cHRM");

   if (!(png_ptr->mode & PNG_HAVE_IHDR))

      png_error(png_ptr, "Missing IHDR before cHRM");

   else if (png_ptr->mode & PNG_HAVE_IDAT)

   {

      png_warning(png_ptr, "Invalid cHRM after IDAT");

      png_crc_finish(png_ptr, length);

      return;

   }

   else if (png_ptr->mode & PNG_HAVE_PLTE)

      /* Should be an error, but we can cope with it */

      png_warning(png_ptr, "Missing PLTE before cHRM");

   if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM)

#ifdef PNG_READ_sRGB_SUPPORTED

      && !(info_ptr->valid & PNG_INFO_sRGB)

#endif

      )

   {

      png_warning(png_ptr, "Duplicate cHRM chunk");

      png_crc_finish(png_ptr, length);

      return;

   }

   if (length != 32)

   {

      png_warning(png_ptr, "Incorrect cHRM chunk length");

      png_crc_finish(png_ptr, length);

      return;

   }

   png_crc_read(png_ptr, buf, 32);

   if (png_crc_finish(png_ptr, 0))

      return;

   uint_x = png_get_uint_32(buf);

   uint_y = png_get_uint_32(buf + 4);

   int_x_white = (png_fixed_point)uint_x;