Update libpng to 1.2.38 to patch a minor security issue.
diff --git a/pngwio.c b/pngwio.c
index 52eb7c0..f77b2db 100644
--- a/pngwio.c
+++ b/pngwio.c
@@ -1,12 +1,15 @@
/* pngwio.c - functions for data output
*
- * Last changed in libpng 1.2.35 [February 14, 2009]
- * For conditions of distribution and use, see copyright notice in png.h
+ * Last changed in libpng 1.2.37 [June 4, 2009]
* Copyright (c) 1998-2009 Glenn Randers-Pehrson
* (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
* (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
*
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
* This file provides a location for all output. Users who need
* special handling are expected to write functions that have the same
* arguments as these and perform similar functions, but that possibly
@@ -20,10 +23,11 @@
#ifdef PNG_WRITE_SUPPORTED
/* Write the data to whatever output you are using. The default routine
- writes to a file pointer. Note that this routine sometimes gets called
- with very small lengths, so you should implement some kind of simple
- buffering if you are using unbuffered writes. This should never be asked
- to write more than 64K on a 16 bit machine. */
+ * writes to a file pointer. Note that this routine sometimes gets called
+ * with very small lengths, so you should implement some kind of simple
+ * buffering if you are using unbuffered writes. This should never be asked
+ * to write more than 64K on a 16 bit machine.
+ */
void /* PRIVATE */
png_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
@@ -36,16 +40,18 @@
#if !defined(PNG_NO_STDIO)
/* This is the function that does the actual writing of data. If you are
- not writing to a standard C stream, you should create a replacement
- write_data function and use it at run time with png_set_write_fn(), rather
- than changing the library. */
+ * not writing to a standard C stream, you should create a replacement
+ * write_data function and use it at run time with png_set_write_fn(), rather
+ * than changing the library.
+ */
#ifndef USE_FAR_KEYWORD
void PNGAPI
png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
{
png_uint_32 check;
- if (png_ptr == NULL) return;
+ if (png_ptr == NULL)
+ return;
#if defined(_WIN32_WCE)
if ( !WriteFile((HANDLE)(png_ptr->io_ptr), data, length, &check, NULL) )
check = 0;
@@ -56,10 +62,10 @@
png_error(png_ptr, "Write Error");
}
#else
-/* this is the model-independent version. Since the standard I/O library
- can't handle far buffers in the medium and small models, we have to copy
- the data.
-*/
+/* This is the model-independent version. Since the standard I/O library
+ * can't handle far buffers in the medium and small models, we have to copy
+ * the data.
+ */
#define NEAR_BUF_SIZE 1024
#define MIN(a,b) (a <= b ? a : b)
@@ -71,7 +77,8 @@
png_byte *near_data; /* Needs to be "png_byte *" instead of "png_bytep" */
png_FILE_p io_ptr;
- if (png_ptr == NULL) return;
+ if (png_ptr == NULL)
+ return;
/* Check if data really is near. If so, use usual code. */
near_data = (png_byte *)CVT_PTR_NOCHECK(data);
io_ptr = (png_FILE_p)CVT_PTR(png_ptr->io_ptr);
@@ -93,7 +100,7 @@
do
{
written = MIN(NEAR_BUF_SIZE, remaining);
- png_memcpy(buf, data, written); /* copy far buffer to near buffer */
+ png_memcpy(buf, data, written); /* Copy far buffer to near buffer */
#if defined(_WIN32_WCE)
if ( !WriteFile(io_ptr, buf, written, &err, NULL) )
err = 0;
@@ -102,8 +109,10 @@
#endif
if (err != written)
break;
+
else
check += err;
+
data += written;
remaining -= written;
}
@@ -117,8 +126,9 @@
#endif
/* This function is called to output any data pending writing (normally
- to disk). After png_flush is called, there should be no data pending
- writing in any buffers. */
+ * to disk). After png_flush is called, there should be no data pending
+ * writing in any buffers.
+ */
#if defined(PNG_WRITE_FLUSH_SUPPORTED)
void /* PRIVATE */
png_flush(png_structp png_ptr)
@@ -134,48 +144,58 @@
#if !defined(_WIN32_WCE)
png_FILE_p io_ptr;
#endif
- if (png_ptr == NULL) return;
+ if (png_ptr == NULL)
+ return;
#if !defined(_WIN32_WCE)
io_ptr = (png_FILE_p)CVT_PTR((png_ptr->io_ptr));
- if (io_ptr != NULL && fileno(io_ptr) != -1)
- fflush(io_ptr);
+ fflush(io_ptr);
#endif
}
#endif
#endif
/* This function allows the application to supply new output functions for
- libpng if standard C streams aren't being used.
-
- This function takes as its arguments:
- png_ptr - pointer to a png output data structure
- io_ptr - pointer to user supplied structure containing info about
- the output functions. May be NULL.
- write_data_fn - pointer to a new output function that takes as its
- arguments a pointer to a png_struct, a pointer to
- data to be written, and a 32-bit unsigned int that is
- the number of bytes to be written. The new write
- function should call png_error(png_ptr, "Error msg")
- to exit and output any fatal error messages.
- flush_data_fn - pointer to a new flush function that takes as its
- arguments a pointer to a png_struct. After a call to
- the flush function, there should be no data in any buffers
- or pending transmission. If the output method doesn't do
- any buffering of ouput, a function prototype must still be
- supplied although it doesn't have to do anything. If
- PNG_WRITE_FLUSH_SUPPORTED is not defined at libpng compile
- time, output_flush_fn will be ignored, although it must be
- supplied for compatibility. */
+ * libpng if standard C streams aren't being used.
+ *
+ * This function takes as its arguments:
+ * png_ptr - pointer to a png output data structure
+ * io_ptr - pointer to user supplied structure containing info about
+ * the output functions. May be NULL.
+ * write_data_fn - pointer to a new output function that takes as its
+ * arguments a pointer to a png_struct, a pointer to
+ * data to be written, and a 32-bit unsigned int that is
+ * the number of bytes to be written. The new write
+ * function should call png_error(png_ptr, "Error msg")
+ * to exit and output any fatal error messages. May be
+ * NULL, in which case libpng's default function will
+ * be used.
+ * flush_data_fn - pointer to a new flush function that takes as its
+ * arguments a pointer to a png_struct. After a call to
+ * the flush function, there should be no data in any buffers
+ * or pending transmission. If the output method doesn't do
+ * any buffering of ouput, a function prototype must still be
+ * supplied although it doesn't have to do anything. If
+ * PNG_WRITE_FLUSH_SUPPORTED is not defined at libpng compile
+ * time, output_flush_fn will be ignored, although it must be
+ * supplied for compatibility. May be NULL, in which case
+ * libpng's default function will be used, if
+ * PNG_WRITE_FLUSH_SUPPORTED is defined. This is not
+ * a good idea if io_ptr does not point to a standard
+ * *FILE structure.
+ */
void PNGAPI
png_set_write_fn(png_structp png_ptr, png_voidp io_ptr,
png_rw_ptr write_data_fn, png_flush_ptr output_flush_fn)
{
- if (png_ptr == NULL) return;
+ if (png_ptr == NULL)
+ return;
+
png_ptr->io_ptr = io_ptr;
#if !defined(PNG_NO_STDIO)
if (write_data_fn != NULL)
png_ptr->write_data_fn = write_data_fn;
+
else
png_ptr->write_data_fn = png_default_write_data;
#else
@@ -186,6 +206,7 @@
#if !defined(PNG_NO_STDIO)
if (output_flush_fn != NULL)
png_ptr->output_flush_fn = output_flush_fn;
+
else
png_ptr->output_flush_fn = png_default_flush;
#else
@@ -212,9 +233,11 @@
void FAR *far_ptr;
FP_OFF(near_ptr) = FP_OFF(ptr);
far_ptr = (void FAR *)near_ptr;
+
if (check != 0)
if (FP_SEG(ptr) != FP_SEG(far_ptr))
png_error(png_ptr, "segment lost in conversion");
+
return(near_ptr);
}
# else
@@ -224,9 +247,11 @@
void FAR *far_ptr;
near_ptr = (void FAR *)ptr;
far_ptr = (void FAR *)near_ptr;
+
if (check != 0)
if (far_ptr != ptr)
png_error(png_ptr, "segment lost in conversion");
+
return(near_ptr);
}
# endif