FFmpeg coverage

Directory: ../../../ffmpeg/
File: src/libavcodec/pngdec.c
Date: 2026-06-16 12:54:33
Exec Total Coverage
Lines: 724 1182 61.3%
Functions: 26 33 78.8%
Branches: 481 903 53.3%
Line Branch Exec Source
1 /*
2 * PNG image format
3 * Copyright (c) 2003 Fabrice Bellard
4 *
5 * This file is part of FFmpeg.
6 *
7 * FFmpeg is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
11 *
12 * FFmpeg is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with FFmpeg; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20 */
21
22 //#define DEBUG
23
24 #include "config_components.h"
25
26 #include "libavutil/attributes.h"
27 #include "libavutil/avassert.h"
28 #include "libavutil/bprint.h"
29 #include "libavutil/crc.h"
30 #include "libavutil/csp.h"
31 #include "libavutil/imgutils.h"
32 #include "libavutil/intreadwrite.h"
33 #include "libavutil/mastering_display_metadata.h"
34 #include "libavutil/mem.h"
35 #include "libavutil/pixfmt.h"
36 #include "libavutil/rational.h"
37 #include "libavutil/stereo3d.h"
38
39 #include "avcodec.h"
40 #include "bytestream.h"
41 #include "codec_internal.h"
42 #include "decode.h"
43 #include "exif_internal.h"
44 #include "apng.h"
45 #include "png.h"
46 #include "pngdsp.h"
47 #include "progressframe.h"
48 #include "thread.h"
49 #include "zlib_wrapper.h"
50
51 #include <zlib.h>
52
53 enum PNGHeaderState {
54 PNG_IHDR = 1 << 0,
55 PNG_PLTE = 1 << 1,
56 };
57
58 enum PNGImageState {
59 PNG_IDAT = 1 << 0,
60 PNG_ALLIMAGE = 1 << 1,
61 };
62
63 typedef struct PNGDecContext {
64 PNGDSPContext dsp;
65 AVCodecContext *avctx;
66
67 GetByteContext gb;
68 ProgressFrame last_picture;
69 ProgressFrame picture;
70
71 AVDictionary *frame_metadata;
72
73 uint8_t iccp_name[82];
74 uint8_t *iccp_data;
75 size_t iccp_data_len;
76
77 int stereo_mode;
78
79 int have_chrm;
80 uint32_t white_point[2];
81 uint32_t display_primaries[3][2];
82 int gamma;
83 int have_srgb;
84 int have_cicp;
85 enum AVColorPrimaries cicp_primaries;
86 enum AVColorTransferCharacteristic cicp_trc;
87 enum AVColorRange cicp_range;
88 int have_clli;
89 uint32_t clli_max;
90 uint32_t clli_avg;
91 /* Mastering Display Color Volume */
92 int have_mdcv;
93 uint16_t mdcv_primaries[3][2];
94 uint16_t mdcv_white_point[2];
95 uint32_t mdcv_max_lum;
96 uint32_t mdcv_min_lum;
97
98 enum PNGHeaderState hdr_state;
99 enum PNGImageState pic_state;
100 int width, height;
101 int cur_w, cur_h;
102 int x_offset, y_offset;
103 uint8_t dispose_op, blend_op;
104 int bit_depth;
105 int color_type;
106 int compression_type;
107 int interlace_type;
108 int filter_type;
109 int channels;
110 int bits_per_pixel;
111 int bpp;
112 int has_trns;
113 uint8_t transparent_color_be[6];
114 int significant_bits;
115
116 uint32_t palette[256];
117 uint8_t *crow_buf;
118 uint8_t *last_row;
119 unsigned int last_row_size;
120 uint8_t *tmp_row;
121 unsigned int tmp_row_size;
122 uint8_t *buffer;
123 int buffer_size;
124 int pass;
125 int crow_size; /* compressed row size (include filter type) */
126 int row_size; /* decompressed row size */
127 int pass_row_size; /* decompress row size of the current pass */
128 int y;
129 FFZStream zstream;
130
131 AVBufferRef *exif_data;
132 } PNGDecContext;
133
134 /* Mask to determine which pixels are valid in a pass */
135 static const uint8_t png_pass_mask[NB_PASSES] = {
136 0x01, 0x01, 0x11, 0x11, 0x55, 0x55, 0xff,
137 };
138
139 /* Mask to determine which y pixels can be written in a pass */
140 static const uint8_t png_pass_dsp_ymask[NB_PASSES] = {
141 0xff, 0xff, 0x0f, 0xff, 0x33, 0xff, 0x55,
142 };
143
144 /* Mask to determine which pixels to overwrite while displaying */
145 static const uint8_t png_pass_dsp_mask[NB_PASSES] = {
146 0xff, 0x0f, 0xff, 0x33, 0xff, 0x55, 0xff
147 };
148
149 /* NOTE: we try to construct a good looking image at each pass. width
150 * is the original image width. We also do pixel format conversion at
151 * this stage */
152 5632 static void png_put_interlaced_row(uint8_t *dst, int width,
153 int bits_per_pixel, int pass,
154 int color_type, const uint8_t *src)
155 {
156 int x, mask, dsp_mask, j, src_x, b, bpp;
157 uint8_t *d;
158 const uint8_t *s;
159
160 5632 mask = png_pass_mask[pass];
161 5632 dsp_mask = png_pass_dsp_mask[pass];
162
163
1/4
✗ Branch 0 not taken.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 5632 times.
 5632 switch (bits_per_pixel) {
164 ✗ case 1:
165 ✗ src_x = 0;
166 ✗ for (x = 0; x < width; x++) {
167 ✗ j = (x & 7);
168 ✗ if ((dsp_mask << j) & 0x80) {
169 ✗ b = (src[src_x >> 3] >> (7 - (src_x & 7))) & 1;
170 ✗ dst[x >> 3] &= 0xFF7F>>j;
171 ✗ dst[x >> 3] |= b << (7 - j);
172 }
173 ✗ if ((mask << j) & 0x80)
174 ✗ src_x++;
175 }
176 ✗ break;
177 ✗ case 2:
178 ✗ src_x = 0;
179 ✗ for (x = 0; x < width; x++) {
180 ✗ int j2 = 2 * (x & 3);
181 ✗ j = (x & 7);
182 ✗ if ((dsp_mask << j) & 0x80) {
183 ✗ b = (src[src_x >> 2] >> (6 - 2*(src_x & 3))) & 3;
184 ✗ dst[x >> 2] &= 0xFF3F>>j2;
185 ✗ dst[x >> 2] |= b << (6 - j2);
186 }
187 ✗ if ((mask << j) & 0x80)
188 ✗ src_x++;
189 }
190 ✗ break;
191 ✗ case 4:
192 ✗ src_x = 0;
193 ✗ for (x = 0; x < width; x++) {
194 ✗ int j2 = 4*(x&1);
195 ✗ j = (x & 7);
196 ✗ if ((dsp_mask << j) & 0x80) {
197 ✗ b = (src[src_x >> 1] >> (4 - 4*(src_x & 1))) & 15;
198 ✗ dst[x >> 1] &= 0xFF0F>>j2;
199 ✗ dst[x >> 1] |= b << (4 - j2);
200 }
201 ✗ if ((mask << j) & 0x80)
202 ✗ src_x++;
203 }
204 ✗ break;
205 5632 default:
206 5632 bpp = bits_per_pixel >> 3;
207 5632 d = dst;
208 5632 s = src;
209
2/2
✓ Branch 0 taken 720896 times.
✓ Branch 1 taken 5632 times.
 726528 for (x = 0; x < width; x++) {
210 720896 j = x & 7;
211
2/2
✓ Branch 0 taken 524288 times.
✓ Branch 1 taken 196608 times.
 720896 if ((dsp_mask << j) & 0x80) {
212 524288 memcpy(d, s, bpp);
213 }
214 720896 d += bpp;
215
2/2
✓ Branch 0 taken 245760 times.
✓ Branch 1 taken 475136 times.
 720896 if ((mask << j) & 0x80)
216 245760 s += bpp;
217 }
218 5632 break;
219 }
220 5632 }
221
222 #define UNROLL1(bpp, op) \
223 { \
224 r = dst[0]; \
225 if (bpp >= 2) \
226 g = dst[1]; \
227 if (bpp >= 3) \
228 b = dst[2]; \
229 if (bpp >= 4) \
230 a = dst[3]; \
231 for (; i <= size - bpp; i += bpp) { \
232 dst[i + 0] = r = op(r, src[i + 0], last[i + 0]); \
233 if (bpp == 1) \
234 continue; \
235 dst[i + 1] = g = op(g, src[i + 1], last[i + 1]); \
236 if (bpp == 2) \
237 continue; \
238 dst[i + 2] = b = op(b, src[i + 2], last[i + 2]); \
239 if (bpp == 3) \
240 continue; \
241 dst[i + 3] = a = op(a, src[i + 3], last[i + 3]); \
242 } \
243 }
244
245 #define UNROLL_FILTER(op) \
246 if (bpp == 1) { \
247 UNROLL1(1, op) \
248 } else if (bpp == 2) { \
249 UNROLL1(2, op) \
250 } else if (bpp == 3) { \
251 UNROLL1(3, op) \
252 } else if (bpp == 4) { \
253 UNROLL1(4, op) \
254 } \
255 for (; i < size; i++) { \
256 dst[i] = op(dst[i - bpp], src[i], last[i]); \
257 }
258
259 /* NOTE: 'dst' can be equal to 'last' */
260 132068 void ff_png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
261 const uint8_t *src, const uint8_t *last, int size, int bpp)
262 {
263 int i, p, r, g, b, a;
264
265
5/6
✓ Branch 0 taken 4782 times.
✓ Branch 1 taken 4840 times.
✓ Branch 2 taken 11474 times.
✓ Branch 3 taken 2761 times.
✓ Branch 4 taken 108211 times.
✗ Branch 5 not taken.
 132068 switch (filter_type) {
266 4782 case PNG_FILTER_VALUE_NONE:
267 4782 memcpy(dst, src, size);
268 4782 break;
269 4840 case PNG_FILTER_VALUE_SUB:
270
2/2
✓ Branch 0 taken 17233 times.
✓ Branch 1 taken 4840 times.
 22073 for (i = 0; i < bpp; i++)
271 17233 dst[i] = src[i];
272
2/2
✓ Branch 0 taken 2655 times.
✓ Branch 1 taken 2185 times.
 4840 if (bpp == 4) {
273 2655 p = *(int *)dst;
274
2/2
✓ Branch 0 taken 408525 times.
✓ Branch 1 taken 2655 times.
 411180 for (; i < size; i += bpp) {
275 408525 unsigned s = *(const int *)(src + i);
276 408525 p = ((s & 0x7f7f7f7f) + (p & 0x7f7f7f7f)) ^ ((s ^ p) & 0x80808080);
277 408525 *(int *)(dst + i) = p;
278 }
279 } else {
280 #define OP_SUB(x, s, l) ((x) + (s))
281
12/18
✗ Branch 0 not taken.
✓ Branch 1 taken 2185 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✓ Branch 4 taken 16 times.
✓ Branch 5 taken 2169 times.
✓ Branch 6 taken 5168 times.
✓ Branch 7 taken 16 times.
✓ Branch 8 taken 2147 times.
✓ Branch 9 taken 22 times.
✓ Branch 10 taken 451818 times.
✓ Branch 11 taken 2147 times.
✗ Branch 12 not taken.
✓ Branch 13 taken 22 times.
✗ Branch 14 not taken.
✗ Branch 15 not taken.
✓ Branch 16 taken 36596 times.
✓ Branch 17 taken 2185 times.
 495767 UNROLL_FILTER(OP_SUB);
282 }
283 4840 break;
284 11474 case PNG_FILTER_VALUE_UP:
285 11474 dsp->add_bytes_l2(dst, src, last, size);
286 11474 break;
287 2761 case PNG_FILTER_VALUE_AVG:
288
2/2
✓ Branch 0 taken 8941 times.
✓ Branch 1 taken 2761 times.
 11702 for (i = 0; i < bpp; i++) {
289 8941 p = (last[i] >> 1);
290 8941 dst[i] = p + src[i];
291 }
292 #define OP_AVG(x, s, l) (((((x) + (l)) >> 1) + (s)) & 0xff)
293
15/18
✗ Branch 0 not taken.
✓ Branch 1 taken 2761 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✓ Branch 4 taken 2 times.
✓ Branch 5 taken 2759 times.
✓ Branch 6 taken 254 times.
✓ Branch 7 taken 2 times.
✓ Branch 8 taken 2155 times.
✓ Branch 9 taken 604 times.
✓ Branch 10 taken 322665 times.
✓ Branch 11 taken 2155 times.
✓ Branch 12 taken 576 times.
✓ Branch 13 taken 28 times.
✓ Branch 14 taken 48974 times.
✓ Branch 15 taken 576 times.
✓ Branch 16 taken 21336 times.
✓ Branch 17 taken 2761 times.
 395990 UNROLL_FILTER(OP_AVG);
294 2761 break;
295 108211 case PNG_FILTER_VALUE_PAETH:
296
2/2
✓ Branch 0 taken 335650 times.
✓ Branch 1 taken 108211 times.
 443861 for (i = 0; i < bpp; i++) {
297 335650 p = last[i];
298 335650 dst[i] = p + src[i];
299 }
300
3/4
✓ Branch 0 taken 104123 times.
✓ Branch 1 taken 4088 times.
✓ Branch 2 taken 104123 times.
✗ Branch 3 not taken.
 108211 if (bpp > 2 && size > 4) {
301 /* would write off the end of the array if we let it process
302 * the last pixel with bpp=3 */
303
2/2
✓ Branch 0 taken 101700 times.
✓ Branch 1 taken 2423 times.
 104123 int w = (bpp & 3) ? size - 3 : size;
304
305
1/2
✓ Branch 0 taken 104123 times.
✗ Branch 1 not taken.
 104123 if (w > i) {
306 104123 dsp->add_paeth_prediction(dst + i, src + i, last + i, size - i, bpp);
307 104123 i = w;
308 }
309 }
310 108211 ff_png_add_paeth_prediction(dst + i, src + i, last + i, size - i, bpp);
311 108211 break;
312 }
313 132068 }
314
315 /* This used to be called "deloco" in FFmpeg
316 * and is actually an inverse reversible colorspace transformation */
317 #define YUV2RGB(NAME, TYPE) \
318 static void deloco_ ## NAME(TYPE *dst, int size, int alpha) \
319 { \
320 int i; \
321 for (i = 0; i < size - 2; i += 3 + alpha) { \
322 int g = dst [i + 1]; \
323 dst[i + 0] += g; \
324 dst[i + 2] += g; \
325 } \
326 }
327
328 ✗ YUV2RGB(rgb8, uint8_t)
329 ✗ YUV2RGB(rgb16, uint16_t)
330
331 587 static int percent_missing(PNGDecContext *s)
332 {
333
2/2
✓ Branch 0 taken 4 times.
✓ Branch 1 taken 583 times.
 587 if (s->interlace_type) {
334 4 return 100 - 100 * s->pass / (NB_PASSES - 1);
335 } else {
336 583 return 100 - 100 * s->y / s->cur_h;
337 }
338 }
339
340 /* process exactly one decompressed row */
341 127827 static void png_handle_row(PNGDecContext *s, uint8_t *dst, ptrdiff_t dst_stride)
342 {
343 uint8_t *ptr, *last_row;
344 int got_line;
345
346
2/2
✓ Branch 0 taken 125907 times.
✓ Branch 1 taken 1920 times.
 127827 if (!s->interlace_type) {
347 125907 ptr = dst + dst_stride * (s->y + s->y_offset) + s->x_offset * s->bpp;
348
2/2
✓ Branch 0 taken 659 times.
✓ Branch 1 taken 125248 times.
 125907 if (s->y == 0)
349 659 last_row = s->last_row;
350 else
351 125248 last_row = ptr - dst_stride;
352
353 125907 ff_png_filter_row(&s->dsp, ptr, s->crow_buf[0], s->crow_buf + 1,
354 last_row, s->row_size, s->bpp);
355 /* loco lags by 1 row so that it doesn't interfere with top prediction */
356
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 125907 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 125907 if (s->filter_type == PNG_FILTER_TYPE_LOCO && s->y > 0) {
357 ✗ if (s->bit_depth == 16) {
358 ✗ deloco_rgb16((uint16_t *)(ptr - dst_stride), s->row_size / 2,
359 ✗ s->color_type == PNG_COLOR_TYPE_RGB_ALPHA);
360 } else {
361 ✗ deloco_rgb8(ptr - dst_stride, s->row_size,
362 ✗ s->color_type == PNG_COLOR_TYPE_RGB_ALPHA);
363 }
364 }
365 125907 s->y++;
366
2/2
✓ Branch 0 taken 659 times.
✓ Branch 1 taken 125248 times.
 125907 if (s->y == s->cur_h) {
367 659 s->pic_state |= PNG_ALLIMAGE;
368
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 659 times.
 659 if (s->filter_type == PNG_FILTER_TYPE_LOCO) {
369 ✗ if (s->bit_depth == 16) {
370 ✗ deloco_rgb16((uint16_t *)ptr, s->row_size / 2,
371 ✗ s->color_type == PNG_COLOR_TYPE_RGB_ALPHA);
372 } else {
373 ✗ deloco_rgb8(ptr, s->row_size,
374 ✗ s->color_type == PNG_COLOR_TYPE_RGB_ALPHA);
375 }
376 }
377 }
378 } else {
379 1920 got_line = 0;
380 for (;;) {
381 9080 ptr = dst + dst_stride * (s->y + s->y_offset) + s->x_offset * s->bpp;
382
2/2
✓ Branch 0 taken 3832 times.
✓ Branch 1 taken 5248 times.
 9080 if ((ff_png_pass_ymask[s->pass] << (s->y & 7)) & 0x80) {
383 /* if we already read one row, it is time to stop to
384 * wait for the next one */
385
2/2
✓ Branch 0 taken 1912 times.
✓ Branch 1 taken 1920 times.
 3832 if (got_line)
386 1912 break;
387 1920 ff_png_filter_row(&s->dsp, s->tmp_row, s->crow_buf[0], s->crow_buf + 1,
388 1920 s->last_row, s->pass_row_size, s->bpp);
389 1920 FFSWAP(uint8_t *, s->last_row, s->tmp_row);
390 1920 FFSWAP(unsigned int, s->last_row_size, s->tmp_row_size);
391 1920 got_line = 1;
392 }
393
2/2
✓ Branch 0 taken 5632 times.
✓ Branch 1 taken 1536 times.
 7168 if ((png_pass_dsp_ymask[s->pass] << (s->y & 7)) & 0x80) {
394 5632 png_put_interlaced_row(ptr, s->cur_w, s->bits_per_pixel, s->pass,
395 5632 s->color_type, s->last_row);
396 }
397 7168 s->y++;
398
2/2
✓ Branch 0 taken 56 times.
✓ Branch 1 taken 7112 times.
 7168 if (s->y == s->cur_h) {
399 56 memset(s->last_row, 0, s->row_size);
400 for (;;) {
401
2/2
✓ Branch 0 taken 8 times.
✓ Branch 1 taken 48 times.
 56 if (s->pass == NB_PASSES - 1) {
402 8 s->pic_state |= PNG_ALLIMAGE;
403 8 goto the_end;
404 } else {
405 48 s->pass++;
406 48 s->y = 0;
407 48 s->pass_row_size = ff_png_pass_row_size(s->pass,
408 s->bits_per_pixel,
409 s->cur_w);
410 48 s->crow_size = s->pass_row_size + 1;
411
1/2
✓ Branch 0 taken 48 times.
✗ Branch 1 not taken.
 48 if (s->pass_row_size != 0)
412 48 break;
413 /* skip pass if empty row */
414 }
415 }
416 }
417 }
418 1920 the_end:;
419 }
420 127827 }
421
422 12454 static int png_decode_idat(PNGDecContext *s, GetByteContext *gb,
423 uint8_t *dst, ptrdiff_t dst_stride)
424 {
425 12454 z_stream *const zstream = &s->zstream.zstream;
426 int ret;
427 12454 zstream->avail_in = bytestream2_get_bytes_left(gb);
428 12454 zstream->next_in = gb->buffer;
429
430 /* decode one line if possible */
431
2/2
✓ Branch 0 taken 139582 times.
✓ Branch 1 taken 12454 times.
 152036 while (zstream->avail_in > 0) {
432 139582 ret = inflate(zstream, Z_PARTIAL_FLUSH);
433
3/4
✓ Branch 0 taken 667 times.
✓ Branch 1 taken 138915 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 667 times.
 139582 if (ret != Z_OK && ret != Z_STREAM_END) {
434 ✗ av_log(s->avctx, AV_LOG_ERROR, "inflate returned error %d\n", ret);
435 ✗ return AVERROR_EXTERNAL;
436 }
437
2/2
✓ Branch 0 taken 127827 times.
✓ Branch 1 taken 11755 times.
 139582 if (zstream->avail_out == 0) {
438
1/2
✓ Branch 0 taken 127827 times.
✗ Branch 1 not taken.
 127827 if (!(s->pic_state & PNG_ALLIMAGE)) {
439 127827 png_handle_row(s, dst, dst_stride);
440 }
441 127827 zstream->avail_out = s->crow_size;
442 127827 zstream->next_out = s->crow_buf;
443 }
444
3/4
✓ Branch 0 taken 667 times.
✓ Branch 1 taken 138915 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 667 times.
 139582 if (ret == Z_STREAM_END && zstream->avail_in > 0) {
445 ✗ av_log(s->avctx, AV_LOG_WARNING,
446 "%d undecompressed bytes left in buffer\n", zstream->avail_in);
447 ✗ return 0;
448 }
449 }
450 12454 return 0;
451 }
452
453 /* Hard cap on decompressed zTXt/iCCP payloads to defeat decompression bombs. */
454 #define PNG_ZBUF_MAX_DECOMPRESSED (16 * 1024 * 1024)
455
456 6 static int decode_zbuf(AVBPrint *bp, const uint8_t *data,
457 const uint8_t *data_end, void *logctx)
458 {
459 FFZStream z;
460 6 z_stream *const zstream = &z.zstream;
461 unsigned char *buf;
462 unsigned buf_size;
463 6 int ret = ff_inflate_init(&z, logctx);
464
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 6 times.
 6 if (ret < 0)
465 ✗ return ret;
466
467 6 zstream->next_in = data;
468 6 zstream->avail_in = data_end - data;
469 6 av_bprint_init(bp, 0, AV_BPRINT_SIZE_UNLIMITED);
470
471
1/2
✓ Branch 0 taken 18 times.
✗ Branch 1 not taken.
 18 while (zstream->avail_in > 0) {
472
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 18 times.
 18 if (bp->len > PNG_ZBUF_MAX_DECOMPRESSED) {
473 ✗ av_log(logctx, AV_LOG_ERROR,
474 "Compressed PNG chunk expands beyond %d bytes, aborting\n",
475 PNG_ZBUF_MAX_DECOMPRESSED);
476 ✗ ret = AVERROR_INVALIDDATA;
477 ✗ goto fail;
478 }
479 18 av_bprint_get_buffer(bp, 2, &buf, &buf_size);
480
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 18 times.
 18 if (buf_size < 2) {
481 ✗ ret = AVERROR(ENOMEM);
482 ✗ goto fail;
483 }
484 18 zstream->next_out = buf;
485 18 zstream->avail_out = buf_size - 1;
486 18 ret = inflate(zstream, Z_PARTIAL_FLUSH);
487
3/4
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 12 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 6 times.
 18 if (ret != Z_OK && ret != Z_STREAM_END) {
488 ✗ ret = AVERROR_EXTERNAL;
489 ✗ goto fail;
490 }
491 18 bp->len += zstream->next_out - buf;
492
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 12 times.
 18 if (ret == Z_STREAM_END)
493 6 break;
494 }
495 6 ff_inflate_end(&z);
496 6 bp->str[bp->len] = 0;
497 6 return 0;
498
499 ✗ fail:
500 ✗ ff_inflate_end(&z);
501 ✗ av_bprint_finalize(bp, NULL);
502 ✗ return ret;
503 }
504
505 276 static char *iso88591_to_utf8(const char *in, size_t size_in)
506 {
507 276 size_t extra = 0, i;
508 char *out, *q;
509
510
2/2
✓ Branch 0 taken 4545 times.
✓ Branch 1 taken 276 times.
 4821 for (i = 0; i < size_in; i++)
511 4545 extra += !!(in[i] & 0x80);
512
2/4
✓ Branch 0 taken 276 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 276 times.
 276 if (size_in == SIZE_MAX || extra > SIZE_MAX - size_in - 1)
513 ✗ return NULL;
514 276 q = out = av_malloc(size_in + extra + 1);
515
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 276 times.
 276 if (!out)
516 ✗ return NULL;
517
2/2
✓ Branch 0 taken 4545 times.
✓ Branch 1 taken 276 times.
 4821 for (i = 0; i < size_in; i++) {
518
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4545 times.
 4545 if (in[i] & 0x80) {
519 ✗ *(q++) = 0xC0 | (in[i] >> 6);
520 ✗ *(q++) = 0x80 | (in[i] & 0x3F);
521 } else {
522 4545 *(q++) = in[i];
523 }
524 }
525 276 *(q++) = 0;
526 276 return out;
527 }
528
529 ✗ static int decode_text_to_exif(PNGDecContext *s, const char *txt_utf8)
530 {
531 ✗ size_t len = strlen(txt_utf8);
532 ✗ const char *ptr = txt_utf8;
533 ✗ const char *end = txt_utf8 + len;
534 ✗ size_t exif_len = 0;
535 uint8_t *exif_ptr;
536 const uint8_t *exif_end;
537
538 // first we find a newline
539 ✗ while (*ptr++ != '\n') {
540 ✗ if (ptr >= end)
541 ✗ return AVERROR_BUFFER_TOO_SMALL;
542 }
543
544 // we check for "exif" and skip over it
545 ✗ if (end - ptr < 4 || strncmp("exif", ptr, 4))
546 ✗ return AVERROR_INVALIDDATA;
547 ✗ ptr += 3;
548
549 // then we find the next printable non-space character
550 ✗ while (!av_isgraph(*++ptr)) {
551 ✗ if (ptr >= end)
552 ✗ return AVERROR_BUFFER_TOO_SMALL;
553 }
554
555 // parse the length
556 ✗ while (av_isdigit(*ptr)) {
557 ✗ size_t nlen = exif_len * 10 + (*ptr - '0');
558 ✗ if (nlen < exif_len) // overflow
559 ✗ return AVERROR_INVALIDDATA;
560 ✗ exif_len = nlen;
561 ✗ if (++ptr >= end)
562 ✗ return AVERROR_BUFFER_TOO_SMALL;
563 }
564
565 // then we find the next printable non-space character
566 ✗ while (!av_isgraph(*ptr)) {
567 ✗ if (++ptr >= end)
568 ✗ return AVERROR_BUFFER_TOO_SMALL;
569 }
570
571 // first condition checks for overflow in 2 * exif_len
572 ✗ if (exif_len > SIZE_MAX / 2 || end - ptr < 2 * exif_len)
573 ✗ return AVERROR_INVALIDDATA;
574 ✗ if (exif_len < 10)
575 ✗ return AVERROR_INVALIDDATA;
576
577 ✗ av_buffer_unref(&s->exif_data);
578 // the buffer starts with "Exif " which we skip over
579 // we don't use AV_EXIF_EXIF00 because that disagrees
580 // with the eXIf chunk format
581 ✗ s->exif_data = av_buffer_alloc(exif_len - 6);
582 ✗ if (!s->exif_data)
583 ✗ return AVERROR(ENOMEM);
584
585 // we subtract one because we call ++ptr later
586 // compiler will optimize out the call
587 ✗ ptr += strlen("Exif ") * 2 - 1;
588
589 ✗ exif_ptr = s->exif_data->data;
590 ✗ exif_end = exif_ptr + s->exif_data->size;
591
592 ✗ while (exif_ptr < exif_end) {
593 ✗ while (++ptr < end) {
594 ✗ if (*ptr >= '0' && *ptr <= '9') {
595 ✗ *exif_ptr = (*ptr - '0') << 4;
596 ✗ break;
597 }
598 ✗ if (*ptr >= 'a' && *ptr <= 'f') {
599 ✗ *exif_ptr = (*ptr - 'a' + 10) << 4;
600 ✗ break;
601 }
602 }
603 ✗ while (++ptr < end) {
604 ✗ if (*ptr >= '0' && *ptr <= '9') {
605 ✗ *exif_ptr += *ptr - '0';
606 ✗ break;
607 }
608 ✗ if (*ptr >= 'a' && *ptr <= 'f') {
609 ✗ *exif_ptr += *ptr - 'a' + 10;
610 ✗ break;
611 }
612 }
613 ✗ if (ptr > end)
614 ✗ return AVERROR_INVALIDDATA;
615 ✗ exif_ptr++;
616 }
617
618 ✗ return 0;
619 }
620
621 138 static int decode_text_chunk(PNGDecContext *s, GetByteContext *gb, int compressed)
622 {
623 int ret, method;
624 138 const uint8_t *data = gb->buffer;
625 138 const uint8_t *data_end = gb->buffer_end;
626 138 const char *keyword = data;
627 138 const char *keyword_end = memchr(keyword, 0, data_end - data);
628 138 char *kw_utf8 = NULL, *txt_utf8 = NULL;
629 const char *text;
630 unsigned text_len;
631 AVBPrint bp;
632
633
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 138 times.
 138 if (!keyword_end)
634 ✗ return AVERROR_INVALIDDATA;
635 138 data = keyword_end + 1;
636
637
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 138 times.
 138 if (compressed) {
638 ✗ if (data == data_end)
639 ✗ return AVERROR_INVALIDDATA;
640 ✗ method = *(data++);
641 ✗ if (method)
642 ✗ return AVERROR_INVALIDDATA;
643 ✗ if ((ret = decode_zbuf(&bp, data, data_end, s->avctx)) < 0)
644 ✗ return ret;
645 ✗ text = bp.str;
646 ✗ text_len = bp.len;
647 } else {
648 138 text = data;
649 138 text_len = data_end - data;
650 }
651
652 138 txt_utf8 = iso88591_to_utf8(text, text_len);
653
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 138 times.
 138 if (compressed)
654 ✗ av_bprint_finalize(&bp, NULL);
655
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 138 times.
 138 if (!txt_utf8)
656 ✗ return AVERROR(ENOMEM);
657 138 kw_utf8 = iso88591_to_utf8(keyword, keyword_end - keyword);
658
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 138 times.
 138 if (!kw_utf8) {
659 ✗ av_free(txt_utf8);
660 ✗ return AVERROR(ENOMEM);
661 }
662
663
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 138 times.
 138 if (!strcmp(kw_utf8, "Raw profile type exif")) {
664 ✗ ret = decode_text_to_exif(s, txt_utf8);
665 ✗ if (ret < 0) {;
666 ✗ av_buffer_unref(&s->exif_data);
667 } else {
668 ✗ av_freep(&kw_utf8);
669 ✗ av_freep(&txt_utf8);
670 ✗ return ret;
671 }
672 }
673
674 138 av_dict_set(&s->frame_metadata, kw_utf8, txt_utf8,
675 AV_DICT_DONT_STRDUP_KEY | AV_DICT_DONT_STRDUP_VAL);
676 138 return 0;
677 }
678
679 422 static int decode_ihdr_chunk(AVCodecContext *avctx, PNGDecContext *s,
680 GetByteContext *gb)
681 {
682
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 422 times.
 422 if (bytestream2_get_bytes_left(gb) != 13)
683 ✗ return AVERROR_INVALIDDATA;
684
685
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 422 times.
 422 if (s->pic_state & PNG_IDAT) {
686 ✗ av_log(avctx, AV_LOG_ERROR, "IHDR after IDAT\n");
687 ✗ return AVERROR_INVALIDDATA;
688 }
689
690
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 422 times.
 422 if (s->hdr_state & PNG_IHDR) {
691 ✗ av_log(avctx, AV_LOG_ERROR, "Multiple IHDR\n");
692 ✗ return AVERROR_INVALIDDATA;
693 }
694
695 422 s->width = s->cur_w = bytestream2_get_be32(gb);
696 422 s->height = s->cur_h = bytestream2_get_be32(gb);
697
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 422 times.
 422 if (av_image_check_size(s->width, s->height, 0, avctx)) {
698 ✗ s->cur_w = s->cur_h = s->width = s->height = 0;
699 ✗ av_log(avctx, AV_LOG_ERROR, "Invalid image size\n");
700 ✗ return AVERROR_INVALIDDATA;
701 }
702 422 s->bit_depth = bytestream2_get_byte(gb);
703
3/6
✓ Branch 0 taken 422 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 422 times.
✗ Branch 3 not taken.
✓ Branch 4 taken 422 times.
✗ Branch 5 not taken.
 422 if (s->bit_depth != 1 && s->bit_depth != 2 && s->bit_depth != 4 &&
704
3/4
✓ Branch 0 taken 40 times.
✓ Branch 1 taken 382 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 40 times.
 422 s->bit_depth != 8 && s->bit_depth != 16) {
705 ✗ av_log(avctx, AV_LOG_ERROR, "Invalid bit depth\n");
706 ✗ goto error;
707 }
708 422 s->color_type = bytestream2_get_byte(gb);
709 422 s->compression_type = bytestream2_get_byte(gb);
710
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 422 times.
 422 if (s->compression_type) {
711 ✗ av_log(avctx, AV_LOG_ERROR, "Invalid compression method %d\n", s->compression_type);
712 ✗ goto error;
713 }
714 422 s->filter_type = bytestream2_get_byte(gb);
715 422 s->interlace_type = bytestream2_get_byte(gb);
716 422 s->hdr_state |= PNG_IHDR;
717
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 422 times.
 422 if (avctx->debug & FF_DEBUG_PICT_INFO)
718 ✗ av_log(avctx, AV_LOG_DEBUG, "width=%d height=%d depth=%d color_type=%d "
719 "compression_type=%d filter_type=%d interlace_type=%d\n",
720 s->width, s->height, s->bit_depth, s->color_type,
721 s->compression_type, s->filter_type, s->interlace_type);
722
723 422 return 0;
724 ✗ error:
725 ✗ s->cur_w = s->cur_h = s->width = s->height = 0;
726 ✗ s->bit_depth = 8;
727 ✗ return AVERROR_INVALIDDATA;
728 }
729
730 389 static int decode_phys_chunk(AVCodecContext *avctx, PNGDecContext *s,
731 GetByteContext *gb)
732 {
733
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 389 times.
 389 if (s->pic_state & PNG_IDAT) {
734 ✗ av_log(avctx, AV_LOG_ERROR, "pHYs after IDAT\n");
735 ✗ return AVERROR_INVALIDDATA;
736 }
737 389 avctx->sample_aspect_ratio.num = bytestream2_get_be32(gb);
738 389 avctx->sample_aspect_ratio.den = bytestream2_get_be32(gb);
739
2/4
✓ Branch 0 taken 389 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 389 times.
 389 if (avctx->sample_aspect_ratio.num < 0 || avctx->sample_aspect_ratio.den < 0)
740 ✗ avctx->sample_aspect_ratio = (AVRational){ 0, 1 };
741 389 bytestream2_skip(gb, 1); /* unit specifier */
742
743 389 return 0;
744 }
745
746 2 static int decode_exif_chunk(AVCodecContext *avctx, PNGDecContext *s,
747 GetByteContext *gb)
748 {
749
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (!(s->hdr_state & PNG_IHDR)) {
750 ✗ av_log(avctx, AV_LOG_ERROR, "eXIf before IHDR\n");
751 ✗ return AVERROR_INVALIDDATA;
752 }
753
754 2 av_buffer_unref(&s->exif_data);
755 2 s->exif_data = av_buffer_alloc(bytestream2_get_bytes_left(gb));
756
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (!s->exif_data)
757 ✗ return AVERROR(ENOMEM);
758 2 bytestream2_get_buffer(gb, s->exif_data->data, s->exif_data->size);
759
760 2 return 0;
761 }
762
763 /*
764 * This populates AVCodecContext fields so it must be called before
765 * ff_thread_finish_setup() to avoid a race condition with respect to the
766 * generic copying of avctx fields.
767 */
768 667 static int populate_avctx_color_fields(AVCodecContext *avctx, AVFrame *frame)
769 {
770 667 PNGDecContext *s = avctx->priv_data;
771 int ret;
772
773
2/2
✓ Branch 0 taken 4 times.
✓ Branch 1 taken 663 times.
 667 if (s->have_cicp) {
774
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 if (s->cicp_primaries >= AVCOL_PRI_NB)
775 ✗ av_log(avctx, AV_LOG_WARNING, "unrecognized cICP primaries\n");
776 else
777 4 avctx->color_primaries = frame->color_primaries = s->cicp_primaries;
778
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 if (s->cicp_trc >= AVCOL_TRC_NB)
779 ✗ av_log(avctx, AV_LOG_WARNING, "unrecognized cICP transfer\n");
780 else
781 4 avctx->color_trc = frame->color_trc = s->cicp_trc;
782
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 if (s->cicp_range == 0) {
783 ✗ av_log(avctx, AV_LOG_WARNING, "tv-range cICP tag found. Colors may be wrong\n");
784 ✗ avctx->color_range = frame->color_range = AVCOL_RANGE_MPEG;
785
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 } else if (s->cicp_range != 1) {
786 /* we already printed a warning when parsing the cICP chunk */
787 ✗ avctx->color_range = frame->color_range = AVCOL_RANGE_UNSPECIFIED;
788 }
789
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 657 times.
 663 } else if (s->iccp_data) {
790 AVFrameSideData *sd;
791 6 ret = ff_frame_new_side_data(avctx, frame, AV_FRAME_DATA_ICC_PROFILE,
792 s->iccp_data_len, &sd);
793
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 6 times.
 6 if (ret < 0)
794 ✗ return ret;
795
1/2
✓ Branch 0 taken 6 times.
✗ Branch 1 not taken.
 6 if (sd) {
796 6 memcpy(sd->data, s->iccp_data, s->iccp_data_len);
797 6 av_dict_set(&sd->metadata, "name", s->iccp_name, 0);
798 }
799
2/2
✓ Branch 0 taken 40 times.
✓ Branch 1 taken 617 times.
 657 } else if (s->have_srgb) {
800 40 avctx->color_primaries = frame->color_primaries = AVCOL_PRI_BT709;
801 40 avctx->color_trc = frame->color_trc = AVCOL_TRC_IEC61966_2_1;
802
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 611 times.
 617 } else if (s->have_chrm) {
803 AVColorPrimariesDesc desc;
804 enum AVColorPrimaries prim;
805 6 desc.wp.x = av_make_q(s->white_point[0], 100000);
806 6 desc.wp.y = av_make_q(s->white_point[1], 100000);
807 6 desc.prim.r.x = av_make_q(s->display_primaries[0][0], 100000);
808 6 desc.prim.r.y = av_make_q(s->display_primaries[0][1], 100000);
809 6 desc.prim.g.x = av_make_q(s->display_primaries[1][0], 100000);
810 6 desc.prim.g.y = av_make_q(s->display_primaries[1][1], 100000);
811 6 desc.prim.b.x = av_make_q(s->display_primaries[2][0], 100000);
812 6 desc.prim.b.y = av_make_q(s->display_primaries[2][1], 100000);
813 6 prim = av_csp_primaries_id_from_desc(&desc);
814
1/2
✓ Branch 0 taken 6 times.
✗ Branch 1 not taken.
 6 if (prim != AVCOL_PRI_UNSPECIFIED)
815 6 avctx->color_primaries = frame->color_primaries = prim;
816 else
817 ✗ av_log(avctx, AV_LOG_WARNING, "unknown cHRM primaries\n");
818 }
819
820 /* these chunks override gAMA */
821
6/6
✓ Branch 0 taken 661 times.
✓ Branch 1 taken 6 times.
✓ Branch 2 taken 621 times.
✓ Branch 3 taken 40 times.
✓ Branch 4 taken 4 times.
✓ Branch 5 taken 617 times.
 667 if (s->iccp_data || s->have_srgb || s->have_cicp) {
822 50 av_dict_set(&s->frame_metadata, "gamma", NULL, 0);
823
2/2
✓ Branch 0 taken 34 times.
✓ Branch 1 taken 583 times.
 617 } else if (s->gamma) {
824 /*
825 * These values are 100000/2.2, 100000/2.8, 100000/2.6, and
826 * 100000/1.0 respectively. 45455, 35714, and 38462, and 100000.
827 * There's a 0.001 gamma tolerance here in case of floating
828 * point issues when the PNG was written.
829 *
830 * None of the other enums have a pure gamma curve so it makes
831 * sense to leave those to sRGB and cICP.
832 */
833
3/4
✓ Branch 0 taken 26 times.
✓ Branch 1 taken 8 times.
✓ Branch 2 taken 26 times.
✗ Branch 3 not taken.
 34 if (s->gamma > 45355 && s->gamma < 45555)
834 26 avctx->color_trc = frame->color_trc = AVCOL_TRC_GAMMA22;
835
2/4
✓ Branch 0 taken 8 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 8 times.
 8 else if (s->gamma > 35614 && s->gamma < 35814)
836 ✗ avctx->color_trc = frame->color_trc = AVCOL_TRC_GAMMA28;
837
2/4
✓ Branch 0 taken 8 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 8 times.
 8 else if (s->gamma > 38362 && s->gamma < 38562)
838 ✗ avctx->color_trc = frame->color_trc = AVCOL_TRC_SMPTE428;
839
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 8 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 8 else if (s->gamma > 99900 && s->gamma < 100100)
840 ✗ avctx->color_trc = frame->color_trc = AVCOL_TRC_LINEAR;
841 }
842
843 /* PNG only supports RGB */
844 667 avctx->colorspace = frame->colorspace = AVCOL_SPC_RGB;
845
3/4
✓ Branch 0 taken 4 times.
✓ Branch 1 taken 663 times.
✓ Branch 2 taken 4 times.
✗ Branch 3 not taken.
 667 if (!s->have_cicp || s->cicp_range == 1)
846 667 avctx->color_range = frame->color_range = AVCOL_RANGE_JPEG;
847
848 /*
849 * tRNS sets alpha depth to full, so we ignore sBIT if set.
850 * As a result we must wait until now to set
851 * avctx->bits_per_raw_sample in case tRNS appears after sBIT
852 */
853
3/4
✓ Branch 0 taken 488 times.
✓ Branch 1 taken 179 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 488 times.
 667 if (!s->has_trns && s->significant_bits > 0)
854 ✗ avctx->bits_per_raw_sample = s->significant_bits;
855
856
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 665 times.
 667 if (s->have_clli) {
857 AVContentLightMetadata *clli;
858
859 2 ret = ff_decode_content_light_new(avctx, frame, &clli);
860
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (ret < 0)
861 ✗ return ret;
862
863
1/2
✓ Branch 0 taken 2 times.
✗ Branch 1 not taken.
 2 if (clli) {
864 /*
865 * 0.0001 divisor value
866 * see: https://www.w3.org/TR/png-3/#cLLI-chunk
867 */
868 2 clli->MaxCLL = s->clli_max / 10000;
869 2 clli->MaxFALL = s->clli_avg / 10000;
870 }
871 }
872
873
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 665 times.
 667 if (s->have_mdcv) {
874 AVMasteringDisplayMetadata *mdcv;
875
876 2 ret = ff_decode_mastering_display_new(avctx, frame, &mdcv);
877
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (ret < 0)
878 ✗ return ret;
879
880
1/2
✓ Branch 0 taken 2 times.
✗ Branch 1 not taken.
 2 if (mdcv) {
881 2 mdcv->has_primaries = 1;
882
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 2 times.
 8 for (int i = 0; i < 3; i++) {
883 6 mdcv->display_primaries[i][0] = av_make_q(s->mdcv_primaries[i][0], 50000);
884 6 mdcv->display_primaries[i][1] = av_make_q(s->mdcv_primaries[i][1], 50000);
885 }
886 2 mdcv->white_point[0] = av_make_q(s->mdcv_white_point[0], 50000);
887 2 mdcv->white_point[1] = av_make_q(s->mdcv_white_point[1], 50000);
888 2 mdcv->has_luminance = 1;
889 2 mdcv->max_luminance = av_make_q(s->mdcv_max_lum, 10000);
890 2 mdcv->min_luminance = av_make_q(s->mdcv_min_lum, 10000);
891 }
892 }
893
894 667 return 0;
895 }
896
897 12454 static int decode_idat_chunk(AVCodecContext *avctx, PNGDecContext *s,
898 GetByteContext *gb, AVFrame *p)
899 {
900 int ret;
901
2/2
✓ Branch 0 taken 1536 times.
✓ Branch 1 taken 10918 times.
 12454 size_t byte_depth = s->bit_depth > 8 ? 2 : 1;
902
903
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12454 times.
 12454 if (!p)
904 ✗ return AVERROR_INVALIDDATA;
905
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12454 times.
 12454 if (!(s->hdr_state & PNG_IHDR)) {
906 ✗ av_log(avctx, AV_LOG_ERROR, "IDAT without IHDR\n");
907 ✗ return AVERROR_INVALIDDATA;
908 }
909
2/2
✓ Branch 0 taken 667 times.
✓ Branch 1 taken 11787 times.
 12454 if (!(s->pic_state & PNG_IDAT)) {
910 /* init image info */
911 667 ret = ff_set_dimensions(avctx, s->width, s->height);
912
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 667 times.
 667 if (ret < 0)
913 ✗ return ret;
914
915 667 s->channels = ff_png_get_nb_channels(s->color_type);
916 667 s->bits_per_pixel = s->bit_depth * s->channels;
917 667 s->bpp = (s->bits_per_pixel + 7) >> 3;
918 667 s->row_size = (s->cur_w * s->bits_per_pixel + 7) >> 3;
919
920
4/6
✓ Branch 0 taken 667 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 667 times.
✗ Branch 3 not taken.
✓ Branch 4 taken 627 times.
✓ Branch 5 taken 40 times.
 667 if ((s->bit_depth == 2 || s->bit_depth == 4 || s->bit_depth == 8) &&
921
2/2
✓ Branch 0 taken 482 times.
✓ Branch 1 taken 145 times.
 627 s->color_type == PNG_COLOR_TYPE_RGB) {
922 482 avctx->pix_fmt = AV_PIX_FMT_RGB24;
923
4/6
✓ Branch 0 taken 185 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 185 times.
✗ Branch 3 not taken.
✓ Branch 4 taken 145 times.
✓ Branch 5 taken 40 times.
 185 } else if ((s->bit_depth == 2 || s->bit_depth == 4 || s->bit_depth == 8) &&
924
2/2
✓ Branch 0 taken 97 times.
✓ Branch 1 taken 48 times.
 145 s->color_type == PNG_COLOR_TYPE_RGB_ALPHA) {
925 97 avctx->pix_fmt = AV_PIX_FMT_RGBA;
926
4/6
✓ Branch 0 taken 88 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 88 times.
✗ Branch 3 not taken.
✓ Branch 4 taken 48 times.
✓ Branch 5 taken 40 times.
 88 } else if ((s->bit_depth == 2 || s->bit_depth == 4 || s->bit_depth == 8) &&
927
2/2
✓ Branch 0 taken 4 times.
✓ Branch 1 taken 44 times.
 48 s->color_type == PNG_COLOR_TYPE_GRAY) {
928 4 avctx->pix_fmt = AV_PIX_FMT_GRAY8;
929
2/2
✓ Branch 0 taken 40 times.
✓ Branch 1 taken 44 times.
 84 } else if (s->bit_depth == 16 &&
930
2/2
✓ Branch 0 taken 16 times.
✓ Branch 1 taken 24 times.
 40 s->color_type == PNG_COLOR_TYPE_GRAY) {
931 16 avctx->pix_fmt = AV_PIX_FMT_GRAY16BE;
932
2/2
✓ Branch 0 taken 24 times.
✓ Branch 1 taken 44 times.
 68 } else if (s->bit_depth == 16 &&
933
2/2
✓ Branch 0 taken 18 times.
✓ Branch 1 taken 6 times.
 24 s->color_type == PNG_COLOR_TYPE_RGB) {
934 18 avctx->pix_fmt = AV_PIX_FMT_RGB48BE;
935
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 44 times.
 50 } else if (s->bit_depth == 16 &&
936
2/2
✓ Branch 0 taken 4 times.
✓ Branch 1 taken 2 times.
 6 s->color_type == PNG_COLOR_TYPE_RGB_ALPHA) {
937 4 avctx->pix_fmt = AV_PIX_FMT_RGBA64BE;
938
5/8
✓ Branch 0 taken 46 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 46 times.
✗ Branch 3 not taken.
✓ Branch 4 taken 46 times.
✗ Branch 5 not taken.
✓ Branch 6 taken 42 times.
✓ Branch 7 taken 4 times.
 46 } else if ((s->bits_per_pixel == 1 || s->bits_per_pixel == 2 || s->bits_per_pixel == 4 || s->bits_per_pixel == 8) &&
939
1/2
✓ Branch 0 taken 42 times.
✗ Branch 1 not taken.
 42 s->color_type == PNG_COLOR_TYPE_PALETTE) {
940
1/2
✓ Branch 0 taken 42 times.
✗ Branch 1 not taken.
 42 avctx->pix_fmt = avctx->codec_id == AV_CODEC_ID_APNG ? AV_PIX_FMT_RGBA : AV_PIX_FMT_PAL8;
941
1/6
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✗ Branch 5 not taken.
 4 } else if (s->bit_depth == 1 && s->bits_per_pixel == 1 && avctx->codec_id != AV_CODEC_ID_APNG) {
942 ✗ avctx->pix_fmt = AV_PIX_FMT_MONOBLACK;
943
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 2 times.
 4 } else if (s->bit_depth == 8 &&
944
1/2
✓ Branch 0 taken 2 times.
✗ Branch 1 not taken.
 2 s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) {
945 2 avctx->pix_fmt = AV_PIX_FMT_YA8;
946
1/2
✓ Branch 0 taken 2 times.
✗ Branch 1 not taken.
 2 } else if (s->bit_depth == 16 &&
947
1/2
✓ Branch 0 taken 2 times.
✗ Branch 1 not taken.
 2 s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) {
948 2 avctx->pix_fmt = AV_PIX_FMT_YA16BE;
949 } else {
950 ✗ avpriv_report_missing_feature(avctx,
951 "Bit depth %d color type %d",
952 s->bit_depth, s->color_type);
953 ✗ return AVERROR_PATCHWELCOME;
954 }
955
956
4/4
✓ Branch 0 taken 179 times.
✓ Branch 1 taken 488 times.
✓ Branch 2 taken 137 times.
✓ Branch 3 taken 42 times.
 667 if (s->has_trns && s->color_type != PNG_COLOR_TYPE_PALETTE) {
957
1/5
✓ Branch 0 taken 137 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
 137 switch (avctx->pix_fmt) {
958 137 case AV_PIX_FMT_RGB24:
959 137 avctx->pix_fmt = AV_PIX_FMT_RGBA;
960 137 break;
961
962 ✗ case AV_PIX_FMT_RGB48BE:
963 ✗ avctx->pix_fmt = AV_PIX_FMT_RGBA64BE;
964 ✗ break;
965
966 ✗ case AV_PIX_FMT_GRAY8:
967 ✗ avctx->pix_fmt = AV_PIX_FMT_YA8;
968 ✗ break;
969
970 ✗ case AV_PIX_FMT_GRAY16BE:
971 ✗ avctx->pix_fmt = AV_PIX_FMT_YA16BE;
972 ✗ break;
973
974 ✗ default:
975 ✗ avpriv_request_sample(avctx, "bit depth %d "
976 "and color type %d with TRNS",
977 s->bit_depth, s->color_type);
978 ✗ return AVERROR_INVALIDDATA;
979 }
980
981 137 s->bpp += byte_depth;
982 }
983
984 /* PNG spec mandates independent alpha channel */
985
2/2
✓ Branch 0 taken 566 times.
✓ Branch 1 taken 101 times.
 667 if (s->color_type == PNG_COLOR_TYPE_RGB_ALPHA ||
986
2/2
✓ Branch 0 taken 4 times.
✓ Branch 1 taken 562 times.
 566 s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
987 105 avctx->alpha_mode = AVALPHA_MODE_STRAIGHT;
988
989 667 ff_progress_frame_unref(&s->picture);
990
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 666 times.
 667 if (s->dispose_op == APNG_DISPOSE_OP_PREVIOUS) {
991 /* We only need a buffer for the current picture. */
992 1 ret = ff_thread_get_buffer(avctx, p, 0);
993
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 1 times.
 1 if (ret < 0)
994 ✗ return ret;
995
2/2
✓ Branch 0 taken 12 times.
✓ Branch 1 taken 654 times.
 666 } else if (s->dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
996 /* We need a buffer for the current picture as well as
997 * a buffer for the reference to retain. */
998 12 ret = ff_progress_frame_get_buffer(avctx, &s->picture,
999 AV_GET_BUFFER_FLAG_REF);
1000
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12 times.
 12 if (ret < 0)
1001 ✗ return ret;
1002 12 ret = ff_thread_get_buffer(avctx, p, 0);
1003
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12 times.
 12 if (ret < 0)
1004 ✗ return ret;
1005 } else {
1006 /* The picture output this time and the reference to retain coincide. */
1007 654 ret = ff_progress_frame_get_buffer(avctx, &s->picture,
1008 AV_GET_BUFFER_FLAG_REF);
1009
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 654 times.
 654 if (ret < 0)
1010 ✗ return ret;
1011 654 ret = av_frame_ref(p, s->picture.f);
1012
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 654 times.
 654 if (ret < 0)
1013 ✗ return ret;
1014 }
1015
1016 667 p->pict_type = AV_PICTURE_TYPE_I;
1017 667 p->flags |= AV_FRAME_FLAG_KEY;
1018
2/2
✓ Branch 0 taken 8 times.
✓ Branch 1 taken 659 times.
 667 p->flags |= AV_FRAME_FLAG_INTERLACED * !!s->interlace_type;
1019
1020
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 667 times.
 667 if ((ret = populate_avctx_color_fields(avctx, p)) < 0)
1021 ✗ return ret;
1022 667 ff_thread_finish_setup(avctx);
1023
1024 /* compute the compressed row size */
1025
2/2
✓ Branch 0 taken 659 times.
✓ Branch 1 taken 8 times.
 667 if (!s->interlace_type) {
1026 659 s->crow_size = s->row_size + 1;
1027 } else {
1028 8 s->pass = 0;
1029 8 s->pass_row_size = ff_png_pass_row_size(s->pass,
1030 s->bits_per_pixel,
1031 s->cur_w);
1032 8 s->crow_size = s->pass_row_size + 1;
1033 }
1034 ff_dlog(avctx, "row_size=%d crow_size =%d\n",
1035 s->row_size, s->crow_size);
1036
1037 /* copy the palette if needed */
1038
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 667 times.
 667 if (avctx->pix_fmt == AV_PIX_FMT_PAL8)
1039 ✗ memcpy(p->data[1], s->palette, 256 * sizeof(uint32_t));
1040 /* empty row is used if differencing to the first row */
1041 667 av_fast_padded_mallocz(&s->last_row, &s->last_row_size, s->row_size);
1042
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 667 times.
 667 if (!s->last_row)
1043 ✗ return AVERROR_INVALIDDATA;
1044
2/2
✓ Branch 0 taken 659 times.
✓ Branch 1 taken 8 times.
 667 if (s->interlace_type ||
1045
2/2
✓ Branch 0 taken 101 times.
✓ Branch 1 taken 558 times.
 659 s->color_type == PNG_COLOR_TYPE_RGB_ALPHA) {
1046 109 av_fast_padded_malloc(&s->tmp_row, &s->tmp_row_size, s->row_size);
1047
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 109 times.
 109 if (!s->tmp_row)
1048 ✗ return AVERROR_INVALIDDATA;
1049 }
1050 /* compressed row */
1051 667 av_fast_padded_malloc(&s->buffer, &s->buffer_size, s->row_size + 16);
1052
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 667 times.
 667 if (!s->buffer)
1053 ✗ return AVERROR(ENOMEM);
1054
1055 /* we want crow_buf+1 to be 16-byte aligned */
1056 667 s->crow_buf = s->buffer + 15;
1057 667 s->zstream.zstream.avail_out = s->crow_size;
1058 667 s->zstream.zstream.next_out = s->crow_buf;
1059 }
1060
1061 12454 s->pic_state |= PNG_IDAT;
1062
1063 /* set image to non-transparent bpp while decompressing */
1064
4/4
✓ Branch 0 taken 189 times.
✓ Branch 1 taken 12265 times.
✓ Branch 2 taken 147 times.
✓ Branch 3 taken 42 times.
 12454 if (s->has_trns && s->color_type != PNG_COLOR_TYPE_PALETTE)
1065 147 s->bpp -= byte_depth;
1066
1067 12454 ret = png_decode_idat(s, gb, p->data[0], p->linesize[0]);
1068
1069
4/4
✓ Branch 0 taken 189 times.
✓ Branch 1 taken 12265 times.
✓ Branch 2 taken 147 times.
✓ Branch 3 taken 42 times.
 12454 if (s->has_trns && s->color_type != PNG_COLOR_TYPE_PALETTE)
1070 147 s->bpp += byte_depth;
1071
1072
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12454 times.
 12454 if (ret < 0)
1073 ✗ return ret;
1074
1075 12454 return 0;
1076 }
1077
1078 3 static int decode_plte_chunk(AVCodecContext *avctx, PNGDecContext *s,
1079 GetByteContext *gb)
1080 {
1081 3 int length = bytestream2_get_bytes_left(gb);
1082 int n, i, r, g, b;
1083
1084
2/4
✓ Branch 0 taken 3 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 3 times.
 3 if ((length % 3) != 0 || length > 256 * 3)
1085 ✗ return AVERROR_INVALIDDATA;
1086 /* read the palette */
1087 3 n = length / 3;
1088
2/2
✓ Branch 0 taken 708 times.
✓ Branch 1 taken 3 times.
 711 for (i = 0; i < n; i++) {
1089 708 r = bytestream2_get_byte(gb);
1090 708 g = bytestream2_get_byte(gb);
1091 708 b = bytestream2_get_byte(gb);
1092 708 s->palette[i] = (0xFFU << 24) | (r << 16) | (g << 8) | b;
1093 }
1094
2/2
✓ Branch 0 taken 60 times.
✓ Branch 1 taken 3 times.
 63 for (; i < 256; i++)
1095 60 s->palette[i] = (0xFFU << 24);
1096 3 s->hdr_state |= PNG_PLTE;
1097
1098 3 return 0;
1099 }
1100
1101 7 static int decode_trns_chunk(AVCodecContext *avctx, PNGDecContext *s,
1102 GetByteContext *gb)
1103 {
1104 7 int length = bytestream2_get_bytes_left(gb);
1105 int v, i;
1106
1107
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (!(s->hdr_state & PNG_IHDR)) {
1108 ✗ av_log(avctx, AV_LOG_ERROR, "trns before IHDR\n");
1109 ✗ return AVERROR_INVALIDDATA;
1110 }
1111
1112
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (s->pic_state & PNG_IDAT) {
1113 ✗ av_log(avctx, AV_LOG_ERROR, "trns after IDAT\n");
1114 ✗ return AVERROR_INVALIDDATA;
1115 }
1116
1117
2/2
✓ Branch 0 taken 3 times.
✓ Branch 1 taken 4 times.
 7 if (s->color_type == PNG_COLOR_TYPE_PALETTE) {
1118
2/4
✓ Branch 0 taken 3 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 3 times.
 3 if (length > 256 || !(s->hdr_state & PNG_PLTE))
1119 ✗ return AVERROR_INVALIDDATA;
1120
1121
2/2
✓ Branch 0 taken 51 times.
✓ Branch 1 taken 3 times.
 54 for (i = 0; i < length; i++) {
1122 51 unsigned v = bytestream2_get_byte(gb);
1123 51 s->palette[i] = (s->palette[i] & 0x00ffffff) | (v << 24);
1124 }
1125
2/4
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 4 times.
✗ Branch 3 not taken.
 4 } else if (s->color_type == PNG_COLOR_TYPE_GRAY || s->color_type == PNG_COLOR_TYPE_RGB) {
1126
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 4 if ((s->color_type == PNG_COLOR_TYPE_GRAY && length != 2) ||
1127
2/4
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 4 times.
✗ Branch 3 not taken.
 4 (s->color_type == PNG_COLOR_TYPE_RGB && length != 6) ||
1128
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 s->bit_depth == 1)
1129 ✗ return AVERROR_INVALIDDATA;
1130
1131
2/2
✓ Branch 0 taken 12 times.
✓ Branch 1 taken 4 times.
 16 for (i = 0; i < length / 2; i++) {
1132 /* only use the least significant bits */
1133 12 v = av_zero_extend(bytestream2_get_be16(gb), s->bit_depth);
1134
1135
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12 times.
 12 if (s->bit_depth > 8)
1136 ✗ AV_WB16(&s->transparent_color_be[2 * i], v);
1137 else
1138 12 s->transparent_color_be[i] = v;
1139 }
1140 } else {
1141 ✗ return AVERROR_INVALIDDATA;
1142 }
1143
1144 7 s->has_trns = 1;
1145
1146 7 return 0;
1147 }
1148
1149 6 static int decode_iccp_chunk(PNGDecContext *s, GetByteContext *gb)
1150 {
1151 6 int ret, cnt = 0;
1152 AVBPrint bp;
1153
1154
3/4
✓ Branch 1 taken 126 times.
✓ Branch 2 taken 6 times.
✓ Branch 3 taken 126 times.
✗ Branch 4 not taken.
 132 while ((s->iccp_name[cnt++] = bytestream2_get_byte(gb)) && cnt < 81);
1155
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 6 times.
 6 if (cnt > 80) {
1156 ✗ av_log(s->avctx, AV_LOG_ERROR, "iCCP with invalid name!\n");
1157 ✗ ret = AVERROR_INVALIDDATA;
1158 ✗ goto fail;
1159 }
1160
1161
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 6 times.
 6 if (bytestream2_get_byte(gb) != 0) {
1162 ✗ av_log(s->avctx, AV_LOG_ERROR, "iCCP with invalid compression!\n");
1163 ✗ ret = AVERROR_INVALIDDATA;
1164 ✗ goto fail;
1165 }
1166
1167
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 6 times.
 6 if ((ret = decode_zbuf(&bp, gb->buffer, gb->buffer_end, s->avctx)) < 0)
1168 ✗ return ret;
1169
1170 6 av_freep(&s->iccp_data);
1171 6 ret = av_bprint_finalize(&bp, (char **)&s->iccp_data);
1172
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 6 times.
 6 if (ret < 0)
1173 ✗ return ret;
1174 6 s->iccp_data_len = bp.len;
1175
1176 6 return 0;
1177 ✗ fail:
1178 ✗ s->iccp_name[0] = 0;
1179 ✗ return ret;
1180 }
1181
1182 ✗ static int decode_sbit_chunk(AVCodecContext *avctx, PNGDecContext *s,
1183 GetByteContext *gb)
1184 {
1185 ✗ int bits = 0;
1186 int channels;
1187 ✗ int remainder = bytestream2_get_bytes_left(gb);
1188
1189 ✗ if (!(s->hdr_state & PNG_IHDR)) {
1190 ✗ av_log(avctx, AV_LOG_ERROR, "sBIT before IHDR\n");
1191 ✗ return AVERROR_INVALIDDATA;
1192 }
1193
1194 ✗ if (s->pic_state & PNG_IDAT) {
1195 ✗ av_log(avctx, AV_LOG_WARNING, "Ignoring illegal sBIT chunk after IDAT\n");
1196 ✗ return 0;
1197 }
1198
1199 ✗ channels = s->color_type & PNG_COLOR_MASK_PALETTE ? 3 : ff_png_get_nb_channels(s->color_type);
1200
1201 ✗ if (remainder != channels) {
1202 ✗ av_log(avctx, AV_LOG_WARNING, "Invalid sBIT size: %d, expected: %d\n", remainder, channels);
1203 /* not enough space left in chunk to read info */
1204 ✗ if (remainder < channels)
1205 ✗ return 0;
1206 }
1207
1208 ✗ for (int i = 0; i < channels; i++) {
1209 ✗ int b = bytestream2_get_byteu(gb);
1210 ✗ bits = FFMAX(b, bits);
1211 }
1212
1213 ✗ if (bits <= 0 || bits > (s->color_type & PNG_COLOR_MASK_PALETTE ? 8 : s->bit_depth)) {
1214 ✗ av_log(avctx, AV_LOG_WARNING, "Invalid significant bits: %d\n", bits);
1215 ✗ return 0;
1216 }
1217 ✗ s->significant_bits = bits;
1218
1219 ✗ return 0;
1220 }
1221
1222 ✗ static void handle_small_bpp(PNGDecContext *s, AVFrame *p)
1223 {
1224 ✗ if (s->bits_per_pixel == 1 && s->color_type == PNG_COLOR_TYPE_PALETTE) {
1225 int i, j, k;
1226 ✗ uint8_t *pd = p->data[0];
1227 ✗ for (j = 0; j < s->height; j++) {
1228 ✗ i = s->width / 8;
1229 ✗ for (k = 7; k >= 1; k--)
1230 ✗ if ((s->width&7) >= k)
1231 ✗ pd[8*i + k - 1] = (pd[i]>>8-k) & 1;
1232 ✗ for (i--; i >= 0; i--) {
1233 ✗ pd[8*i + 7]= pd[i] & 1;
1234 ✗ pd[8*i + 6]= (pd[i]>>1) & 1;
1235 ✗ pd[8*i + 5]= (pd[i]>>2) & 1;
1236 ✗ pd[8*i + 4]= (pd[i]>>3) & 1;
1237 ✗ pd[8*i + 3]= (pd[i]>>4) & 1;
1238 ✗ pd[8*i + 2]= (pd[i]>>5) & 1;
1239 ✗ pd[8*i + 1]= (pd[i]>>6) & 1;
1240 ✗ pd[8*i + 0]= pd[i]>>7;
1241 }
1242 ✗ pd += p->linesize[0];
1243 }
1244 ✗ } else if (s->bits_per_pixel == 2) {
1245 int i, j;
1246 ✗ uint8_t *pd = p->data[0];
1247 ✗ for (j = 0; j < s->height; j++) {
1248 ✗ i = s->width / 4;
1249 ✗ if (s->color_type == PNG_COLOR_TYPE_PALETTE) {
1250 ✗ if ((s->width&3) >= 3) pd[4*i + 2]= (pd[i] >> 2) & 3;
1251 ✗ if ((s->width&3) >= 2) pd[4*i + 1]= (pd[i] >> 4) & 3;
1252 ✗ if ((s->width&3) >= 1) pd[4*i + 0]= pd[i] >> 6;
1253 ✗ for (i--; i >= 0; i--) {
1254 ✗ pd[4*i + 3]= pd[i] & 3;
1255 ✗ pd[4*i + 2]= (pd[i]>>2) & 3;
1256 ✗ pd[4*i + 1]= (pd[i]>>4) & 3;
1257 ✗ pd[4*i + 0]= pd[i]>>6;
1258 }
1259 } else {
1260 ✗ if ((s->width&3) >= 3) pd[4*i + 2]= ((pd[i]>>2) & 3)*0x55;
1261 ✗ if ((s->width&3) >= 2) pd[4*i + 1]= ((pd[i]>>4) & 3)*0x55;
1262 ✗ if ((s->width&3) >= 1) pd[4*i + 0]= ( pd[i]>>6 )*0x55;
1263 ✗ for (i--; i >= 0; i--) {
1264 ✗ pd[4*i + 3]= ( pd[i] & 3)*0x55;
1265 ✗ pd[4*i + 2]= ((pd[i]>>2) & 3)*0x55;
1266 ✗ pd[4*i + 1]= ((pd[i]>>4) & 3)*0x55;
1267 ✗ pd[4*i + 0]= ( pd[i]>>6 )*0x55;
1268 }
1269 }
1270 ✗ pd += p->linesize[0];
1271 }
1272 ✗ } else if (s->bits_per_pixel == 4) {
1273 int i, j;
1274 ✗ uint8_t *pd = p->data[0];
1275 ✗ for (j = 0; j < s->height; j++) {
1276 ✗ i = s->width/2;
1277 ✗ if (s->color_type == PNG_COLOR_TYPE_PALETTE) {
1278 ✗ if (s->width&1) pd[2*i+0]= pd[i]>>4;
1279 ✗ for (i--; i >= 0; i--) {
1280 ✗ pd[2*i + 1] = pd[i] & 15;
1281 ✗ pd[2*i + 0] = pd[i] >> 4;
1282 }
1283 } else {
1284 ✗ if (s->width & 1) pd[2*i + 0]= (pd[i] >> 4) * 0x11;
1285 ✗ for (i--; i >= 0; i--) {
1286 ✗ pd[2*i + 1] = (pd[i] & 15) * 0x11;
1287 ✗ pd[2*i + 0] = (pd[i] >> 4) * 0x11;
1288 }
1289 }
1290 ✗ pd += p->linesize[0];
1291 }
1292 }
1293 ✗ }
1294
1295 262 static int decode_fctl_chunk(AVCodecContext *avctx, PNGDecContext *s,
1296 GetByteContext *gb)
1297 {
1298 uint32_t sequence_number;
1299 int cur_w, cur_h, x_offset, y_offset, dispose_op, blend_op;
1300
1301
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 262 times.
 262 if (bytestream2_get_bytes_left(gb) != APNG_FCTL_CHUNK_SIZE)
1302 ✗ return AVERROR_INVALIDDATA;
1303
1304
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 262 times.
 262 if (!(s->hdr_state & PNG_IHDR)) {
1305 ✗ av_log(avctx, AV_LOG_ERROR, "fctl before IHDR\n");
1306 ✗ return AVERROR_INVALIDDATA;
1307 }
1308
1309
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 262 times.
 262 if (s->pic_state & PNG_IDAT) {
1310 ✗ av_log(avctx, AV_LOG_ERROR, "fctl after IDAT\n");
1311 ✗ return AVERROR_INVALIDDATA;
1312 }
1313
1314 262 sequence_number = bytestream2_get_be32(gb);
1315 262 cur_w = bytestream2_get_be32(gb);
1316 262 cur_h = bytestream2_get_be32(gb);
1317 262 x_offset = bytestream2_get_be32(gb);
1318 262 y_offset = bytestream2_get_be32(gb);
1319 262 bytestream2_skip(gb, 4); /* delay_num (2), delay_den (2) */
1320 262 dispose_op = bytestream2_get_byte(gb);
1321 262 blend_op = bytestream2_get_byte(gb);
1322
1323
2/2
✓ Branch 0 taken 16 times.
✓ Branch 1 taken 246 times.
 262 if (sequence_number == 0 &&
1324
1/2
✓ Branch 0 taken 16 times.
✗ Branch 1 not taken.
 16 (cur_w != s->width ||
1325
2/4
✓ Branch 0 taken 16 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 16 times.
✗ Branch 3 not taken.
 16 cur_h != s->height ||
1326
1/2
✓ Branch 0 taken 16 times.
✗ Branch 1 not taken.
 16 x_offset != 0 ||
1327
1/2
✓ Branch 0 taken 262 times.
✗ Branch 1 not taken.
 262 y_offset != 0) ||
1328
2/4
✓ Branch 0 taken 262 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 262 times.
✗ Branch 3 not taken.
 262 cur_w <= 0 || cur_h <= 0 ||
1329
1/2
✓ Branch 0 taken 262 times.
✗ Branch 1 not taken.
 262 x_offset < 0 || y_offset < 0 ||
1330
2/4
✓ Branch 0 taken 262 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 262 times.
 262 cur_w > s->width - x_offset|| cur_h > s->height - y_offset)
1331 ✗ return AVERROR_INVALIDDATA;
1332
1333
3/4
✓ Branch 0 taken 219 times.
✓ Branch 1 taken 43 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 219 times.
 262 if (blend_op != APNG_BLEND_OP_OVER && blend_op != APNG_BLEND_OP_SOURCE) {
1334 ✗ av_log(avctx, AV_LOG_ERROR, "Invalid blend_op %d\n", blend_op);
1335 ✗ return AVERROR_INVALIDDATA;
1336 }
1337
1338
4/6
✓ Branch 0 taken 246 times.
✓ Branch 1 taken 16 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 246 times.
✗ Branch 4 not taken.
✓ Branch 5 taken 16 times.
 262 if ((sequence_number == 0 || !s->last_picture.f) &&
1339 dispose_op == APNG_DISPOSE_OP_PREVIOUS) {
1340 // No previous frame to revert to for the first frame
1341 // Spec says to just treat it as a APNG_DISPOSE_OP_BACKGROUND
1342 ✗ dispose_op = APNG_DISPOSE_OP_BACKGROUND;
1343 }
1344
1345
4/4
✓ Branch 0 taken 43 times.
✓ Branch 1 taken 219 times.
✓ Branch 2 taken 4 times.
✓ Branch 3 taken 39 times.
 262 if (blend_op == APNG_BLEND_OP_OVER && !s->has_trns && (
1346
1/2
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
 4 avctx->pix_fmt == AV_PIX_FMT_RGB24 ||
1347
1/2
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
 4 avctx->pix_fmt == AV_PIX_FMT_RGB48BE ||
1348
1/2
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
 4 avctx->pix_fmt == AV_PIX_FMT_GRAY8 ||
1349
1/2
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
 4 avctx->pix_fmt == AV_PIX_FMT_GRAY16BE ||
1350
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 avctx->pix_fmt == AV_PIX_FMT_MONOBLACK
1351 )) {
1352 // APNG_BLEND_OP_OVER is the same as APNG_BLEND_OP_SOURCE when there is no alpha channel
1353 ✗ blend_op = APNG_BLEND_OP_SOURCE;
1354 }
1355
1356 262 s->cur_w = cur_w;
1357 262 s->cur_h = cur_h;
1358 262 s->x_offset = x_offset;
1359 262 s->y_offset = y_offset;
1360 262 s->dispose_op = dispose_op;
1361 262 s->blend_op = blend_op;
1362
1363 262 return 0;
1364 }
1365
1366 ✗ static void handle_p_frame_png(PNGDecContext *s, AVFrame *p)
1367 {
1368 int i, j;
1369 ✗ uint8_t *pd = p->data[0];
1370 ✗ uint8_t *pd_last = s->last_picture.f->data[0];
1371 ✗ int ls = av_image_get_linesize(p->format, s->width, 0);
1372
1373 ✗ ls = FFMIN(ls, s->width * s->bpp);
1374
1375 ✗ ff_progress_frame_await(&s->last_picture, INT_MAX);
1376 ✗ for (j = 0; j < s->height; j++) {
1377 ✗ for (i = 0; i < ls; i++)
1378 ✗ pd[i] += pd_last[i];
1379 ✗ pd += p->linesize[0];
1380 ✗ pd_last += s->last_picture.f->linesize[0];
1381 }
1382 ✗ }
1383
1384 // divide by 255 and round to nearest
1385 // apply a fast variant: (X+127)/255 = ((X+127)*257+257)>>16 = ((X+128)*257)>>16
1386 #define FAST_DIV255(x) ((((x) + 128) * 257) >> 16)
1387
1388 61 static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s,
1389 AVFrame *p)
1390 {
1391 61 uint8_t *dst = p->data[0];
1392 61 ptrdiff_t dst_stride = p->linesize[0];
1393 61 const uint8_t *src = s->last_picture.f->data[0];
1394 61 ptrdiff_t src_stride = s->last_picture.f->linesize[0];
1395
2/2
✓ Branch 0 taken 22 times.
✓ Branch 1 taken 39 times.
 61 const int bpp = s->color_type == PNG_COLOR_TYPE_PALETTE ? 4 : s->bpp;
1396
1397 size_t x, y;
1398
1399
2/2
✓ Branch 0 taken 41 times.
✓ Branch 1 taken 20 times.
 61 if (s->blend_op == APNG_BLEND_OP_OVER &&
1400
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 41 times.
 41 avctx->pix_fmt != AV_PIX_FMT_RGBA &&
1401 ✗ avctx->pix_fmt != AV_PIX_FMT_GRAY8A) {
1402 ✗ avpriv_request_sample(avctx, "Blending with pixel format %s",
1403 av_get_pix_fmt_name(avctx->pix_fmt));
1404 ✗ return AVERROR_PATCHWELCOME;
1405 }
1406
1407 61 ff_progress_frame_await(&s->last_picture, INT_MAX);
1408
1409 // copy unchanged rectangles from the last frame
1410
2/2
✓ Branch 0 taken 2186 times.
✓ Branch 1 taken 61 times.
 2247 for (y = 0; y < s->y_offset; y++)
1411 2186 memcpy(dst + y * dst_stride, src + y * src_stride, p->width * bpp);
1412
2/2
✓ Branch 0 taken 3320 times.
✓ Branch 1 taken 61 times.
 3381 for (y = s->y_offset; y < s->y_offset + s->cur_h; y++) {
1413 3320 memcpy(dst + y * dst_stride, src + y * src_stride, s->x_offset * bpp);
1414 3320 memcpy(dst + y * dst_stride + (s->x_offset + s->cur_w) * bpp,
1415 3320 src + y * src_stride + (s->x_offset + s->cur_w) * bpp,
1416 3320 (p->width - s->cur_w - s->x_offset) * bpp);
1417 }
1418
2/2
✓ Branch 0 taken 2500 times.
✓ Branch 1 taken 61 times.
 2561 for (y = s->y_offset + s->cur_h; y < p->height; y++)
1419 2500 memcpy(dst + y * dst_stride, src + y * src_stride, p->width * bpp);
1420
1421
2/2
✓ Branch 0 taken 41 times.
✓ Branch 1 taken 20 times.
 61 if (s->blend_op == APNG_BLEND_OP_OVER) {
1422 // Perform blending
1423
2/2
✓ Branch 0 taken 1912 times.
✓ Branch 1 taken 41 times.
 1953 for (y = s->y_offset; y < s->y_offset + s->cur_h; ++y) {
1424 1912 uint8_t *foreground = dst + dst_stride * y + bpp * s->x_offset;
1425 1912 const uint8_t *background = src + src_stride * y + bpp * s->x_offset;
1426
2/2
✓ Branch 0 taken 143265 times.
✓ Branch 1 taken 1912 times.
 145177 for (x = s->x_offset; x < s->x_offset + s->cur_w; ++x, foreground += bpp, background += bpp) {
1427 size_t b;
1428 uint8_t foreground_alpha, background_alpha, output_alpha;
1429 uint8_t output[10];
1430
1431 // Since we might be blending alpha onto alpha, we use the following equations:
1432 // output_alpha = foreground_alpha + (1 - foreground_alpha) * background_alpha
1433 // output = (foreground_alpha * foreground + (1 - foreground_alpha) * background_alpha * background) / output_alpha
1434
1435
1/3
✓ Branch 0 taken 143265 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
 143265 switch (avctx->pix_fmt) {
1436 143265 case AV_PIX_FMT_RGBA:
1437 143265 foreground_alpha = foreground[3];
1438 143265 background_alpha = background[3];
1439 143265 break;
1440
1441 ✗ case AV_PIX_FMT_GRAY8A:
1442 ✗ foreground_alpha = foreground[1];
1443 ✗ background_alpha = background[1];
1444 ✗ break;
1445 }
1446
1447
2/2
✓ Branch 0 taken 21682 times.
✓ Branch 1 taken 121583 times.
 143265 if (foreground_alpha == 255)
1448 143265 continue;
1449
1450
1/2
✓ Branch 0 taken 121583 times.
✗ Branch 1 not taken.
 121583 if (foreground_alpha == 0) {
1451 121583 memcpy(foreground, background, bpp);
1452 121583 continue;
1453 }
1454
1455 ✗ output_alpha = foreground_alpha + FAST_DIV255((255 - foreground_alpha) * background_alpha);
1456
1457 ✗ av_assert0(bpp <= 10);
1458
1459 ✗ for (b = 0; b < bpp - 1; ++b) {
1460 ✗ if (output_alpha == 0) {
1461 ✗ output[b] = 0;
1462 ✗ } else if (background_alpha == 255) {
1463 ✗ output[b] = FAST_DIV255(foreground_alpha * foreground[b] + (255 - foreground_alpha) * background[b]);
1464 } else {
1465 ✗ output[b] = (255 * foreground_alpha * foreground[b] + (255 - foreground_alpha) * background_alpha * background[b]) / (255 * output_alpha);
1466 }
1467 }
1468 ✗ output[b] = output_alpha;
1469 ✗ memcpy(foreground, output, bpp);
1470 }
1471 }
1472 }
1473
1474 61 return 0;
1475 }
1476
1477 12 static void apng_reset_background(PNGDecContext *s, const AVFrame *p)
1478 {
1479 // need to reset a rectangle to black
1480 12 av_unused int ret = av_frame_copy(s->picture.f, p);
1481
1/2
✓ Branch 0 taken 12 times.
✗ Branch 1 not taken.
 12 const int bpp = s->color_type == PNG_COLOR_TYPE_PALETTE ? 4 : s->bpp;
1482 12 const ptrdiff_t dst_stride = s->picture.f->linesize[0];
1483 12 uint8_t *dst = s->picture.f->data[0] + s->y_offset * dst_stride + bpp * s->x_offset;
1484
1485 av_assert1(ret >= 0);
1486
1487
2/2
✓ Branch 0 taken 959 times.
✓ Branch 1 taken 12 times.
 971 for (size_t y = 0; y < s->cur_h; y++) {
1488 959 memset(dst, 0, bpp * s->cur_w);
1489 959 dst += dst_stride;
1490 }
1491 12 }
1492
1493 684 static int decode_frame_common(AVCodecContext *avctx, PNGDecContext *s,
1494 AVFrame *p, const AVPacket *avpkt)
1495 {
1496 684 const AVCRC *crc_tab = av_crc_get_table(AV_CRC_32_IEEE_LE);
1497 uint32_t tag, length;
1498 684 int decode_next_dat = 0;
1499 int i, ret;
1500
1501 13998 for (;;) {
1502 GetByteContext gb_chunk;
1503
1504 14682 length = bytestream2_get_bytes_left(&s->gb);
1505
2/2
✓ Branch 0 taken 358 times.
✓ Branch 1 taken 14324 times.
 14682 if (length <= 0) {
1506
1507
2/2
✓ Branch 0 taken 80 times.
✓ Branch 1 taken 278 times.
 358 if (avctx->codec_id == AV_CODEC_ID_PNG &&
1508
1/2
✓ Branch 0 taken 80 times.
✗ Branch 1 not taken.
 80 avctx->skip_frame == AVDISCARD_ALL) {
1509 96 return 0;
1510 }
1511
1512
2/4
✓ Branch 0 taken 278 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 278 times.
✗ Branch 3 not taken.
 278 if (CONFIG_APNG_DECODER && avctx->codec_id == AV_CODEC_ID_APNG && length == 0) {
1513
2/2
✓ Branch 0 taken 16 times.
✓ Branch 1 taken 262 times.
 278 if (!(s->pic_state & PNG_IDAT))
1514 16 return 0;
1515 else
1516 587 goto exit_loop;
1517 }
1518 ✗ av_log(avctx, AV_LOG_ERROR, "%d bytes left\n", length);
1519 ✗ if ( s->pic_state & PNG_ALLIMAGE
1520 ✗ && avctx->strict_std_compliance <= FF_COMPLIANCE_NORMAL)
1521 ✗ goto exit_loop;
1522 ✗ ret = AVERROR_INVALIDDATA;
1523 1 goto fail;
1524 }
1525
1526 14324 length = bytestream2_get_be32(&s->gb);
1527
3/4
✓ Branch 0 taken 14324 times.
✗ Branch 1 not taken.
✓ Branch 3 taken 1 times.
✓ Branch 4 taken 14323 times.
 14324 if (length > 0x7fffffff || length + 8 > bytestream2_get_bytes_left(&s->gb)) {
1528 1 av_log(avctx, AV_LOG_ERROR, "chunk too big\n");
1529 1 ret = AVERROR_INVALIDDATA;
1530 1 goto fail;
1531 }
1532
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 14323 times.
 14323 if (avctx->err_recognition & (AV_EF_CRCCHECK | AV_EF_IGNORE_ERR)) {
1533 ✗ uint32_t crc_sig = AV_RB32(s->gb.buffer + length + 4);
1534 ✗ uint32_t crc_cal = ~av_crc(crc_tab, UINT32_MAX, s->gb.buffer, length + 4);
1535 ✗ if (crc_sig ^ crc_cal) {
1536 ✗ av_log(avctx, AV_LOG_ERROR, "CRC mismatch in chunk");
1537 ✗ if (avctx->err_recognition & AV_EF_EXPLODE) {
1538 ✗ av_log(avctx, AV_LOG_ERROR, ", quitting\n");
1539 ✗ ret = AVERROR_INVALIDDATA;
1540 ✗ goto fail;
1541 }
1542 ✗ av_log(avctx, AV_LOG_ERROR, ", skipping\n");
1543 ✗ bytestream2_skip(&s->gb, length + 8); /* tag */
1544 144 continue;
1545 }
1546 }
1547 14323 tag = bytestream2_get_le32(&s->gb);
1548
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 14323 times.
 14323 if (avctx->debug & FF_DEBUG_STARTCODE)
1549 ✗ av_log(avctx, AV_LOG_DEBUG, "png: tag=%s length=%u\n",
1550 ✗ av_fourcc2str(tag), length);
1551
1552 14323 bytestream2_init(&gb_chunk, s->gb.buffer, length);
1553 14323 bytestream2_skip(&s->gb, length + 4);
1554
1555
2/2
✓ Branch 0 taken 11754 times.
✓ Branch 1 taken 2569 times.
 14323 if (avctx->codec_id == AV_CODEC_ID_PNG &&
1556
2/2
✓ Branch 0 taken 1531 times.
✓ Branch 1 taken 10223 times.
 11754 avctx->skip_frame == AVDISCARD_ALL) {
1557
2/2
✓ Branch 0 taken 1387 times.
✓ Branch 1 taken 144 times.
 1531 switch(tag) {
1558 1387 case MKTAG('I', 'H', 'D', 'R'):
1559 case MKTAG('p', 'H', 'Y', 's'):
1560 case MKTAG('t', 'E', 'X', 't'):
1561 case MKTAG('I', 'D', 'A', 'T'):
1562 case MKTAG('t', 'R', 'N', 'S'):
1563 case MKTAG('s', 'R', 'G', 'B'):
1564 case MKTAG('c', 'I', 'C', 'P'):
1565 case MKTAG('c', 'H', 'R', 'M'):
1566 case MKTAG('g', 'A', 'M', 'A'):
1567 1387 break;
1568 144 default:
1569 144 continue;
1570 }
1571 }
1572
1573
18/21
✓ Branch 0 taken 422 times.
✓ Branch 1 taken 389 times.
✓ Branch 2 taken 262 times.
✓ Branch 3 taken 2054 times.
✓ Branch 4 taken 10400 times.
✓ Branch 5 taken 3 times.
✓ Branch 6 taken 7 times.
✓ Branch 7 taken 138 times.
✗ Branch 8 not taken.
✗ Branch 9 not taken.
✓ Branch 10 taken 4 times.
✓ Branch 11 taken 40 times.
✓ Branch 12 taken 6 times.
✓ Branch 13 taken 16 times.
✗ Branch 14 not taken.
✓ Branch 15 taken 35 times.
✓ Branch 16 taken 2 times.
✓ Branch 17 taken 2 times.
✓ Branch 18 taken 2 times.
✓ Branch 19 taken 325 times.
✓ Branch 20 taken 72 times.
 14179 switch (tag) {
1574 422 case MKTAG('I', 'H', 'D', 'R'):
1575
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 422 times.
 422 if ((ret = decode_ihdr_chunk(avctx, s, &gb_chunk)) < 0)
1576 ✗ goto fail;
1577 422 break;
1578 389 case MKTAG('p', 'H', 'Y', 's'):
1579
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 389 times.
 389 if ((ret = decode_phys_chunk(avctx, s, &gb_chunk)) < 0)
1580 ✗ goto fail;
1581 389 break;
1582 262 case MKTAG('f', 'c', 'T', 'L'):
1583
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 262 times.
 262 if (!CONFIG_APNG_DECODER || avctx->codec_id != AV_CODEC_ID_APNG)
1584 ✗ continue;
1585
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 262 times.
 262 if ((ret = decode_fctl_chunk(avctx, s, &gb_chunk)) < 0)
1586 ✗ goto fail;
1587 262 decode_next_dat = 1;
1588 262 break;
1589 2054 case MKTAG('f', 'd', 'A', 'T'):
1590
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2054 times.
 2054 if (!CONFIG_APNG_DECODER || avctx->codec_id != AV_CODEC_ID_APNG)
1591 ✗ continue;
1592
2/4
✓ Branch 0 taken 2054 times.
✗ Branch 1 not taken.
✗ Branch 3 not taken.
✓ Branch 4 taken 2054 times.
 2054 if (!decode_next_dat || bytestream2_get_bytes_left(&gb_chunk) < 4) {
1593 ✗ ret = AVERROR_INVALIDDATA;
1594 ✗ goto fail;
1595 }
1596 2054 bytestream2_get_be32(&gb_chunk);
1597 av_fallthrough;
1598 12454 case MKTAG('I', 'D', 'A', 'T'):
1599
3/4
✓ Branch 0 taken 2260 times.
✓ Branch 1 taken 10194 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 2260 times.
 12454 if (CONFIG_APNG_DECODER && avctx->codec_id == AV_CODEC_ID_APNG && !decode_next_dat)
1600 ✗ continue;
1601
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 12454 times.
 12454 if ((ret = decode_idat_chunk(avctx, s, &gb_chunk, p)) < 0)
1602 ✗ goto fail;
1603 12454 break;
1604 3 case MKTAG('P', 'L', 'T', 'E'):
1605 3 decode_plte_chunk(avctx, s, &gb_chunk);
1606 3 break;
1607 7 case MKTAG('t', 'R', 'N', 'S'):
1608 7 decode_trns_chunk(avctx, s, &gb_chunk);
1609 7 break;
1610 138 case MKTAG('t', 'E', 'X', 't'):
1611
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 138 times.
 138 if (decode_text_chunk(s, &gb_chunk, 0) < 0)
1612 ✗ av_log(avctx, AV_LOG_WARNING, "Broken tEXt chunk\n");
1613 138 break;
1614 ✗ case MKTAG('z', 'T', 'X', 't'):
1615 ✗ if (decode_text_chunk(s, &gb_chunk, 1) < 0)
1616 ✗ av_log(avctx, AV_LOG_WARNING, "Broken zTXt chunk\n");
1617 ✗ break;
1618 ✗ case MKTAG('s', 'T', 'E', 'R'): {
1619 ✗ int mode = bytestream2_get_byte(&gb_chunk);
1620
1621 ✗ if (mode == 0 || mode == 1) {
1622 ✗ s->stereo_mode = mode;
1623 } else {
1624 ✗ av_log(avctx, AV_LOG_WARNING,
1625 "Unknown value in sTER chunk (%d)\n", mode);
1626 }
1627 ✗ break;
1628 }
1629 4 case MKTAG('c', 'I', 'C', 'P'):
1630 4 s->cicp_primaries = bytestream2_get_byte(&gb_chunk);
1631 4 s->cicp_trc = bytestream2_get_byte(&gb_chunk);
1632
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 4 times.
 4 if (bytestream2_get_byte(&gb_chunk) != 0)
1633 ✗ av_log(avctx, AV_LOG_WARNING, "nonzero cICP matrix\n");
1634 4 s->cicp_range = bytestream2_get_byte(&gb_chunk);
1635
2/4
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 4 times.
 4 if (s->cicp_range != 0 && s->cicp_range != 1)
1636 ✗ av_log(avctx, AV_LOG_WARNING, "invalid cICP range: %d\n", s->cicp_range);
1637 4 s->have_cicp = 1;
1638 4 break;
1639 40 case MKTAG('s', 'R', 'G', 'B'):
1640 /* skip rendering intent byte */
1641 40 bytestream2_skip(&gb_chunk, 1);
1642 40 s->have_srgb = 1;
1643 40 break;
1644 6 case MKTAG('i', 'C', 'C', 'P'): {
1645
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 6 times.
 6 if ((ret = decode_iccp_chunk(s, &gb_chunk)) < 0)
1646 ✗ goto fail;
1647 6 break;
1648 }
1649 16 case MKTAG('c', 'H', 'R', 'M'): {
1650 16 s->have_chrm = 1;
1651
1652 16 s->white_point[0] = bytestream2_get_be32(&gb_chunk);
1653 16 s->white_point[1] = bytestream2_get_be32(&gb_chunk);
1654
1655 /* RGB Primaries */
1656
2/2
✓ Branch 0 taken 48 times.
✓ Branch 1 taken 16 times.
 64 for (i = 0; i < 3; i++) {
1657 48 s->display_primaries[i][0] = bytestream2_get_be32(&gb_chunk);
1658 48 s->display_primaries[i][1] = bytestream2_get_be32(&gb_chunk);
1659 }
1660
1661 16 break;
1662 }
1663 ✗ case MKTAG('s', 'B', 'I', 'T'):
1664 ✗ if ((ret = decode_sbit_chunk(avctx, s, &gb_chunk)) < 0)
1665 ✗ goto fail;
1666 ✗ break;
1667 35 case MKTAG('g', 'A', 'M', 'A'): {
1668 AVBPrint bp;
1669 char *gamma_str;
1670 35 s->gamma = bytestream2_get_be32(&gb_chunk);
1671
1672 35 av_bprint_init(&bp, 0, AV_BPRINT_SIZE_UNLIMITED);
1673 35 av_bprintf(&bp, "%i/%i", s->gamma, 100000);
1674 35 ret = av_bprint_finalize(&bp, &gamma_str);
1675
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 35 times.
 35 if (ret < 0)
1676 ✗ return ret;
1677
1678 35 av_dict_set(&s->frame_metadata, "gamma", gamma_str, AV_DICT_DONT_STRDUP_VAL);
1679
1680 35 break;
1681 }
1682 2 case MKTAG('c', 'L', 'L', 'i'): /* legacy spelling, for backwards compat */
1683 case MKTAG('c', 'L', 'L', 'I'):
1684
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 2 times.
 2 if (bytestream2_get_bytes_left(&gb_chunk) != 8) {
1685 ✗ av_log(avctx, AV_LOG_WARNING, "Invalid cLLI chunk size: %d\n", bytestream2_get_bytes_left(&gb_chunk));
1686 ✗ break;
1687 }
1688 2 s->have_clli = 1;
1689 2 s->clli_max = bytestream2_get_be32u(&gb_chunk);
1690 2 s->clli_avg = bytestream2_get_be32u(&gb_chunk);
1691 2 break;
1692 2 case MKTAG('m', 'D', 'C', 'v'): /* legacy spelling, for backward compat */
1693 case MKTAG('m', 'D', 'C', 'V'):
1694
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 2 times.
 2 if (bytestream2_get_bytes_left(&gb_chunk) != 24) {
1695 ✗ av_log(avctx, AV_LOG_WARNING, "Invalid mDCV chunk size: %d\n", bytestream2_get_bytes_left(&gb_chunk));
1696 ✗ break;
1697 }
1698 2 s->have_mdcv = 1;
1699
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 2 times.
 8 for (int i = 0; i < 3; i++) {
1700 6 s->mdcv_primaries[i][0] = bytestream2_get_be16u(&gb_chunk);
1701 6 s->mdcv_primaries[i][1] = bytestream2_get_be16u(&gb_chunk);
1702 }
1703 2 s->mdcv_white_point[0] = bytestream2_get_be16u(&gb_chunk);
1704 2 s->mdcv_white_point[1] = bytestream2_get_be16u(&gb_chunk);
1705 2 s->mdcv_max_lum = bytestream2_get_be32u(&gb_chunk);
1706 2 s->mdcv_min_lum = bytestream2_get_be32u(&gb_chunk);
1707 2 break;
1708 2 case MKTAG('e', 'X', 'I', 'f'):
1709 2 ret = decode_exif_chunk(avctx, s, &gb_chunk);
1710
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (ret < 0)
1711 ✗ goto fail;
1712 2 break;
1713 325 case MKTAG('I', 'E', 'N', 'D'):
1714
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 325 times.
 325 if (!(s->pic_state & PNG_ALLIMAGE))
1715 ✗ av_log(avctx, AV_LOG_ERROR, "IEND without all image\n");
1716
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 325 times.
 325 if (!(s->pic_state & (PNG_ALLIMAGE|PNG_IDAT))) {
1717 ✗ ret = AVERROR_INVALIDDATA;
1718 ✗ goto fail;
1719 }
1720 325 goto exit_loop;
1721 }
1722 }
1723 587 exit_loop:
1724
1725
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 587 times.
 587 if (!p)
1726 ✗ return AVERROR_INVALIDDATA;
1727
1728
2/2
✓ Branch 0 taken 325 times.
✓ Branch 1 taken 262 times.
 587 if (avctx->codec_id == AV_CODEC_ID_PNG &&
1729
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 325 times.
 325 avctx->skip_frame == AVDISCARD_ALL) {
1730 ✗ return 0;
1731 }
1732
1733
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 587 times.
 587 if (percent_missing(s) > avctx->discard_damaged_percentage) {
1734 ✗ ret = AVERROR_INVALIDDATA;
1735 ✗ goto fail;
1736 }
1737
1738
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 587 times.
 587 if (s->bits_per_pixel <= 4)
1739 ✗ handle_small_bpp(s, p);
1740
1741
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 585 times.
 587 if (s->exif_data) {
1742 // we swap because ff_decode_exif_attach_buffer adds to p->metadata
1743 2 FFSWAP(AVDictionary *, p->metadata, s->frame_metadata);
1744 2 ret = ff_decode_exif_attach_buffer(avctx, p, &s->exif_data, AV_EXIF_TIFF_HEADER);
1745 2 FFSWAP(AVDictionary *, p->metadata, s->frame_metadata);
1746
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (ret < 0) {
1747 ✗ av_log(avctx, AV_LOG_WARNING, "unable to attach EXIF buffer\n");
1748 ✗ return ret;
1749 }
1750 }
1751
1752
3/4
✓ Branch 0 taken 42 times.
✓ Branch 1 taken 545 times.
✓ Branch 2 taken 42 times.
✗ Branch 3 not taken.
 587 if (s->color_type == PNG_COLOR_TYPE_PALETTE && avctx->codec_id == AV_CODEC_ID_APNG) {
1753
2/2
✓ Branch 0 taken 6300 times.
✓ Branch 1 taken 42 times.
 6342 for (int y = 0; y < s->height; y++) {
1754 6300 uint8_t *row = &p->data[0][p->linesize[0] * y];
1755
1756
2/2
✓ Branch 0 taken 945000 times.
✓ Branch 1 taken 6300 times.
 951300 for (int x = s->width - 1; x >= 0; x--) {
1757 945000 const uint8_t idx = row[x];
1758
1759 945000 row[4*x+2] = s->palette[idx] & 0xFF;
1760 945000 row[4*x+1] = (s->palette[idx] >> 8 ) & 0xFF;
1761 945000 row[4*x+0] = (s->palette[idx] >> 16) & 0xFF;
1762 945000 row[4*x+3] = s->palette[idx] >> 24;
1763 }
1764 }
1765 }
1766
1767 /* apply transparency if needed */
1768
4/4
✓ Branch 0 taken 178 times.
✓ Branch 1 taken 409 times.
✓ Branch 2 taken 136 times.
✓ Branch 3 taken 42 times.
 587 if (s->has_trns && s->color_type != PNG_COLOR_TYPE_PALETTE) {
1769
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 136 times.
 136 size_t byte_depth = s->bit_depth > 8 ? 2 : 1;
1770 136 size_t raw_bpp = s->bpp - byte_depth;
1771 ptrdiff_t x, y;
1772
1773
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 136 times.
 136 av_assert0(s->bit_depth > 1);
1774
1775
2/2
✓ Branch 0 taken 17610 times.
✓ Branch 1 taken 136 times.
 17746 for (y = 0; y < s->height; ++y) {
1776 17610 uint8_t *row = &p->data[0][p->linesize[0] * y];
1777
1778
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 17610 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 17610 if (s->bpp == 2 && byte_depth == 1) {
1779 ✗ uint8_t *pixel = &row[2 * s->width - 1];
1780 ✗ uint8_t *rowp = &row[1 * s->width - 1];
1781 ✗ int tcolor = s->transparent_color_be[0];
1782 ✗ for (x = s->width; x > 0; --x) {
1783 ✗ *pixel-- = *rowp == tcolor ? 0 : 0xff;
1784 ✗ *pixel-- = *rowp--;
1785 }
1786
2/4
✓ Branch 0 taken 17610 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 17610 times.
✗ Branch 3 not taken.
 35220 } else if (s->bpp == 4 && byte_depth == 1) {
1787 17610 uint8_t *pixel = &row[4 * s->width - 1];
1788 17610 uint8_t *rowp = &row[3 * s->width - 1];
1789 17610 int tcolor = AV_RL24(s->transparent_color_be);
1790
2/2
✓ Branch 0 taken 1577700 times.
✓ Branch 1 taken 17610 times.
 1595310 for (x = s->width; x > 0; --x) {
1791
2/2
✓ Branch 0 taken 82906 times.
✓ Branch 1 taken 1494794 times.
 1577700 *pixel-- = AV_RL24(rowp-2) == tcolor ? 0 : 0xff;
1792 1577700 *pixel-- = *rowp--;
1793 1577700 *pixel-- = *rowp--;
1794 1577700 *pixel-- = *rowp--;
1795 }
1796 } else {
1797 /* since we're updating in-place, we have to go from right to left */
1798 ✗ for (x = s->width; x > 0; --x) {
1799 ✗ uint8_t *pixel = &row[s->bpp * (x - 1)];
1800 ✗ memmove(pixel, &row[raw_bpp * (x - 1)], raw_bpp);
1801
1802 ✗ if (!memcmp(pixel, s->transparent_color_be, raw_bpp)) {
1803 ✗ memset(&pixel[raw_bpp], 0, byte_depth);
1804 } else {
1805 ✗ memset(&pixel[raw_bpp], 0xff, byte_depth);
1806 }
1807 }
1808 }
1809 }
1810 }
1811
1812 /* handle P-frames only if a predecessor frame is available */
1813
2/2
✓ Branch 0 taken 506 times.
✓ Branch 1 taken 81 times.
 587 if (s->last_picture.f) {
1814
3/4
✓ Branch 0 taken 61 times.
✓ Branch 1 taken 445 times.
✓ Branch 2 taken 61 times.
✗ Branch 3 not taken.
 506 if ( !(avpkt->flags & AV_PKT_FLAG_KEY) && avctx->codec_tag != AV_RL32("MPNG")
1815
1/2
✓ Branch 0 taken 61 times.
✗ Branch 1 not taken.
 61 && s->last_picture.f->width == p->width
1816
1/2
✓ Branch 0 taken 61 times.
✗ Branch 1 not taken.
 61 && s->last_picture.f->height== p->height
1817
1/2
✓ Branch 0 taken 61 times.
✗ Branch 1 not taken.
 61 && s->last_picture.f->format== p->format
1818 ) {
1819
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 61 times.
 61 if (CONFIG_PNG_DECODER && avctx->codec_id != AV_CODEC_ID_APNG)
1820 ✗ handle_p_frame_png(s, p);
1821 61 else if (CONFIG_APNG_DECODER &&
1822
2/4
✓ Branch 0 taken 61 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 61 times.
 122 avctx->codec_id == AV_CODEC_ID_APNG &&
1823 61 (ret = handle_p_frame_apng(avctx, s, p)) < 0)
1824 ✗ goto fail;
1825 }
1826 }
1827
2/2
✓ Branch 0 taken 12 times.
✓ Branch 1 taken 575 times.
 587 if (CONFIG_APNG_DECODER && s->dispose_op == APNG_DISPOSE_OP_BACKGROUND)
1828 12 apng_reset_background(s, p);
1829
1830 587 ret = 0;
1831 588 fail:
1832
2/2
✓ Branch 0 taken 586 times.
✓ Branch 1 taken 2 times.
 588 if (s->picture.f)
1833 586 ff_progress_frame_report(&s->picture, INT_MAX);
1834
1835 588 return ret;
1836 }
1837
1838 668 static void clear_frame_metadata(PNGDecContext *s)
1839 {
1840 668 av_freep(&s->iccp_data);
1841 668 s->iccp_data_len = 0;
1842 668 s->iccp_name[0] = 0;
1843
1844 668 s->stereo_mode = -1;
1845
1846 668 s->have_chrm = 0;
1847 668 s->have_srgb = 0;
1848 668 s->have_cicp = 0;
1849
1850 668 av_dict_free(&s->frame_metadata);
1851 668 }
1852
1853 587 static int output_frame(PNGDecContext *s, AVFrame *f)
1854 {
1855 int ret;
1856
1857
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 587 times.
 587 if (s->stereo_mode >= 0) {
1858 ✗ AVStereo3D *stereo3d = av_stereo3d_create_side_data(f);
1859 ✗ if (!stereo3d) {
1860 ✗ ret = AVERROR(ENOMEM);
1861 ✗ goto fail;
1862 }
1863
1864 ✗ stereo3d->type = AV_STEREO3D_SIDEBYSIDE;
1865 ✗ stereo3d->flags = s->stereo_mode ? 0 : AV_STEREO3D_FLAG_INVERT;
1866 }
1867
1868 587 FFSWAP(AVDictionary*, f->metadata, s->frame_metadata);
1869
1870 587 return 0;
1871 ✗ fail:
1872 ✗ av_frame_unref(f);
1873 ✗ return ret;
1874 }
1875
1876 #if CONFIG_PNG_DECODER
1877 406 static int decode_frame_png(AVCodecContext *avctx, AVFrame *p,
1878 int *got_frame, AVPacket *avpkt)
1879 {
1880 406 PNGDecContext *const s = avctx->priv_data;
1881 406 const uint8_t *buf = avpkt->data;
1882 406 int buf_size = avpkt->size;
1883 int64_t sig;
1884 int ret;
1885
1886 406 clear_frame_metadata(s);
1887
1888 406 bytestream2_init(&s->gb, buf, buf_size);
1889
1890 /* check signature */
1891 406 sig = bytestream2_get_be64(&s->gb);
1892
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 406 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 406 if (sig != PNGSIG &&
1893 sig != MNGSIG) {
1894 ✗ av_log(avctx, AV_LOG_ERROR, "Invalid PNG signature 0x%08"PRIX64".\n", sig);
1895 ✗ return AVERROR_INVALIDDATA;
1896 }
1897
1898 406 s->y = s->has_trns = 0;
1899 406 s->hdr_state = 0;
1900 406 s->pic_state = 0;
1901
1902 /* Reset z_stream */
1903 406 ret = inflateReset(&s->zstream.zstream);
1904
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 406 times.
 406 if (ret != Z_OK)
1905 ✗ return AVERROR_EXTERNAL;
1906
1907
2/2
✓ Branch 1 taken 1 times.
✓ Branch 2 taken 405 times.
 406 if ((ret = decode_frame_common(avctx, s, p, avpkt)) < 0)
1908 1 goto the_end;
1909
1910
2/2
✓ Branch 0 taken 80 times.
✓ Branch 1 taken 325 times.
 405 if (avctx->skip_frame == AVDISCARD_ALL) {
1911 80 *got_frame = 0;
1912 80 ret = bytestream2_tell(&s->gb);
1913 80 goto the_end;
1914 }
1915
1916 325 ret = output_frame(s, p);
1917
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 325 times.
 325 if (ret < 0)
1918 ✗ goto the_end;
1919
1920
1/2
✓ Branch 0 taken 325 times.
✗ Branch 1 not taken.
 325 if (!(avctx->active_thread_type & FF_THREAD_FRAME)) {
1921 325 ff_progress_frame_unref(&s->last_picture);
1922 325 FFSWAP(ProgressFrame, s->picture, s->last_picture);
1923 }
1924
1925 325 *got_frame = 1;
1926
1927 325 ret = bytestream2_tell(&s->gb);
1928 406 the_end:
1929 406 s->crow_buf = NULL;
1930 406 return ret;
1931 }
1932 #endif
1933
1934 #if CONFIG_APNG_DECODER
1935 262 static int decode_frame_apng(AVCodecContext *avctx, AVFrame *p,
1936 int *got_frame, AVPacket *avpkt)
1937 {
1938 262 PNGDecContext *const s = avctx->priv_data;
1939 int ret;
1940
1941 262 clear_frame_metadata(s);
1942
1943
2/2
✓ Branch 0 taken 16 times.
✓ Branch 1 taken 246 times.
 262 if (!(s->hdr_state & PNG_IHDR)) {
1944
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 16 times.
 16 if (!avctx->extradata_size)
1945 ✗ return AVERROR_INVALIDDATA;
1946
1947
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 16 times.
 16 if ((ret = inflateReset(&s->zstream.zstream)) != Z_OK)
1948 ✗ return AVERROR_EXTERNAL;
1949 16 bytestream2_init(&s->gb, avctx->extradata, avctx->extradata_size);
1950
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 16 times.
 16 if ((ret = decode_frame_common(avctx, s, NULL, avpkt)) < 0)
1951 ✗ return ret;
1952 }
1953
1954 /* reset state for a new frame */
1955
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 262 times.
 262 if ((ret = inflateReset(&s->zstream.zstream)) != Z_OK)
1956 ✗ return AVERROR_EXTERNAL;
1957 262 s->y = 0;
1958 262 s->pic_state = 0;
1959 262 bytestream2_init(&s->gb, avpkt->data, avpkt->size);
1960
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 262 times.
 262 if ((ret = decode_frame_common(avctx, s, p, avpkt)) < 0)
1961 ✗ return ret;
1962
1963
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 262 times.
 262 if (!(s->pic_state & PNG_ALLIMAGE))
1964 ✗ av_log(avctx, AV_LOG_WARNING, "Frame did not contain a complete image\n");
1965
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 262 times.
 262 if (!(s->pic_state & (PNG_ALLIMAGE|PNG_IDAT)))
1966 ✗ return AVERROR_INVALIDDATA;
1967
1968 262 ret = output_frame(s, p);
1969
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 262 times.
 262 if (ret < 0)
1970 ✗ return ret;
1971
1972
1/2
✓ Branch 0 taken 262 times.
✗ Branch 1 not taken.
 262 if (!(avctx->active_thread_type & FF_THREAD_FRAME)) {
1973
2/2
✓ Branch 0 taken 261 times.
✓ Branch 1 taken 1 times.
 262 if (s->dispose_op != APNG_DISPOSE_OP_PREVIOUS)
1974 261 FFSWAP(ProgressFrame, s->picture, s->last_picture);
1975 262 ff_progress_frame_unref(&s->picture);
1976 }
1977
1978 262 *got_frame = 1;
1979 262 return bytestream2_tell(&s->gb);
1980 }
1981 #endif
1982
1983 #if HAVE_THREADS
1984 ✗ static int update_thread_context(AVCodecContext *dst, const AVCodecContext *src)
1985 {
1986 ✗ PNGDecContext *psrc = src->priv_data;
1987 ✗ PNGDecContext *pdst = dst->priv_data;
1988 const ProgressFrame *src_frame;
1989
1990 ✗ if (dst == src)
1991 ✗ return 0;
1992
1993 ✗ if (CONFIG_APNG_DECODER && dst->codec_id == AV_CODEC_ID_APNG) {
1994
1995 ✗ pdst->width = psrc->width;
1996 ✗ pdst->height = psrc->height;
1997 ✗ pdst->bit_depth = psrc->bit_depth;
1998 ✗ pdst->color_type = psrc->color_type;
1999 ✗ pdst->compression_type = psrc->compression_type;
2000 ✗ pdst->interlace_type = psrc->interlace_type;
2001 ✗ pdst->filter_type = psrc->filter_type;
2002 ✗ pdst->has_trns = psrc->has_trns;
2003 ✗ memcpy(pdst->transparent_color_be, psrc->transparent_color_be, sizeof(pdst->transparent_color_be));
2004
2005 ✗ memcpy(pdst->palette, psrc->palette, sizeof(pdst->palette));
2006
2007 ✗ pdst->hdr_state |= psrc->hdr_state;
2008 }
2009
2010 ✗ src_frame = psrc->dispose_op == APNG_DISPOSE_OP_PREVIOUS ?
2011 &psrc->last_picture : &psrc->picture;
2012
2013 ✗ ff_progress_frame_replace(&pdst->last_picture, src_frame);
2014
2015 ✗ return 0;
2016 }
2017 #endif
2018
2019 167 static av_cold int png_dec_init(AVCodecContext *avctx)
2020 {
2021 167 PNGDecContext *s = avctx->priv_data;
2022
2023 167 s->avctx = avctx;
2024
2025 167 ff_pngdsp_init(&s->dsp);
2026
2027 167 return ff_inflate_init(&s->zstream, avctx);
2028 }
2029
2030 167 static av_cold int png_dec_end(AVCodecContext *avctx)
2031 {
2032 167 PNGDecContext *s = avctx->priv_data;
2033
2034 167 ff_progress_frame_unref(&s->last_picture);
2035 167 ff_progress_frame_unref(&s->picture);
2036 167 av_freep(&s->buffer);
2037 167 s->buffer_size = 0;
2038 167 av_freep(&s->last_row);
2039 167 s->last_row_size = 0;
2040 167 av_freep(&s->tmp_row);
2041 167 s->tmp_row_size = 0;
2042
2043 167 av_freep(&s->iccp_data);
2044 167 av_buffer_unref(&s->exif_data);
2045 167 av_dict_free(&s->frame_metadata);
2046 167 ff_inflate_end(&s->zstream);
2047
2048 167 return 0;
2049 }
2050
2051 #if CONFIG_APNG_DECODER
2052 const FFCodec ff_apng_decoder = {
2053 .p.name = "apng",
2054 CODEC_LONG_NAME("APNG (Animated Portable Network Graphics) image"),
2055 .p.type = AVMEDIA_TYPE_VIDEO,
2056 .p.id = AV_CODEC_ID_APNG,
2057 .priv_data_size = sizeof(PNGDecContext),
2058 .init = png_dec_init,
2059 .close = png_dec_end,
2060 FF_CODEC_DECODE_CB(decode_frame_apng),
2061 UPDATE_THREAD_CONTEXT(update_thread_context),
2062 .p.capabilities = AV_CODEC_CAP_DR1 | AV_CODEC_CAP_FRAME_THREADS,
2063 .caps_internal = FF_CODEC_CAP_INIT_CLEANUP |
2064 FF_CODEC_CAP_USES_PROGRESSFRAMES |
2065 FF_CODEC_CAP_ICC_PROFILES,
2066 };
2067 #endif
2068
2069 #if CONFIG_PNG_DECODER
2070 const FFCodec ff_png_decoder = {
2071 .p.name = "png",
2072 CODEC_LONG_NAME("PNG (Portable Network Graphics) image"),
2073 .p.type = AVMEDIA_TYPE_VIDEO,
2074 .p.id = AV_CODEC_ID_PNG,
2075 .priv_data_size = sizeof(PNGDecContext),
2076 .init = png_dec_init,
2077 .close = png_dec_end,
2078 FF_CODEC_DECODE_CB(decode_frame_png),
2079 UPDATE_THREAD_CONTEXT(update_thread_context),
2080 .p.capabilities = AV_CODEC_CAP_DR1 | AV_CODEC_CAP_FRAME_THREADS,
2081 .caps_internal = FF_CODEC_CAP_SKIP_FRAME_FILL_PARAM |
2082 FF_CODEC_CAP_INIT_CLEANUP |
2083 FF_CODEC_CAP_USES_PROGRESSFRAMES |
2084 FF_CODEC_CAP_ICC_PROFILES,
2085 };
2086 #endif
2087