fix a buffer overflow
[libpicofe.git] / readpng.c
1 /*
2  * (C) GraÅžvydas "notaz" Ignotas, 2008-2011
3  *
4  * This work is licensed under the terms of any of these licenses
5  * (at your option):
6  *  - GNU GPL, version 2 or later.
7  *  - GNU LGPL, version 2.1 or later.
8  *  - MAME license.
9  * See the COPYING file in the top-level directory.
10  */
11
12 #include <stdio.h>
13 #include <stdlib.h>
14 #include <string.h>
15 #include <png.h>
16 #include "readpng.h"
17 #include "lprintf.h"
18
19 int readpng(void *dest, const char *fname, readpng_what what, int req_w, int req_h)
20 {
21         FILE *fp;
22         png_structp png_ptr = NULL;
23         png_infop info_ptr = NULL;
24         png_bytepp row_ptr = NULL;
25         int ret = -1;
26
27         if (dest == NULL || fname == NULL)
28         {
29                 return -1;
30         }
31
32         fp = fopen(fname, "rb");
33         if (fp == NULL)
34         {
35                 lprintf(__FILE__ ": failed to open: %s\n", fname);
36                 return -1;
37         }
38
39         png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
40         if (!png_ptr)
41         {
42                 lprintf(__FILE__ ": png_create_read_struct() failed\n");
43                 fclose(fp);
44                 return -1;
45         }
46
47         info_ptr = png_create_info_struct(png_ptr);
48         if (!info_ptr)
49         {
50                 lprintf(__FILE__ ": png_create_info_struct() failed\n");
51                 goto done;
52         }
53
54         // Start reading
55         png_init_io(png_ptr, fp);
56         png_read_png(png_ptr, info_ptr, PNG_TRANSFORM_STRIP_16 | PNG_TRANSFORM_STRIP_ALPHA | PNG_TRANSFORM_PACKING, NULL);
57         row_ptr = png_get_rows(png_ptr, info_ptr);
58         if (row_ptr == NULL)
59         {
60                 lprintf(__FILE__ ": png_get_rows() failed\n");
61                 goto done;
62         }
63
64         // lprintf("%s: %ix%i @ %ibpp\n", fname, (int)png_get_image_width(png_ptr, info_ptr),
65         //      (int)png_get_image_height(png_ptr, info_ptr), png_get_bit_depth(png_ptr, info_ptr));
66
67         switch (what)
68         {
69                 case READPNG_BG:
70                 {
71                         int height, width, h, x_ofs = 0, y_ofs = 0;
72                         unsigned short *dst = dest;
73
74                         if (png_get_bit_depth(png_ptr, info_ptr) != 8)
75                         {
76                                 lprintf(__FILE__ ": bg image uses %ibpc, needed 8bpc\n", png_get_bit_depth(png_ptr, info_ptr));
77                                 break;
78                         }
79                         width = png_get_image_width(png_ptr, info_ptr);
80                         if (width > req_w) {
81                                 x_ofs = (width - req_w) / 2;
82                                 width = req_w;
83                         }
84                         height = png_get_image_height(png_ptr, info_ptr);
85                         if (height > req_h) {
86                                 y_ofs = (height - req_h) / 2;
87                                 height = req_h;
88                         }
89
90                         for (h = 0; h < height; h++)
91                         {
92                                 unsigned char *src = row_ptr[h + y_ofs] + x_ofs * 3;
93                                 int len = width;
94                                 while (len--)
95                                 {
96 #ifdef PSP
97                                         *dst++ = ((src[2]&0xf8)<<8) | ((src[1]&0xf8)<<3) | (src[0] >> 3); // BGR
98 #else
99                                         *dst++ = ((src[0]&0xf8)<<8) | ((src[1]&0xf8)<<3) | (src[2] >> 3); // RGB
100 #endif
101                                         src += 3;
102                                 }
103                                 dst += req_w - width;
104                         }
105                         break;
106                 }
107
108                 case READPNG_FONT:
109                 {
110                         int x, y, x1, y1;
111                         unsigned char *dst = dest;
112                         if (png_get_image_width(png_ptr, info_ptr) != req_w || png_get_image_height(png_ptr, info_ptr) != req_h)
113                         {
114                                 lprintf(__FILE__ ": unexpected font image size %dx%d, needed %dx%d\n",
115                                         (int)png_get_image_width(png_ptr, info_ptr), (int)png_get_image_height(png_ptr, info_ptr), req_w, req_h);
116                                 break;
117                         }
118                         if (png_get_bit_depth(png_ptr, info_ptr) != 8)
119                         {
120                                 lprintf(__FILE__ ": font image uses %ibpp, needed 8bpp\n", png_get_bit_depth(png_ptr, info_ptr));
121                                 break;
122                         }
123                         for (y = 0; y < 16; y++)
124                         {
125                                 for (x = 0; x < 16; x++)
126                                 {
127                                         /* 16x16 grid of syms */
128                                         int sym_w = req_w / 16;
129                                         int sym_h = req_h / 16;
130                                         for (y1 = 0; y1 < sym_h; y1++)
131                                         {
132                                                 unsigned char *src = row_ptr[y*sym_h + y1] + x*sym_w;
133                                                 for (x1 = sym_w/2; x1 > 0; x1--, src+=2)
134                                                         *dst++ = ((src[0]^0xff) & 0xf0) | ((src[1]^0xff) >> 4);
135                                         }
136                                 }
137                         }
138                         break;
139                 }
140
141                 case READPNG_SELECTOR:
142                 {
143                         int x1, y1;
144                         unsigned char *dst = dest;
145                         if (png_get_image_width(png_ptr, info_ptr) != req_w || png_get_image_height(png_ptr, info_ptr) != req_h)
146                         {
147                                 lprintf(__FILE__ ": unexpected selector image size %ix%i, needed %dx%d\n",
148                                         (int)png_get_image_width(png_ptr, info_ptr), (int)png_get_image_height(png_ptr, info_ptr), req_w, req_h);
149                                 break;
150                         }
151                         if (png_get_bit_depth(png_ptr, info_ptr) != 8)
152                         {
153                                 lprintf(__FILE__ ": selector image uses %ibpp, needed 8bpp\n", png_get_bit_depth(png_ptr, info_ptr));
154                                 break;
155                         }
156                         for (y1 = 0; y1 < req_h; y1++)
157                         {
158                                 unsigned char *src = row_ptr[y1];
159                                 for (x1 = req_w/2; x1 > 0; x1--, src+=2)
160                                         *dst++ = ((src[0]^0xff) & 0xf0) | ((src[1]^0xff) >> 4);
161                         }
162                         break;
163                 }
164
165                 case READPNG_24:
166                 {
167                         int height, width, h;
168                         unsigned char *dst = dest;
169                         if (png_get_bit_depth(png_ptr, info_ptr) != 8)
170                         {
171                                 lprintf(__FILE__ ": image uses %ibpc, needed 8bpc\n", png_get_bit_depth(png_ptr, info_ptr));
172                                 break;
173                         }
174                         width = png_get_image_width(png_ptr, info_ptr);
175                         if (width > req_w)
176                                 width = req_w;
177                         height = png_get_image_height(png_ptr, info_ptr);
178                         if (height > req_h)
179                                 height = req_h;
180
181                         for (h = 0; h < height; h++)
182                         {
183                                 int len = width;
184                                 unsigned char *src = row_ptr[h];
185                                 dst += (req_w - width) * 3;
186                                 for (len = width; len > 0; len--, dst+=3, src+=3)
187                                         dst[0] = src[2], dst[1] = src[1], dst[2] = src[0];
188                         }
189                         break;
190                 }
191         }
192
193
194         ret = 0;
195 done:
196         png_destroy_read_struct(&png_ptr, info_ptr ? &info_ptr : NULL, (png_infopp)NULL);
197         fclose(fp);
198         return ret;
199 }
200
201 int writepng(const char *fname, unsigned short *src, int w, int h)
202 {
203         png_structp png_ptr = NULL;
204         png_infop info_ptr = NULL;
205         png_bytepp row_pointers;
206         int i, j, ret = -1;
207         FILE *f;
208
209         f = fopen(fname, "wb");
210         if (f == NULL) {
211                 lprintf(__FILE__ ": failed to open \"%s\"\n", fname);
212                 return -1;
213         }
214
215         row_pointers = calloc(h, sizeof(row_pointers[0]));
216         if (row_pointers == NULL)
217                 goto end1;
218
219         for (i = 0; i < h; i++) {
220                 unsigned char *dst = malloc(w * 3);
221                 if (dst == NULL)
222                         goto end2;
223                 row_pointers[i] = dst;
224                 for (j = 0; j < w; j++, src++, dst += 3) {
225                         dst[0] = (*src & 0xf800) >> 8;
226                         dst[1] = (*src & 0x07e0) >> 3;
227                         dst[2] = (*src & 0x001f) << 3;
228                 }
229         }
230
231         /* initialize stuff */
232         png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
233         if (png_ptr == NULL) {
234                 fprintf(stderr, "png_create_write_struct() failed");
235                 goto end2;
236         }
237
238         info_ptr = png_create_info_struct(png_ptr);
239         if (info_ptr == NULL) {
240                 fprintf(stderr, "png_create_info_struct() failed");
241                 goto end3;
242         }
243
244         if (setjmp(png_jmpbuf(png_ptr)) != 0) {
245                 fprintf(stderr, "error in png code\n");
246                 goto end4;
247         }
248
249         png_init_io(png_ptr, f);
250
251         png_set_IHDR(png_ptr, info_ptr, w, h,
252                 8, PNG_COLOR_TYPE_RGB, PNG_INTERLACE_NONE,
253                 PNG_COMPRESSION_TYPE_DEFAULT, PNG_FILTER_TYPE_DEFAULT);
254
255         png_write_info(png_ptr, info_ptr);
256         png_write_image(png_ptr, row_pointers);
257         png_write_end(png_ptr, NULL);
258
259         ret = 0;
260
261 end4:
262 //      png_destroy_info_struct(png_ptr, &info_ptr); // freed below
263 end3:
264         png_destroy_write_struct(&png_ptr, &info_ptr);
265 end2:
266         for (i = 0; i < h; i++)
267                 free(row_pointers[i]);
268         free(row_pointers);
269 end1:
270         fclose(f);
271         return ret;
272 }
273