fix a buffer overflow
[libpicofe.git] / readpng.c
... / ...
CommitLineData
1/*
2 * (C) GraÅžvydas "notaz" Ignotas, 2008-2011
3 *
4 * This work is licensed under the terms of any of these licenses
5 * (at your option):
6 * - GNU GPL, version 2 or later.
7 * - GNU LGPL, version 2.1 or later.
8 * - MAME license.
9 * See the COPYING file in the top-level directory.
10 */
11
12#include <stdio.h>
13#include <stdlib.h>
14#include <string.h>
15#include <png.h>
16#include "readpng.h"
17#include "lprintf.h"
18
19int readpng(void *dest, const char *fname, readpng_what what, int req_w, int req_h)
20{
21 FILE *fp;
22 png_structp png_ptr = NULL;
23 png_infop info_ptr = NULL;
24 png_bytepp row_ptr = NULL;
25 int ret = -1;
26
27 if (dest == NULL || fname == NULL)
28 {
29 return -1;
30 }
31
32 fp = fopen(fname, "rb");
33 if (fp == NULL)
34 {
35 lprintf(__FILE__ ": failed to open: %s\n", fname);
36 return -1;
37 }
38
39 png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
40 if (!png_ptr)
41 {
42 lprintf(__FILE__ ": png_create_read_struct() failed\n");
43 fclose(fp);
44 return -1;
45 }
46
47 info_ptr = png_create_info_struct(png_ptr);
48 if (!info_ptr)
49 {
50 lprintf(__FILE__ ": png_create_info_struct() failed\n");
51 goto done;
52 }
53
54 // Start reading
55 png_init_io(png_ptr, fp);
56 png_read_png(png_ptr, info_ptr, PNG_TRANSFORM_STRIP_16 | PNG_TRANSFORM_STRIP_ALPHA | PNG_TRANSFORM_PACKING, NULL);
57 row_ptr = png_get_rows(png_ptr, info_ptr);
58 if (row_ptr == NULL)
59 {
60 lprintf(__FILE__ ": png_get_rows() failed\n");
61 goto done;
62 }
63
64 // lprintf("%s: %ix%i @ %ibpp\n", fname, (int)png_get_image_width(png_ptr, info_ptr),
65 // (int)png_get_image_height(png_ptr, info_ptr), png_get_bit_depth(png_ptr, info_ptr));
66
67 switch (what)
68 {
69 case READPNG_BG:
70 {
71 int height, width, h, x_ofs = 0, y_ofs = 0;
72 unsigned short *dst = dest;
73
74 if (png_get_bit_depth(png_ptr, info_ptr) != 8)
75 {
76 lprintf(__FILE__ ": bg image uses %ibpc, needed 8bpc\n", png_get_bit_depth(png_ptr, info_ptr));
77 break;
78 }
79 width = png_get_image_width(png_ptr, info_ptr);
80 if (width > req_w) {
81 x_ofs = (width - req_w) / 2;
82 width = req_w;
83 }
84 height = png_get_image_height(png_ptr, info_ptr);
85 if (height > req_h) {
86 y_ofs = (height - req_h) / 2;
87 height = req_h;
88 }
89
90 for (h = 0; h < height; h++)
91 {
92 unsigned char *src = row_ptr[h + y_ofs] + x_ofs * 3;
93 int len = width;
94 while (len--)
95 {
96#ifdef PSP
97 *dst++ = ((src[2]&0xf8)<<8) | ((src[1]&0xf8)<<3) | (src[0] >> 3); // BGR
98#else
99 *dst++ = ((src[0]&0xf8)<<8) | ((src[1]&0xf8)<<3) | (src[2] >> 3); // RGB
100#endif
101 src += 3;
102 }
103 dst += req_w - width;
104 }
105 break;
106 }
107
108 case READPNG_FONT:
109 {
110 int x, y, x1, y1;
111 unsigned char *dst = dest;
112 if (png_get_image_width(png_ptr, info_ptr) != req_w || png_get_image_height(png_ptr, info_ptr) != req_h)
113 {
114 lprintf(__FILE__ ": unexpected font image size %dx%d, needed %dx%d\n",
115 (int)png_get_image_width(png_ptr, info_ptr), (int)png_get_image_height(png_ptr, info_ptr), req_w, req_h);
116 break;
117 }
118 if (png_get_bit_depth(png_ptr, info_ptr) != 8)
119 {
120 lprintf(__FILE__ ": font image uses %ibpp, needed 8bpp\n", png_get_bit_depth(png_ptr, info_ptr));
121 break;
122 }
123 for (y = 0; y < 16; y++)
124 {
125 for (x = 0; x < 16; x++)
126 {
127 /* 16x16 grid of syms */
128 int sym_w = req_w / 16;
129 int sym_h = req_h / 16;
130 for (y1 = 0; y1 < sym_h; y1++)
131 {
132 unsigned char *src = row_ptr[y*sym_h + y1] + x*sym_w;
133 for (x1 = sym_w/2; x1 > 0; x1--, src+=2)
134 *dst++ = ((src[0]^0xff) & 0xf0) | ((src[1]^0xff) >> 4);
135 }
136 }
137 }
138 break;
139 }
140
141 case READPNG_SELECTOR:
142 {
143 int x1, y1;
144 unsigned char *dst = dest;
145 if (png_get_image_width(png_ptr, info_ptr) != req_w || png_get_image_height(png_ptr, info_ptr) != req_h)
146 {
147 lprintf(__FILE__ ": unexpected selector image size %ix%i, needed %dx%d\n",
148 (int)png_get_image_width(png_ptr, info_ptr), (int)png_get_image_height(png_ptr, info_ptr), req_w, req_h);
149 break;
150 }
151 if (png_get_bit_depth(png_ptr, info_ptr) != 8)
152 {
153 lprintf(__FILE__ ": selector image uses %ibpp, needed 8bpp\n", png_get_bit_depth(png_ptr, info_ptr));
154 break;
155 }
156 for (y1 = 0; y1 < req_h; y1++)
157 {
158 unsigned char *src = row_ptr[y1];
159 for (x1 = req_w/2; x1 > 0; x1--, src+=2)
160 *dst++ = ((src[0]^0xff) & 0xf0) | ((src[1]^0xff) >> 4);
161 }
162 break;
163 }
164
165 case READPNG_24:
166 {
167 int height, width, h;
168 unsigned char *dst = dest;
169 if (png_get_bit_depth(png_ptr, info_ptr) != 8)
170 {
171 lprintf(__FILE__ ": image uses %ibpc, needed 8bpc\n", png_get_bit_depth(png_ptr, info_ptr));
172 break;
173 }
174 width = png_get_image_width(png_ptr, info_ptr);
175 if (width > req_w)
176 width = req_w;
177 height = png_get_image_height(png_ptr, info_ptr);
178 if (height > req_h)
179 height = req_h;
180
181 for (h = 0; h < height; h++)
182 {
183 int len = width;
184 unsigned char *src = row_ptr[h];
185 dst += (req_w - width) * 3;
186 for (len = width; len > 0; len--, dst+=3, src+=3)
187 dst[0] = src[2], dst[1] = src[1], dst[2] = src[0];
188 }
189 break;
190 }
191 }
192
193
194 ret = 0;
195done:
196 png_destroy_read_struct(&png_ptr, info_ptr ? &info_ptr : NULL, (png_infopp)NULL);
197 fclose(fp);
198 return ret;
199}
200
201int writepng(const char *fname, unsigned short *src, int w, int h)
202{
203 png_structp png_ptr = NULL;
204 png_infop info_ptr = NULL;
205 png_bytepp row_pointers;
206 int i, j, ret = -1;
207 FILE *f;
208
209 f = fopen(fname, "wb");
210 if (f == NULL) {
211 lprintf(__FILE__ ": failed to open \"%s\"\n", fname);
212 return -1;
213 }
214
215 row_pointers = calloc(h, sizeof(row_pointers[0]));
216 if (row_pointers == NULL)
217 goto end1;
218
219 for (i = 0; i < h; i++) {
220 unsigned char *dst = malloc(w * 3);
221 if (dst == NULL)
222 goto end2;
223 row_pointers[i] = dst;
224 for (j = 0; j < w; j++, src++, dst += 3) {
225 dst[0] = (*src & 0xf800) >> 8;
226 dst[1] = (*src & 0x07e0) >> 3;
227 dst[2] = (*src & 0x001f) << 3;
228 }
229 }
230
231 /* initialize stuff */
232 png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
233 if (png_ptr == NULL) {
234 fprintf(stderr, "png_create_write_struct() failed");
235 goto end2;
236 }
237
238 info_ptr = png_create_info_struct(png_ptr);
239 if (info_ptr == NULL) {
240 fprintf(stderr, "png_create_info_struct() failed");
241 goto end3;
242 }
243
244 if (setjmp(png_jmpbuf(png_ptr)) != 0) {
245 fprintf(stderr, "error in png code\n");
246 goto end4;
247 }
248
249 png_init_io(png_ptr, f);
250
251 png_set_IHDR(png_ptr, info_ptr, w, h,
252 8, PNG_COLOR_TYPE_RGB, PNG_INTERLACE_NONE,
253 PNG_COMPRESSION_TYPE_DEFAULT, PNG_FILTER_TYPE_DEFAULT);
254
255 png_write_info(png_ptr, info_ptr);
256 png_write_image(png_ptr, row_pointers);
257 png_write_end(png_ptr, NULL);
258
259 ret = 0;
260
261end4:
262// png_destroy_info_struct(png_ptr, &info_ptr); // freed below
263end3:
264 png_destroy_write_struct(&png_ptr, &info_ptr);
265end2:
266 for (i = 0; i < h; i++)
267 free(row_pointers[i]);
268 free(row_pointers);
269end1:
270 fclose(f);
271 return ret;
272}
273