FFmpeg coverage

Directory: ../../../ffmpeg/
File: src/libavcodec/pngdec.c
Date: 2026-10-29 07:45:57
Exec Total Coverage
Lines: 775 1197 64.7%
Functions: 28 35 80.0%
Branches: 533 915 58.3%
Line Branch Exec Source
1 /*
2 * PNG image format
3 * Copyright (c) 2003 Fabrice Bellard
4 *
5 * This file is part of FFmpeg.
6 *
7 * FFmpeg is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
11 *
12 * FFmpeg is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with FFmpeg; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20 */
21
22 //#define DEBUG
23
24 #include "config_components.h"
25
26 #include "libavutil/attributes.h"
27 #include "libavutil/avassert.h"
28 #include "libavutil/bprint.h"
29 #include "libavutil/crc.h"
30 #include "libavutil/csp.h"
31 #include "libavutil/imgutils.h"
32 #include "libavutil/intreadwrite.h"
33 #include "libavutil/mastering_display_metadata.h"
34 #include "libavutil/mem.h"
35 #include "libavutil/pixfmt.h"
36 #include "libavutil/rational.h"
37 #include "libavutil/stereo3d.h"
38
39 #include "avcodec.h"
40 #include "bytestream.h"
41 #include "codec_internal.h"
42 #include "decode.h"
43 #include "exif_internal.h"
44 #include "apng.h"
45 #include "png.h"
46 #include "pngdsp.h"
47 #include "progressframe.h"
48 #include "thread.h"
49 #include "zlib_wrapper.h"
50
51 #include <zlib.h>
52
53 enum PNGHeaderState {
54 PNG_IHDR = 1 << 0,
55 PNG_PLTE = 1 << 1,
56 };
57
58 enum PNGImageState {
59 PNG_IDAT = 1 << 0,
60 PNG_ALLIMAGE = 1 << 1,
61 };
62
63 typedef struct PNGDecContext {
64 PNGDSPContext dsp;
65 AVCodecContext *avctx;
66
67 GetByteContext gb;
68 ProgressFrame last_picture;
69 ProgressFrame picture;
70
71 AVDictionary *frame_metadata;
72
73 uint8_t iccp_name[82];
74 uint8_t *iccp_data;
75 size_t iccp_data_len;
76
77 int stereo_mode;
78
79 int have_chrm;
80 uint32_t white_point[2];
81 uint32_t display_primaries[3][2];
82 int gamma;
83 int have_srgb;
84 int have_cicp;
85 enum AVColorPrimaries cicp_primaries;
86 enum AVColorTransferCharacteristic cicp_trc;
87 enum AVColorRange cicp_range;
88 int have_clli;
89 uint32_t clli_max;
90 uint32_t clli_avg;
91 /* Mastering Display Color Volume */
92 int have_mdcv;
93 uint16_t mdcv_primaries[3][2];
94 uint16_t mdcv_white_point[2];
95 uint32_t mdcv_max_lum;
96 uint32_t mdcv_min_lum;
97
98 enum PNGHeaderState hdr_state;
99 enum PNGImageState pic_state;
100 int width, height;
101 int cur_w, cur_h;
102 int x_offset, y_offset;
103 uint8_t dispose_op, blend_op;
104 int bit_depth;
105 int color_type;
106 int compression_type;
107 int interlace_type;
108 int filter_type;
109 int channels;
110 int bits_per_pixel;
111 int bpp;
112 int has_trns;
113 uint8_t transparent_color_be[6];
114 int significant_bits;
115
116 uint32_t palette[256];
117 uint8_t *crow_buf;
118 uint8_t *last_row;
119 unsigned int last_row_size;
120 uint8_t *tmp_row;
121 unsigned int tmp_row_size;
122 uint8_t *buffer;
123 int buffer_size;
124 int pass;
125 int crow_size; /* compressed row size (include filter type) */
126 int row_size; /* decompressed row size */
127 int pass_row_size; /* decompress row size of the current pass */
128 int y;
129 /* sub-8-bit samples of an APNG frame are decoded packed at the start of
130 * the frame row and only moved to the frame position once unpacked */
131 int subframe_packed;
132 FFZStream zstream;
133
134 AVBufferRef *exif_data;
135 } PNGDecContext;
136
137 /* Mask to determine which pixels are valid in a pass */
138 static const uint8_t png_pass_mask[NB_PASSES] = {
139 0x01, 0x01, 0x11, 0x11, 0x55, 0x55, 0xff,
140 };
141
142 /* Mask to determine which y pixels can be written in a pass */
143 static const uint8_t png_pass_dsp_ymask[NB_PASSES] = {
144 0xff, 0xff, 0x0f, 0xff, 0x33, 0xff, 0x55,
145 };
146
147 /* Mask to determine which pixels to overwrite while displaying */
148 static const uint8_t png_pass_dsp_mask[NB_PASSES] = {
149 0xff, 0x0f, 0xff, 0x33, 0xff, 0x55, 0xff
150 };
151
152 /* NOTE: we try to construct a good looking image at each pass. width
153 * is the original image width. We also do pixel format conversion at
154 * this stage */
155 7040 static void png_put_interlaced_row(uint8_t *dst, int width,
156 int bits_per_pixel, int pass,
157 int color_type, const uint8_t *src)
158 {
159 int x, mask, dsp_mask, j, src_x, b, bpp;
160 uint8_t *d;
161 const uint8_t *s;
162
163 7040 mask = png_pass_mask[pass];
164 7040 dsp_mask = png_pass_dsp_mask[pass];
165
166
1/4
✗ Branch 0 not taken.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 7040 times.
 7040 switch (bits_per_pixel) {
167 ✗ case 1:
168 ✗ src_x = 0;
169 ✗ for (x = 0; x < width; x++) {
170 ✗ j = (x & 7);
171 ✗ if ((dsp_mask << j) & 0x80) {
172 ✗ b = (src[src_x >> 3] >> (7 - (src_x & 7))) & 1;
173 ✗ dst[x >> 3] &= 0xFF7F>>j;
174 ✗ dst[x >> 3] |= b << (7 - j);
175 }
176 ✗ if ((mask << j) & 0x80)
177 ✗ src_x++;
178 }
179 ✗ break;
180 ✗ case 2:
181 ✗ src_x = 0;
182 ✗ for (x = 0; x < width; x++) {
183 ✗ int j2 = 2 * (x & 3);
184 ✗ j = (x & 7);
185 ✗ if ((dsp_mask << j) & 0x80) {
186 ✗ b = (src[src_x >> 2] >> (6 - 2*(src_x & 3))) & 3;
187 ✗ dst[x >> 2] &= 0xFF3F>>j2;
188 ✗ dst[x >> 2] |= b << (6 - j2);
189 }
190 ✗ if ((mask << j) & 0x80)
191 ✗ src_x++;
192 }
193 ✗ break;
194 ✗ case 4:
195 ✗ src_x = 0;
196 ✗ for (x = 0; x < width; x++) {
197 ✗ int j2 = 4*(x&1);
198 ✗ j = (x & 7);
199 ✗ if ((dsp_mask << j) & 0x80) {
200 ✗ b = (src[src_x >> 1] >> (4 - 4*(src_x & 1))) & 15;
201 ✗ dst[x >> 1] &= 0xFF0F>>j2;
202 ✗ dst[x >> 1] |= b << (4 - j2);
203 }
204 ✗ if ((mask << j) & 0x80)
205 ✗ src_x++;
206 }
207 ✗ break;
208 7040 default:
209 7040 bpp = bits_per_pixel >> 3;
210 7040 d = dst;
211 7040 s = src;
212
2/2
✓ Branch 0 taken 901120 times.
✓ Branch 1 taken 7040 times.
 908160 for (x = 0; x < width; x++) {
213 901120 j = x & 7;
214
2/2
✓ Branch 0 taken 655360 times.
✓ Branch 1 taken 245760 times.
 901120 if ((dsp_mask << j) & 0x80) {
215 655360 memcpy(d, s, bpp);
216 }
217 901120 d += bpp;
218
2/2
✓ Branch 0 taken 307200 times.
✓ Branch 1 taken 593920 times.
 901120 if ((mask << j) & 0x80)
219 307200 s += bpp;
220 }
221 7040 break;
222 }
223 7040 }
224
225 #define UNROLL1(bpp, op) \
226 { \
227 r = dst[0]; \
228 if (bpp >= 2) \
229 g = dst[1]; \
230 if (bpp >= 3) \
231 b = dst[2]; \
232 if (bpp >= 4) \
233 a = dst[3]; \
234 for (; i <= size - bpp; i += bpp) { \
235 dst[i + 0] = r = op(r, src[i + 0], last[i + 0]); \
236 if (bpp == 1) \
237 continue; \
238 dst[i + 1] = g = op(g, src[i + 1], last[i + 1]); \
239 if (bpp == 2) \
240 continue; \
241 dst[i + 2] = b = op(b, src[i + 2], last[i + 2]); \
242 if (bpp == 3) \
243 continue; \
244 dst[i + 3] = a = op(a, src[i + 3], last[i + 3]); \
245 } \
246 }
247
248 #define UNROLL_FILTER(op) \
249 if (bpp == 1) { \
250 UNROLL1(1, op) \
251 } else if (bpp == 2) { \
252 UNROLL1(2, op) \
253 } else if (bpp == 3) { \
254 UNROLL1(3, op) \
255 } else if (bpp == 4) { \
256 UNROLL1(4, op) \
257 } \
258 for (; i < size; i++) { \
259 dst[i] = op(dst[i - bpp], src[i], last[i]); \
260 }
261
262 /* NOTE: 'dst' can be equal to 'last' */
263 133963 void ff_png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type,
264 const uint8_t *src, const uint8_t *last, int size, int bpp)
265 {
266 int i, p, r, g, b, a;
267
268
5/6
✓ Branch 0 taken 4977 times.
✓ Branch 1 taken 4865 times.
✓ Branch 2 taken 11694 times.
✓ Branch 3 taken 2845 times.
✓ Branch 4 taken 109582 times.
✗ Branch 5 not taken.
 133963 switch (filter_type) {
269 4977 case PNG_FILTER_VALUE_NONE:
270 4977 memcpy(dst, src, size);
271 4977 break;
272 4865 case PNG_FILTER_VALUE_SUB:
273
2/2
✓ Branch 0 taken 17313 times.
✓ Branch 1 taken 4865 times.
 22178 for (i = 0; i < bpp; i++)
274 17313 dst[i] = src[i];
275
2/2
✓ Branch 0 taken 2660 times.
✓ Branch 1 taken 2205 times.
 4865 if (bpp == 4) {
276 2660 p = *(int *)dst;
277
2/2
✓ Branch 0 taken 408620 times.
✓ Branch 1 taken 2660 times.
 411280 for (; i < size; i += bpp) {
278 408620 unsigned s = *(const int *)(src + i);
279 408620 p = ((s & 0x7f7f7f7f) + (p & 0x7f7f7f7f)) ^ ((s ^ p) & 0x80808080);
280 408620 *(int *)(dst + i) = p;
281 }
282 } else {
283 #define OP_SUB(x, s, l) ((x) + (s))
284
12/18
✗ Branch 0 not taken.
✓ Branch 1 taken 2205 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✓ Branch 4 taken 16 times.
✓ Branch 5 taken 2189 times.
✓ Branch 6 taken 5168 times.
✓ Branch 7 taken 16 times.
✓ Branch 8 taken 2167 times.
✓ Branch 9 taken 22 times.
✓ Branch 10 taken 454086 times.
✓ Branch 11 taken 2167 times.
✗ Branch 12 not taken.
✓ Branch 13 taken 22 times.
✗ Branch 14 not taken.
✗ Branch 15 not taken.
✓ Branch 16 taken 36596 times.
✓ Branch 17 taken 2205 times.
 498055 UNROLL_FILTER(OP_SUB);
285 }
286 4865 break;
287 11694 case PNG_FILTER_VALUE_UP:
288 11694 dsp->add_bytes_l2(dst, src, last, size);
289 11694 break;
290 2845 case PNG_FILTER_VALUE_AVG:
291
2/2
✓ Branch 0 taken 9195 times.
✓ Branch 1 taken 2845 times.
 12040 for (i = 0; i < bpp; i++) {
292 9195 p = (last[i] >> 1);
293 9195 dst[i] = p + src[i];
294 }
295 #define OP_AVG(x, s, l) (((((x) + (l)) >> 1) + (s)) & 0xff)
296
15/18
✗ Branch 0 not taken.
✓ Branch 1 taken 2845 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✓ Branch 4 taken 2 times.
✓ Branch 5 taken 2843 times.
✓ Branch 6 taken 254 times.
✓ Branch 7 taken 2 times.
✓ Branch 8 taken 2237 times.
✓ Branch 9 taken 606 times.
✓ Branch 10 taken 330999 times.
✓ Branch 11 taken 2237 times.
✓ Branch 12 taken 578 times.
✓ Branch 13 taken 28 times.
✓ Branch 14 taken 49012 times.
✓ Branch 15 taken 578 times.
✓ Branch 16 taken 21336 times.
✓ Branch 17 taken 2845 times.
 404446 UNROLL_FILTER(OP_AVG);
297 2845 break;
298 109582 case PNG_FILTER_VALUE_PAETH:
299
2/2
✓ Branch 0 taken 339768 times.
✓ Branch 1 taken 109582 times.
 449350 for (i = 0; i < bpp; i++) {
300 339768 p = last[i];
301 339768 dst[i] = p + src[i];
302 }
303
3/4
✓ Branch 0 taken 105494 times.
✓ Branch 1 taken 4088 times.
✓ Branch 2 taken 105494 times.
✗ Branch 3 not taken.
 109582 if (bpp > 2 && size > 4) {
304 /* would write off the end of the array if we let it process
305 * the last pixel with bpp=3 */
306
2/2
✓ Branch 0 taken 103066 times.
✓ Branch 1 taken 2428 times.
 105494 int w = (bpp & 3) ? size - 3 : size;
307
308
1/2
✓ Branch 0 taken 105494 times.
✗ Branch 1 not taken.
 105494 if (w > i) {
309 105494 dsp->add_paeth_prediction(dst + i, src + i, last + i, size - i, bpp);
310 105494 i = w;
311 }
312 }
313 109582 ff_png_add_paeth_prediction(dst + i, src + i, last + i, size - i, bpp);
314 109582 break;
315 }
316 133963 }
317
318 /* This used to be called "deloco" in FFmpeg
319 * and is actually an inverse reversible colorspace transformation */
320 #define YUV2RGB(NAME, TYPE) \
321 static void deloco_ ## NAME(TYPE *dst, int size, int alpha) \
322 { \
323 int i; \
324 for (i = 0; i < size - 2; i += 3 + alpha) { \
325 int g = dst [i + 1]; \
326 dst[i + 0] += g; \
327 dst[i + 2] += g; \
328 } \
329 }
330
331 ✗ YUV2RGB(rgb8, uint8_t)
332 ✗ YUV2RGB(rgb16, uint16_t)
333
334 609 static int percent_missing(PNGDecContext *s)
335 {
336
2/2
✓ Branch 0 taken 5 times.
✓ Branch 1 taken 604 times.
 609 if (s->interlace_type) {
337 5 return 100 - 100 * s->pass / (NB_PASSES - 1);
338 } else {
339 604 return 100 - 100 * s->y / s->cur_h;
340 }
341 }
342
343 /* process exactly one decompressed row */
344 129722 static void png_handle_row(PNGDecContext *s, uint8_t *dst, ptrdiff_t dst_stride)
345 {
346 uint8_t *ptr, *last_row;
347 int got_line;
348
349
2/2
✓ Branch 0 taken 127322 times.
✓ Branch 1 taken 2400 times.
 129722 if (!s->interlace_type) {
350 254644 ptr = dst + dst_stride * (s->y + s->y_offset) +
351
2/2
✓ Branch 0 taken 127127 times.
✓ Branch 1 taken 195 times.
 127322 (s->subframe_packed ? 0 : s->x_offset * s->bpp);
352
2/2
✓ Branch 0 taken 683 times.
✓ Branch 1 taken 126639 times.
 127322 if (s->y == 0)
353 683 last_row = s->last_row;
354 else
355 126639 last_row = ptr - dst_stride;
356
357 127322 ff_png_filter_row(&s->dsp, ptr, s->crow_buf[0], s->crow_buf + 1,
358 last_row, s->row_size, s->bpp);
359 /* loco lags by 1 row so that it doesn't interfere with top prediction */
360
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 127322 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 127322 if (s->filter_type == PNG_FILTER_TYPE_LOCO && s->y > 0) {
361 ✗ if (s->bit_depth == 16) {
362 ✗ deloco_rgb16((uint16_t *)(ptr - dst_stride), s->row_size / 2,
363 ✗ s->color_type == PNG_COLOR_TYPE_RGB_ALPHA);
364 } else {
365 ✗ deloco_rgb8(ptr - dst_stride, s->row_size,
366 ✗ s->color_type == PNG_COLOR_TYPE_RGB_ALPHA);
367 }
368 }
369 127322 s->y++;
370
2/2
✓ Branch 0 taken 683 times.
✓ Branch 1 taken 126639 times.
 127322 if (s->y == s->cur_h) {
371 683 s->pic_state |= PNG_ALLIMAGE;
372
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 683 times.
 683 if (s->filter_type == PNG_FILTER_TYPE_LOCO) {
373 ✗ if (s->bit_depth == 16) {
374 ✗ deloco_rgb16((uint16_t *)ptr, s->row_size / 2,
375 ✗ s->color_type == PNG_COLOR_TYPE_RGB_ALPHA);
376 } else {
377 ✗ deloco_rgb8(ptr, s->row_size,
378 ✗ s->color_type == PNG_COLOR_TYPE_RGB_ALPHA);
379 }
380 }
381 }
382 } else {
383 2400 got_line = 0;
384 for (;;) {
385 11350 ptr = dst + dst_stride * (s->y + s->y_offset) + s->x_offset * s->bpp;
386
2/2
✓ Branch 0 taken 4790 times.
✓ Branch 1 taken 6560 times.
 11350 if ((ff_png_pass_ymask[s->pass] << (s->y & 7)) & 0x80) {
387 /* if we already read one row, it is time to stop to
388 * wait for the next one */
389
2/2
✓ Branch 0 taken 2390 times.
✓ Branch 1 taken 2400 times.
 4790 if (got_line)
390 2390 break;
391 2400 ff_png_filter_row(&s->dsp, s->tmp_row, s->crow_buf[0], s->crow_buf + 1,
392 2400 s->last_row, s->pass_row_size, s->bpp);
393 2400 FFSWAP(uint8_t *, s->last_row, s->tmp_row);
394 2400 FFSWAP(unsigned int, s->last_row_size, s->tmp_row_size);
395 2400 got_line = 1;
396 }
397
2/2
✓ Branch 0 taken 7040 times.
✓ Branch 1 taken 1920 times.
 8960 if ((png_pass_dsp_ymask[s->pass] << (s->y & 7)) & 0x80) {
398 7040 png_put_interlaced_row(ptr, s->cur_w, s->bits_per_pixel, s->pass,
399 7040 s->color_type, s->last_row);
400 }
401 8960 s->y++;
402
2/2
✓ Branch 0 taken 70 times.
✓ Branch 1 taken 8890 times.
 8960 if (s->y == s->cur_h) {
403 70 memset(s->last_row, 0, s->row_size);
404 for (;;) {
405
2/2
✓ Branch 0 taken 10 times.
✓ Branch 1 taken 60 times.
 70 if (s->pass == NB_PASSES - 1) {
406 10 s->pic_state |= PNG_ALLIMAGE;
407 10 goto the_end;
408 } else {
409 60 s->pass++;
410 60 s->y = 0;
411 60 s->pass_row_size = ff_png_pass_row_size(s->pass,
412 s->bits_per_pixel,
413 s->cur_w);
414 60 s->crow_size = s->pass_row_size + 1;
415
1/2
✓ Branch 0 taken 60 times.
✗ Branch 1 not taken.
 60 if (s->pass_row_size != 0)
416 60 break;
417 /* skip pass if empty row */
418 }
419 }
420 }
421 }
422 2400 the_end:;
423 }
424 129722 }
425
426 12500 static int png_decode_idat(PNGDecContext *s, GetByteContext *gb,
427 uint8_t *dst, ptrdiff_t dst_stride)
428 {
429 12500 z_stream *const zstream = &s->zstream.zstream;
430 int ret;
431 12500 zstream->avail_in = bytestream2_get_bytes_left(gb);
432 12500 zstream->next_in = gb->buffer;
433
434 /* decode one line if possible */
435
2/2
✓ Branch 0 taken 141495 times.
✓ Branch 1 taken 12500 times.
 153995 while (zstream->avail_in > 0) {
436 141495 ret = inflate(zstream, Z_PARTIAL_FLUSH);
437
3/4
✓ Branch 0 taken 693 times.
✓ Branch 1 taken 140802 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 693 times.
 141495 if (ret != Z_OK && ret != Z_STREAM_END) {
438 ✗ av_log(s->avctx, AV_LOG_ERROR, "inflate returned error %d\n", ret);
439 ✗ return AVERROR_EXTERNAL;
440 }
441
2/2
✓ Branch 0 taken 129722 times.
✓ Branch 1 taken 11773 times.
 141495 if (zstream->avail_out == 0) {
442
1/2
✓ Branch 0 taken 129722 times.
✗ Branch 1 not taken.
 129722 if (!(s->pic_state & PNG_ALLIMAGE)) {
443 129722 png_handle_row(s, dst, dst_stride);
444 }
445 129722 zstream->avail_out = s->crow_size;
446 129722 zstream->next_out = s->crow_buf;
447 }
448
3/4
✓ Branch 0 taken 693 times.
✓ Branch 1 taken 140802 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 693 times.
 141495 if (ret == Z_STREAM_END && zstream->avail_in > 0) {
449 ✗ av_log(s->avctx, AV_LOG_WARNING,
450 "%d undecompressed bytes left in buffer\n", zstream->avail_in);
451 ✗ return 0;
452 }
453 }
454 12500 return 0;
455 }
456
457 /* Hard cap on decompressed zTXt/iCCP payloads to defeat decompression bombs. */
458 #define PNG_ZBUF_MAX_DECOMPRESSED (16 * 1024 * 1024)
459
460 7 static int decode_zbuf(AVBPrint *bp, const uint8_t *data,
461 const uint8_t *data_end, void *logctx)
462 {
463 FFZStream z;
464 7 z_stream *const zstream = &z.zstream;
465 unsigned char *buf;
466 unsigned buf_size;
467 7 int ret = ff_inflate_init(&z, logctx);
468
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (ret < 0)
469 ✗ return ret;
470
471 7 zstream->next_in = data;
472 7 zstream->avail_in = data_end - data;
473 7 av_bprint_init(bp, 0, AV_BPRINT_SIZE_UNLIMITED);
474
475
1/2
✓ Branch 0 taken 21 times.
✗ Branch 1 not taken.
 21 while (zstream->avail_in > 0) {
476
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 21 times.
 21 if (bp->len > PNG_ZBUF_MAX_DECOMPRESSED) {
477 ✗ av_log(logctx, AV_LOG_ERROR,
478 "Compressed PNG chunk expands beyond %d bytes, aborting\n",
479 PNG_ZBUF_MAX_DECOMPRESSED);
480 ✗ ret = AVERROR_INVALIDDATA;
481 ✗ goto fail;
482 }
483 21 av_bprint_get_buffer(bp, 2, &buf, &buf_size);
484
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 21 times.
 21 if (buf_size < 2) {
485 ✗ ret = AVERROR(ENOMEM);
486 ✗ goto fail;
487 }
488 21 zstream->next_out = buf;
489 21 zstream->avail_out = buf_size - 1;
490 21 ret = inflate(zstream, Z_PARTIAL_FLUSH);
491
3/4
✓ Branch 0 taken 7 times.
✓ Branch 1 taken 14 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 7 times.
 21 if (ret != Z_OK && ret != Z_STREAM_END) {
492 ✗ ret = AVERROR_EXTERNAL;
493 ✗ goto fail;
494 }
495 21 bp->len += zstream->next_out - buf;
496
2/2
✓ Branch 0 taken 7 times.
✓ Branch 1 taken 14 times.
 21 if (ret == Z_STREAM_END)
497 7 break;
498 }
499 7 ff_inflate_end(&z);
500 7 bp->str[bp->len] = 0;
501 7 return 0;
502
503 ✗ fail:
504 ✗ ff_inflate_end(&z);
505 ✗ av_bprint_finalize(bp, NULL);
506 ✗ return ret;
507 }
508
509 276 static char *iso88591_to_utf8(const char *in, size_t size_in)
510 {
511 276 size_t extra = 0, i;
512 char *out, *q;
513
514
2/2
✓ Branch 0 taken 4545 times.
✓ Branch 1 taken 276 times.
 4821 for (i = 0; i < size_in; i++)
515 4545 extra += !!(in[i] & 0x80);
516
2/4
✓ Branch 0 taken 276 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 276 times.
 276 if (size_in == SIZE_MAX || extra > SIZE_MAX - size_in - 1)
517 ✗ return NULL;
518 276 q = out = av_malloc(size_in + extra + 1);
519
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 276 times.
 276 if (!out)
520 ✗ return NULL;
521
2/2
✓ Branch 0 taken 4545 times.
✓ Branch 1 taken 276 times.
 4821 for (i = 0; i < size_in; i++) {
522
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4545 times.
 4545 if (in[i] & 0x80) {
523 ✗ *(q++) = 0xC0 | ((in[i] >> 6) & 0x3);
524 ✗ *(q++) = 0x80 | (in[i] & 0x3F);
525 } else {
526 4545 *(q++) = in[i];
527 }
528 }
529 276 *(q++) = 0;
530 276 return out;
531 }
532
533 ✗ static int decode_text_to_exif(PNGDecContext *s, const char *txt_utf8)
534 {
535 ✗ size_t len = strlen(txt_utf8);
536 ✗ const char *ptr = txt_utf8;
537 ✗ const char *end = txt_utf8 + len;
538 ✗ size_t exif_len = 0;
539 uint8_t *exif_ptr;
540 const uint8_t *exif_end;
541
542 // first we find a newline
543 ✗ while (*ptr++ != '\n') {
544 ✗ if (ptr >= end)
545 ✗ return AVERROR_BUFFER_TOO_SMALL;
546 }
547
548 // we check for "exif" and skip over it
549 ✗ if (end - ptr < 4 || strncmp("exif", ptr, 4))
550 ✗ return AVERROR_INVALIDDATA;
551 ✗ ptr += 3;
552
553 // then we find the next printable non-space character
554 ✗ while (!av_isgraph(*++ptr)) {
555 ✗ if (ptr >= end)
556 ✗ return AVERROR_BUFFER_TOO_SMALL;
557 }
558
559 // parse the length
560 ✗ while (av_isdigit(*ptr)) {
561 ✗ size_t nlen = exif_len * 10 + (*ptr - '0');
562 ✗ if (nlen < exif_len) // overflow
563 ✗ return AVERROR_INVALIDDATA;
564 ✗ exif_len = nlen;
565 ✗ if (++ptr >= end)
566 ✗ return AVERROR_BUFFER_TOO_SMALL;
567 }
568
569 // then we find the next printable non-space character
570 ✗ while (!av_isgraph(*ptr)) {
571 ✗ if (++ptr >= end)
572 ✗ return AVERROR_BUFFER_TOO_SMALL;
573 }
574
575 // first condition checks for overflow in 2 * exif_len
576 ✗ if (exif_len > SIZE_MAX / 2 || end - ptr < 2 * exif_len)
577 ✗ return AVERROR_INVALIDDATA;
578 ✗ if (exif_len < 10)
579 ✗ return AVERROR_INVALIDDATA;
580
581 ✗ av_buffer_unref(&s->exif_data);
582 // the buffer starts with "Exif " which we skip over
583 // we don't use AV_EXIF_EXIF00 because that disagrees
584 // with the eXIf chunk format
585 ✗ s->exif_data = av_buffer_alloc(exif_len - 6);
586 ✗ if (!s->exif_data)
587 ✗ return AVERROR(ENOMEM);
588
589 // we subtract one because we call ++ptr later
590 // compiler will optimize out the call
591 ✗ ptr += strlen("Exif ") * 2 - 1;
592
593 ✗ exif_ptr = s->exif_data->data;
594 ✗ exif_end = exif_ptr + s->exif_data->size;
595
596 ✗ while (exif_ptr < exif_end) {
597 ✗ while (++ptr < end) {
598 ✗ if (*ptr >= '0' && *ptr <= '9') {
599 ✗ *exif_ptr = (*ptr - '0') << 4;
600 ✗ break;
601 }
602 ✗ if (*ptr >= 'a' && *ptr <= 'f') {
603 ✗ *exif_ptr = (*ptr - 'a' + 10) << 4;
604 ✗ break;
605 }
606 }
607 ✗ while (++ptr < end) {
608 ✗ if (*ptr >= '0' && *ptr <= '9') {
609 ✗ *exif_ptr += *ptr - '0';
610 ✗ break;
611 }
612 ✗ if (*ptr >= 'a' && *ptr <= 'f') {
613 ✗ *exif_ptr += *ptr - 'a' + 10;
614 ✗ break;
615 }
616 }
617 ✗ if (ptr > end)
618 ✗ return AVERROR_INVALIDDATA;
619 ✗ exif_ptr++;
620 }
621
622 ✗ return 0;
623 }
624
625 138 static int decode_text_chunk(PNGDecContext *s, GetByteContext *gb, int compressed)
626 {
627 int ret, method;
628 138 const uint8_t *data = gb->buffer;
629 138 const uint8_t *data_end = gb->buffer_end;
630 138 const char *keyword = data;
631 138 const char *keyword_end = memchr(keyword, 0, data_end - data);
632 138 char *kw_utf8 = NULL, *txt_utf8 = NULL;
633 const char *text;
634 unsigned text_len;
635 AVBPrint bp;
636
637
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 138 times.
 138 if (!keyword_end)
638 ✗ return AVERROR_INVALIDDATA;
639 138 data = keyword_end + 1;
640
641
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 138 times.
 138 if (compressed) {
642 ✗ if (data == data_end)
643 ✗ return AVERROR_INVALIDDATA;
644 ✗ method = *(data++);
645 ✗ if (method)
646 ✗ return AVERROR_INVALIDDATA;
647 ✗ if ((ret = decode_zbuf(&bp, data, data_end, s->avctx)) < 0)
648 ✗ return ret;
649 ✗ text = bp.str;
650 ✗ text_len = bp.len;
651 } else {
652 138 text = data;
653 138 text_len = data_end - data;
654 }
655
656 138 txt_utf8 = iso88591_to_utf8(text, text_len);
657
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 138 times.
 138 if (compressed)
658 ✗ av_bprint_finalize(&bp, NULL);
659
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 138 times.
 138 if (!txt_utf8)
660 ✗ return AVERROR(ENOMEM);
661 138 kw_utf8 = iso88591_to_utf8(keyword, keyword_end - keyword);
662
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 138 times.
 138 if (!kw_utf8) {
663 ✗ av_free(txt_utf8);
664 ✗ return AVERROR(ENOMEM);
665 }
666
667
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 138 times.
 138 if (!strcmp(kw_utf8, "Raw profile type exif")) {
668 ✗ ret = decode_text_to_exif(s, txt_utf8);
669 ✗ if (ret < 0) {;
670 ✗ av_buffer_unref(&s->exif_data);
671 } else {
672 ✗ av_freep(&kw_utf8);
673 ✗ av_freep(&txt_utf8);
674 ✗ return ret;
675 }
676 }
677
678 138 av_dict_set(&s->frame_metadata, kw_utf8, txt_utf8,
679 AV_DICT_DONT_STRDUP_KEY | AV_DICT_DONT_STRDUP_VAL);
680 138 return 0;
681 }
682
683 433 static int decode_ihdr_chunk(AVCodecContext *avctx, PNGDecContext *s,
684 GetByteContext *gb)
685 {
686
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 433 times.
 433 if (bytestream2_get_bytes_left(gb) != 13)
687 ✗ return AVERROR_INVALIDDATA;
688
689
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 433 times.
 433 if (s->pic_state & PNG_IDAT) {
690 ✗ av_log(avctx, AV_LOG_ERROR, "IHDR after IDAT\n");
691 ✗ return AVERROR_INVALIDDATA;
692 }
693
694
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 433 times.
 433 if (s->hdr_state & PNG_IHDR) {
695 ✗ av_log(avctx, AV_LOG_ERROR, "Multiple IHDR\n");
696 ✗ return AVERROR_INVALIDDATA;
697 }
698
699 433 s->width = s->cur_w = bytestream2_get_be32(gb);
700 433 s->height = s->cur_h = bytestream2_get_be32(gb);
701
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 433 times.
 433 if (av_image_check_size(s->width, s->height, 0, avctx)) {
702 ✗ s->cur_w = s->cur_h = s->width = s->height = 0;
703 ✗ av_log(avctx, AV_LOG_ERROR, "Invalid image size\n");
704 ✗ return AVERROR_INVALIDDATA;
705 }
706 433 s->bit_depth = bytestream2_get_byte(gb);
707
6/6
✓ Branch 0 taken 431 times.
✓ Branch 1 taken 2 times.
✓ Branch 2 taken 429 times.
✓ Branch 3 taken 2 times.
✓ Branch 4 taken 427 times.
✓ Branch 5 taken 2 times.
 433 if (s->bit_depth != 1 && s->bit_depth != 2 && s->bit_depth != 4 &&
708
3/4
✓ Branch 0 taken 40 times.
✓ Branch 1 taken 387 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 40 times.
 427 s->bit_depth != 8 && s->bit_depth != 16) {
709 ✗ av_log(avctx, AV_LOG_ERROR, "Invalid bit depth\n");
710 ✗ goto error;
711 }
712 433 s->color_type = bytestream2_get_byte(gb);
713 433 s->compression_type = bytestream2_get_byte(gb);
714
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 433 times.
 433 if (s->compression_type) {
715 ✗ av_log(avctx, AV_LOG_ERROR, "Invalid compression method %d\n", s->compression_type);
716 ✗ goto error;
717 }
718 433 s->filter_type = bytestream2_get_byte(gb);
719 433 s->interlace_type = bytestream2_get_byte(gb);
720 433 s->hdr_state |= PNG_IHDR;
721
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 433 times.
 433 if (avctx->debug & FF_DEBUG_PICT_INFO)
722 ✗ av_log(avctx, AV_LOG_DEBUG, "width=%d height=%d depth=%d color_type=%d "
723 "compression_type=%d filter_type=%d interlace_type=%d\n",
724 s->width, s->height, s->bit_depth, s->color_type,
725 s->compression_type, s->filter_type, s->interlace_type);
726
727 433 return 0;
728 ✗ error:
729 ✗ s->cur_w = s->cur_h = s->width = s->height = 0;
730 ✗ s->bit_depth = 8;
731 ✗ return AVERROR_INVALIDDATA;
732 }
733
734 394 static int decode_phys_chunk(AVCodecContext *avctx, PNGDecContext *s,
735 GetByteContext *gb)
736 {
737
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 394 times.
 394 if (s->pic_state & PNG_IDAT) {
738 ✗ av_log(avctx, AV_LOG_ERROR, "pHYs after IDAT\n");
739 ✗ return AVERROR_INVALIDDATA;
740 }
741 394 avctx->sample_aspect_ratio.num = bytestream2_get_be32(gb);
742 394 avctx->sample_aspect_ratio.den = bytestream2_get_be32(gb);
743
2/4
✓ Branch 0 taken 394 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 394 times.
 394 if (avctx->sample_aspect_ratio.num < 0 || avctx->sample_aspect_ratio.den < 0)
744 ✗ avctx->sample_aspect_ratio = (AVRational){ 0, 1 };
745 394 bytestream2_skip(gb, 1); /* unit specifier */
746
747 394 return 0;
748 }
749
750 2 static int decode_exif_chunk(AVCodecContext *avctx, PNGDecContext *s,
751 GetByteContext *gb)
752 {
753
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (!(s->hdr_state & PNG_IHDR)) {
754 ✗ av_log(avctx, AV_LOG_ERROR, "eXIf before IHDR\n");
755 ✗ return AVERROR_INVALIDDATA;
756 }
757
758 2 av_buffer_unref(&s->exif_data);
759 2 s->exif_data = av_buffer_alloc(bytestream2_get_bytes_left(gb));
760
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (!s->exif_data)
761 ✗ return AVERROR(ENOMEM);
762 2 bytestream2_get_buffer(gb, s->exif_data->data, s->exif_data->size);
763
764 2 return 0;
765 }
766
767 /*
768 * This populates AVCodecContext fields so it must be called before
769 * ff_thread_finish_setup() to avoid a race condition with respect to the
770 * generic copying of avctx fields.
771 */
772 693 static int populate_avctx_color_fields(AVCodecContext *avctx, AVFrame *frame)
773 {
774 693 PNGDecContext *s = avctx->priv_data;
775 int ret;
776
777
2/2
✓ Branch 0 taken 4 times.
✓ Branch 1 taken 689 times.
 693 if (s->have_cicp) {
778
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 if (s->cicp_primaries >= AVCOL_PRI_NB)
779 ✗ av_log(avctx, AV_LOG_WARNING, "unrecognized cICP primaries\n");
780 else
781 4 avctx->color_primaries = frame->color_primaries = s->cicp_primaries;
782
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 if (s->cicp_trc >= AVCOL_TRC_NB)
783 ✗ av_log(avctx, AV_LOG_WARNING, "unrecognized cICP transfer\n");
784 else
785 4 avctx->color_trc = frame->color_trc = s->cicp_trc;
786
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 if (s->cicp_range == 0) {
787 ✗ av_log(avctx, AV_LOG_WARNING, "tv-range cICP tag found. Colors may be wrong\n");
788 ✗ avctx->color_range = frame->color_range = AVCOL_RANGE_MPEG;
789
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 } else if (s->cicp_range != 1) {
790 /* we already printed a warning when parsing the cICP chunk */
791 ✗ avctx->color_range = frame->color_range = AVCOL_RANGE_UNSPECIFIED;
792 }
793
2/2
✓ Branch 0 taken 7 times.
✓ Branch 1 taken 682 times.
 689 } else if (s->iccp_data) {
794 AVFrameSideData *sd;
795 7 ret = ff_frame_new_side_data(avctx, frame, AV_FRAME_DATA_ICC_PROFILE,
796 s->iccp_data_len, &sd);
797
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (ret < 0)
798 ✗ return ret;
799
1/2
✓ Branch 0 taken 7 times.
✗ Branch 1 not taken.
 7 if (sd) {
800 7 memcpy(sd->data, s->iccp_data, s->iccp_data_len);
801 7 av_dict_set(&sd->metadata, "name", s->iccp_name, 0);
802 }
803
2/2
✓ Branch 0 taken 41 times.
✓ Branch 1 taken 641 times.
 682 } else if (s->have_srgb) {
804 41 avctx->color_primaries = frame->color_primaries = AVCOL_PRI_BT709;
805 41 avctx->color_trc = frame->color_trc = AVCOL_TRC_IEC61966_2_1;
806
2/2
✓ Branch 0 taken 7 times.
✓ Branch 1 taken 634 times.
 641 } else if (s->have_chrm) {
807 AVColorPrimariesDesc desc;
808 enum AVColorPrimaries prim;
809 7 desc.wp.x = av_make_q(s->white_point[0], 100000);
810 7 desc.wp.y = av_make_q(s->white_point[1], 100000);
811 7 desc.prim.r.x = av_make_q(s->display_primaries[0][0], 100000);
812 7 desc.prim.r.y = av_make_q(s->display_primaries[0][1], 100000);
813 7 desc.prim.g.x = av_make_q(s->display_primaries[1][0], 100000);
814 7 desc.prim.g.y = av_make_q(s->display_primaries[1][1], 100000);
815 7 desc.prim.b.x = av_make_q(s->display_primaries[2][0], 100000);
816 7 desc.prim.b.y = av_make_q(s->display_primaries[2][1], 100000);
817 7 prim = av_csp_primaries_id_from_desc(&desc);
818
1/2
✓ Branch 0 taken 7 times.
✗ Branch 1 not taken.
 7 if (prim != AVCOL_PRI_UNSPECIFIED)
819 7 avctx->color_primaries = frame->color_primaries = prim;
820 else
821 ✗ av_log(avctx, AV_LOG_WARNING, "unknown cHRM primaries\n");
822 }
823
824 /* these chunks override gAMA */
825
6/6
✓ Branch 0 taken 686 times.
✓ Branch 1 taken 7 times.
✓ Branch 2 taken 645 times.
✓ Branch 3 taken 41 times.
✓ Branch 4 taken 4 times.
✓ Branch 5 taken 641 times.
 693 if (s->iccp_data || s->have_srgb || s->have_cicp) {
826 52 av_dict_set(&s->frame_metadata, "gamma", NULL, 0);
827
2/2
✓ Branch 0 taken 34 times.
✓ Branch 1 taken 607 times.
 641 } else if (s->gamma) {
828 /*
829 * These values are 100000/2.2, 100000/2.8, 100000/2.6, and
830 * 100000/1.0 respectively. 45455, 35714, and 38462, and 100000.
831 * There's a 0.001 gamma tolerance here in case of floating
832 * point issues when the PNG was written.
833 *
834 * None of the other enums have a pure gamma curve so it makes
835 * sense to leave those to sRGB and cICP.
836 */
837
3/4
✓ Branch 0 taken 26 times.
✓ Branch 1 taken 8 times.
✓ Branch 2 taken 26 times.
✗ Branch 3 not taken.
 34 if (s->gamma > 45355 && s->gamma < 45555)
838 26 avctx->color_trc = frame->color_trc = AVCOL_TRC_GAMMA22;
839
2/4
✓ Branch 0 taken 8 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 8 times.
 8 else if (s->gamma > 35614 && s->gamma < 35814)
840 ✗ avctx->color_trc = frame->color_trc = AVCOL_TRC_GAMMA28;
841
2/4
✓ Branch 0 taken 8 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 8 times.
 8 else if (s->gamma > 38362 && s->gamma < 38562)
842 ✗ avctx->color_trc = frame->color_trc = AVCOL_TRC_SMPTE428;
843
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 8 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 8 else if (s->gamma > 99900 && s->gamma < 100100)
844 ✗ avctx->color_trc = frame->color_trc = AVCOL_TRC_LINEAR;
845 }
846
847 /* PNG only supports RGB */
848 693 avctx->colorspace = frame->colorspace = AVCOL_SPC_RGB;
849
3/4
✓ Branch 0 taken 4 times.
✓ Branch 1 taken 689 times.
✓ Branch 2 taken 4 times.
✗ Branch 3 not taken.
 693 if (!s->have_cicp || s->cicp_range == 1)
850 693 avctx->color_range = frame->color_range = AVCOL_RANGE_JPEG;
851
852 /*
853 * tRNS sets alpha depth to full, so we ignore sBIT if set.
854 * As a result we must wait until now to set
855 * avctx->bits_per_raw_sample in case tRNS appears after sBIT
856 */
857
3/4
✓ Branch 0 taken 514 times.
✓ Branch 1 taken 179 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 514 times.
 693 if (!s->has_trns && s->significant_bits > 0)
858 ✗ avctx->bits_per_raw_sample = s->significant_bits;
859
860
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 691 times.
 693 if (s->have_clli) {
861 AVContentLightMetadata *clli;
862
863 2 ret = ff_decode_content_light_new(avctx, frame, &clli);
864
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (ret < 0)
865 ✗ return ret;
866
867
1/2
✓ Branch 0 taken 2 times.
✗ Branch 1 not taken.
 2 if (clli) {
868 /*
869 * 0.0001 divisor value
870 * see: https://www.w3.org/TR/png-3/#cLLI-chunk
871 */
872 2 clli->MaxCLL = s->clli_max / 10000;
873 2 clli->MaxFALL = s->clli_avg / 10000;
874 }
875 }
876
877
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 691 times.
 693 if (s->have_mdcv) {
878 AVMasteringDisplayMetadata *mdcv;
879
880 2 ret = ff_decode_mastering_display_new(avctx, frame, &mdcv);
881
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (ret < 0)
882 ✗ return ret;
883
884
1/2
✓ Branch 0 taken 2 times.
✗ Branch 1 not taken.
 2 if (mdcv) {
885 2 mdcv->has_primaries = 1;
886
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 2 times.
 8 for (int i = 0; i < 3; i++) {
887 6 mdcv->display_primaries[i][0] = av_make_q(s->mdcv_primaries[i][0], 50000);
888 6 mdcv->display_primaries[i][1] = av_make_q(s->mdcv_primaries[i][1], 50000);
889 }
890 2 mdcv->white_point[0] = av_make_q(s->mdcv_white_point[0], 50000);
891 2 mdcv->white_point[1] = av_make_q(s->mdcv_white_point[1], 50000);
892 2 mdcv->has_luminance = 1;
893 2 mdcv->max_luminance = av_make_q(s->mdcv_max_lum, 10000);
894 2 mdcv->min_luminance = av_make_q(s->mdcv_min_lum, 10000);
895 }
896 }
897
898 693 return 0;
899 }
900
901 12500 static int decode_idat_chunk(AVCodecContext *avctx, PNGDecContext *s,
902 GetByteContext *gb, AVFrame *p)
903 {
904 int ret;
905
2/2
✓ Branch 0 taken 1536 times.
✓ Branch 1 taken 10964 times.
 12500 size_t byte_depth = s->bit_depth > 8 ? 2 : 1;
906
907
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12500 times.
 12500 if (!p)
908 ✗ return AVERROR_INVALIDDATA;
909
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12500 times.
 12500 if (!(s->hdr_state & PNG_IHDR)) {
910 ✗ av_log(avctx, AV_LOG_ERROR, "IDAT without IHDR\n");
911 ✗ return AVERROR_INVALIDDATA;
912 }
913
2/2
✓ Branch 0 taken 693 times.
✓ Branch 1 taken 11807 times.
 12500 if (!(s->pic_state & PNG_IDAT)) {
914 /* init image info */
915 693 ret = ff_set_dimensions(avctx, s->width, s->height);
916
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 693 times.
 693 if (ret < 0)
917 ✗ return ret;
918
919 693 s->channels = ff_png_get_nb_channels(s->color_type);
920 693 s->bits_per_pixel = s->bit_depth * s->channels;
921 693 s->bpp = (s->bits_per_pixel + 7) >> 3;
922 693 s->row_size = (s->cur_w * s->bits_per_pixel + 7) >> 3;
923
924 /* Packed rows of sub-8-bit frames cannot be placed at the frame
925 * offset, as that one is a pixel and not a byte offset. */
926 693 s->subframe_packed = CONFIG_APNG_DECODER &&
927 976 avctx->codec_id == AV_CODEC_ID_APNG &&
928
5/6
✓ Branch 0 taken 283 times.
✓ Branch 1 taken 410 times.
✓ Branch 2 taken 21 times.
✓ Branch 3 taken 262 times.
✓ Branch 4 taken 21 times.
✗ Branch 5 not taken.
 693 s->bits_per_pixel <= 4 && !s->interlace_type;
929
930
6/6
✓ Branch 0 taken 686 times.
✓ Branch 1 taken 7 times.
✓ Branch 2 taken 679 times.
✓ Branch 3 taken 7 times.
✓ Branch 4 taken 632 times.
✓ Branch 5 taken 47 times.
 693 if ((s->bit_depth == 2 || s->bit_depth == 4 || s->bit_depth == 8) &&
931
2/2
✓ Branch 0 taken 486 times.
✓ Branch 1 taken 160 times.
 646 s->color_type == PNG_COLOR_TYPE_RGB) {
932 486 avctx->pix_fmt = AV_PIX_FMT_RGB24;
933
6/6
✓ Branch 0 taken 200 times.
✓ Branch 1 taken 7 times.
✓ Branch 2 taken 193 times.
✓ Branch 3 taken 7 times.
✓ Branch 4 taken 146 times.
✓ Branch 5 taken 47 times.
 207 } else if ((s->bit_depth == 2 || s->bit_depth == 4 || s->bit_depth == 8) &&
934
2/2
✓ Branch 0 taken 98 times.
✓ Branch 1 taken 62 times.
 160 s->color_type == PNG_COLOR_TYPE_RGB_ALPHA) {
935 98 avctx->pix_fmt = AV_PIX_FMT_RGBA;
936
6/6
✓ Branch 0 taken 102 times.
✓ Branch 1 taken 7 times.
✓ Branch 2 taken 95 times.
✓ Branch 3 taken 7 times.
✓ Branch 4 taken 48 times.
✓ Branch 5 taken 47 times.
 109 } else if ((s->bit_depth == 2 || s->bit_depth == 4 || s->bit_depth == 8) &&
937
2/2
✓ Branch 0 taken 4 times.
✓ Branch 1 taken 58 times.
 62 s->color_type == PNG_COLOR_TYPE_GRAY) {
938 4 avctx->pix_fmt = AV_PIX_FMT_GRAY8;
939
2/2
✓ Branch 0 taken 40 times.
✓ Branch 1 taken 65 times.
 105 } else if (s->bit_depth == 16 &&
940
2/2
✓ Branch 0 taken 16 times.
✓ Branch 1 taken 24 times.
 40 s->color_type == PNG_COLOR_TYPE_GRAY) {
941 16 avctx->pix_fmt = AV_PIX_FMT_GRAY16BE;
942
2/2
✓ Branch 0 taken 24 times.
✓ Branch 1 taken 65 times.
 89 } else if (s->bit_depth == 16 &&
943
2/2
✓ Branch 0 taken 18 times.
✓ Branch 1 taken 6 times.
 24 s->color_type == PNG_COLOR_TYPE_RGB) {
944 18 avctx->pix_fmt = AV_PIX_FMT_RGB48BE;
945
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 65 times.
 71 } else if (s->bit_depth == 16 &&
946
2/2
✓ Branch 0 taken 4 times.
✓ Branch 1 taken 2 times.
 6 s->color_type == PNG_COLOR_TYPE_RGB_ALPHA) {
947 4 avctx->pix_fmt = AV_PIX_FMT_RGBA64BE;
948
8/8
✓ Branch 0 taken 60 times.
✓ Branch 1 taken 7 times.
✓ Branch 2 taken 53 times.
✓ Branch 3 taken 7 times.
✓ Branch 4 taken 46 times.
✓ Branch 5 taken 7 times.
✓ Branch 6 taken 42 times.
✓ Branch 7 taken 4 times.
 67 } else if ((s->bits_per_pixel == 1 || s->bits_per_pixel == 2 || s->bits_per_pixel == 4 || s->bits_per_pixel == 8) &&
949
1/2
✓ Branch 0 taken 63 times.
✗ Branch 1 not taken.
 63 s->color_type == PNG_COLOR_TYPE_PALETTE) {
950
1/2
✓ Branch 0 taken 63 times.
✗ Branch 1 not taken.
 63 avctx->pix_fmt = avctx->codec_id == AV_CODEC_ID_APNG ? AV_PIX_FMT_RGBA : AV_PIX_FMT_PAL8;
951
1/6
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✗ Branch 5 not taken.
 4 } else if (s->bit_depth == 1 && s->bits_per_pixel == 1 && avctx->codec_id != AV_CODEC_ID_APNG) {
952 ✗ avctx->pix_fmt = AV_PIX_FMT_MONOBLACK;
953
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 2 times.
 4 } else if (s->bit_depth == 8 &&
954
1/2
✓ Branch 0 taken 2 times.
✗ Branch 1 not taken.
 2 s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) {
955 2 avctx->pix_fmt = AV_PIX_FMT_YA8;
956
1/2
✓ Branch 0 taken 2 times.
✗ Branch 1 not taken.
 2 } else if (s->bit_depth == 16 &&
957
1/2
✓ Branch 0 taken 2 times.
✗ Branch 1 not taken.
 2 s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) {
958 2 avctx->pix_fmt = AV_PIX_FMT_YA16BE;
959 } else {
960 ✗ avpriv_report_missing_feature(avctx,
961 "Bit depth %d color type %d",
962 s->bit_depth, s->color_type);
963 ✗ return AVERROR_PATCHWELCOME;
964 }
965
966
4/4
✓ Branch 0 taken 179 times.
✓ Branch 1 taken 514 times.
✓ Branch 2 taken 137 times.
✓ Branch 3 taken 42 times.
 693 if (s->has_trns && s->color_type != PNG_COLOR_TYPE_PALETTE) {
967
1/5
✓ Branch 0 taken 137 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
 137 switch (avctx->pix_fmt) {
968 137 case AV_PIX_FMT_RGB24:
969 137 avctx->pix_fmt = AV_PIX_FMT_RGBA;
970 137 break;
971
972 ✗ case AV_PIX_FMT_RGB48BE:
973 ✗ avctx->pix_fmt = AV_PIX_FMT_RGBA64BE;
974 ✗ break;
975
976 ✗ case AV_PIX_FMT_GRAY8:
977 ✗ avctx->pix_fmt = AV_PIX_FMT_YA8;
978 ✗ break;
979
980 ✗ case AV_PIX_FMT_GRAY16BE:
981 ✗ avctx->pix_fmt = AV_PIX_FMT_YA16BE;
982 ✗ break;
983
984 ✗ default:
985 ✗ avpriv_request_sample(avctx, "bit depth %d "
986 "and color type %d with TRNS",
987 s->bit_depth, s->color_type);
988 ✗ return AVERROR_INVALIDDATA;
989 }
990
991 137 s->bpp += byte_depth;
992 }
993
994 /* PNG spec mandates independent alpha channel */
995
2/2
✓ Branch 0 taken 591 times.
✓ Branch 1 taken 102 times.
 693 if (s->color_type == PNG_COLOR_TYPE_RGB_ALPHA ||
996
2/2
✓ Branch 0 taken 4 times.
✓ Branch 1 taken 587 times.
 591 s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
997 106 avctx->alpha_mode = AVALPHA_MODE_STRAIGHT;
998
999 693 ff_progress_frame_unref(&s->picture);
1000
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 692 times.
 693 if (s->dispose_op == APNG_DISPOSE_OP_PREVIOUS) {
1001 /* We only need a buffer for the current picture. */
1002 1 ret = ff_thread_get_buffer(avctx, p, 0);
1003
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 1 times.
 1 if (ret < 0)
1004 ✗ return ret;
1005
2/2
✓ Branch 0 taken 12 times.
✓ Branch 1 taken 680 times.
 692 } else if (s->dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
1006 /* We need a buffer for the current picture as well as
1007 * a buffer for the reference to retain. */
1008 12 ret = ff_progress_frame_get_buffer(avctx, &s->picture,
1009 AV_GET_BUFFER_FLAG_REF);
1010
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12 times.
 12 if (ret < 0)
1011 ✗ return ret;
1012 12 ret = ff_thread_get_buffer(avctx, p, 0);
1013
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12 times.
 12 if (ret < 0)
1014 ✗ return ret;
1015 } else {
1016 /* The picture output this time and the reference to retain coincide. */
1017 680 ret = ff_progress_frame_get_buffer(avctx, &s->picture,
1018 AV_GET_BUFFER_FLAG_REF);
1019
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 680 times.
 680 if (ret < 0)
1020 ✗ return ret;
1021 680 ret = av_frame_ref(p, s->picture.f);
1022
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 680 times.
 680 if (ret < 0)
1023 ✗ return ret;
1024 }
1025
1026 693 p->pict_type = AV_PICTURE_TYPE_I;
1027 693 p->flags |= AV_FRAME_FLAG_KEY;
1028
2/2
✓ Branch 0 taken 10 times.
✓ Branch 1 taken 683 times.
 693 p->flags |= AV_FRAME_FLAG_INTERLACED * !!s->interlace_type;
1029
1030
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 693 times.
 693 if ((ret = populate_avctx_color_fields(avctx, p)) < 0)
1031 ✗ return ret;
1032 693 ff_thread_finish_setup(avctx);
1033
1034 /* compute the compressed row size */
1035
2/2
✓ Branch 0 taken 683 times.
✓ Branch 1 taken 10 times.
 693 if (!s->interlace_type) {
1036 683 s->crow_size = s->row_size + 1;
1037 } else {
1038 10 s->pass = 0;
1039 10 s->pass_row_size = ff_png_pass_row_size(s->pass,
1040 s->bits_per_pixel,
1041 s->cur_w);
1042 10 s->crow_size = s->pass_row_size + 1;
1043 }
1044 ff_dlog(avctx, "row_size=%d crow_size =%d\n",
1045 s->row_size, s->crow_size);
1046
1047 /* copy the palette if needed */
1048
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 693 times.
 693 if (avctx->pix_fmt == AV_PIX_FMT_PAL8)
1049 ✗ memcpy(p->data[1], s->palette, 256 * sizeof(uint32_t));
1050 /* empty row is used if differencing to the first row */
1051 693 av_fast_padded_mallocz(&s->last_row, &s->last_row_size, s->row_size);
1052
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 693 times.
 693 if (!s->last_row)
1053 ✗ return AVERROR_INVALIDDATA;
1054
2/2
✓ Branch 0 taken 683 times.
✓ Branch 1 taken 10 times.
 693 if (s->interlace_type ||
1055
2/2
✓ Branch 0 taken 102 times.
✓ Branch 1 taken 581 times.
 683 s->color_type == PNG_COLOR_TYPE_RGB_ALPHA) {
1056 112 av_fast_padded_malloc(&s->tmp_row, &s->tmp_row_size, s->row_size);
1057
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 112 times.
 112 if (!s->tmp_row)
1058 ✗ return AVERROR_INVALIDDATA;
1059 }
1060 /* compressed row */
1061 693 av_fast_padded_malloc(&s->buffer, &s->buffer_size, s->row_size + 16);
1062
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 693 times.
 693 if (!s->buffer)
1063 ✗ return AVERROR(ENOMEM);
1064
1065 /* we want crow_buf+1 to be 16-byte aligned */
1066 693 s->crow_buf = s->buffer + 15;
1067 693 s->zstream.zstream.avail_out = s->crow_size;
1068 693 s->zstream.zstream.next_out = s->crow_buf;
1069 }
1070
1071 12500 s->pic_state |= PNG_IDAT;
1072
1073 /* set image to non-transparent bpp while decompressing */
1074
4/4
✓ Branch 0 taken 189 times.
✓ Branch 1 taken 12311 times.
✓ Branch 2 taken 147 times.
✓ Branch 3 taken 42 times.
 12500 if (s->has_trns && s->color_type != PNG_COLOR_TYPE_PALETTE)
1075 147 s->bpp -= byte_depth;
1076
1077 12500 ret = png_decode_idat(s, gb, p->data[0], p->linesize[0]);
1078
1079
4/4
✓ Branch 0 taken 189 times.
✓ Branch 1 taken 12311 times.
✓ Branch 2 taken 147 times.
✓ Branch 3 taken 42 times.
 12500 if (s->has_trns && s->color_type != PNG_COLOR_TYPE_PALETTE)
1080 147 s->bpp += byte_depth;
1081
1082
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12500 times.
 12500 if (ret < 0)
1083 ✗ return ret;
1084
1085 12500 return 0;
1086 }
1087
1088 9 static int decode_plte_chunk(AVCodecContext *avctx, PNGDecContext *s,
1089 GetByteContext *gb)
1090 {
1091 9 int length = bytestream2_get_bytes_left(gb);
1092 int n, i, r, g, b;
1093
1094
2/4
✓ Branch 0 taken 9 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 9 times.
 9 if ((length % 3) != 0 || length > 256 * 3)
1095 ✗ return AVERROR_INVALIDDATA;
1096 /* read the palette */
1097 9 n = length / 3;
1098
2/2
✓ Branch 0 taken 752 times.
✓ Branch 1 taken 9 times.
 761 for (i = 0; i < n; i++) {
1099 752 r = bytestream2_get_byte(gb);
1100 752 g = bytestream2_get_byte(gb);
1101 752 b = bytestream2_get_byte(gb);
1102 752 s->palette[i] = (0xFFU << 24) | (r << 16) | (g << 8) | b;
1103 }
1104
2/2
✓ Branch 0 taken 1552 times.
✓ Branch 1 taken 9 times.
 1561 for (; i < 256; i++)
1105 1552 s->palette[i] = (0xFFU << 24);
1106 9 s->hdr_state |= PNG_PLTE;
1107
1108 9 return 0;
1109 }
1110
1111 7 static int decode_trns_chunk(AVCodecContext *avctx, PNGDecContext *s,
1112 GetByteContext *gb)
1113 {
1114 7 int length = bytestream2_get_bytes_left(gb);
1115 int v, i;
1116
1117
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (!(s->hdr_state & PNG_IHDR)) {
1118 ✗ av_log(avctx, AV_LOG_ERROR, "trns before IHDR\n");
1119 ✗ return AVERROR_INVALIDDATA;
1120 }
1121
1122
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (s->pic_state & PNG_IDAT) {
1123 ✗ av_log(avctx, AV_LOG_ERROR, "trns after IDAT\n");
1124 ✗ return AVERROR_INVALIDDATA;
1125 }
1126
1127
2/2
✓ Branch 0 taken 3 times.
✓ Branch 1 taken 4 times.
 7 if (s->color_type == PNG_COLOR_TYPE_PALETTE) {
1128
2/4
✓ Branch 0 taken 3 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 3 times.
 3 if (length > 256 || !(s->hdr_state & PNG_PLTE))
1129 ✗ return AVERROR_INVALIDDATA;
1130
1131
2/2
✓ Branch 0 taken 51 times.
✓ Branch 1 taken 3 times.
 54 for (i = 0; i < length; i++) {
1132 51 unsigned v = bytestream2_get_byte(gb);
1133 51 s->palette[i] = (s->palette[i] & 0x00ffffff) | (v << 24);
1134 }
1135
2/4
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 4 times.
✗ Branch 3 not taken.
 4 } else if (s->color_type == PNG_COLOR_TYPE_GRAY || s->color_type == PNG_COLOR_TYPE_RGB) {
1136
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 4 if ((s->color_type == PNG_COLOR_TYPE_GRAY && length != 2) ||
1137
2/4
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 4 times.
✗ Branch 3 not taken.
 4 (s->color_type == PNG_COLOR_TYPE_RGB && length != 6) ||
1138
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 s->bit_depth == 1)
1139 ✗ return AVERROR_INVALIDDATA;
1140
1141
2/2
✓ Branch 0 taken 12 times.
✓ Branch 1 taken 4 times.
 16 for (i = 0; i < length / 2; i++) {
1142 /* only use the least significant bits */
1143 12 v = av_zero_extend(bytestream2_get_be16(gb), s->bit_depth);
1144
1145
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12 times.
 12 if (s->bit_depth > 8)
1146 ✗ AV_WB16(&s->transparent_color_be[2 * i], v);
1147 else
1148 12 s->transparent_color_be[i] = v;
1149 }
1150 } else {
1151 ✗ return AVERROR_INVALIDDATA;
1152 }
1153
1154 7 s->has_trns = 1;
1155
1156 7 return 0;
1157 }
1158
1159 7 static int decode_iccp_chunk(PNGDecContext *s, GetByteContext *gb)
1160 {
1161 7 int ret, cnt = 0;
1162 AVBPrint bp;
1163
1164
3/4
✓ Branch 1 taken 147 times.
✓ Branch 2 taken 7 times.
✓ Branch 3 taken 147 times.
✗ Branch 4 not taken.
 154 while ((s->iccp_name[cnt++] = bytestream2_get_byte(gb)) && cnt < 81);
1165
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (cnt > 80) {
1166 ✗ av_log(s->avctx, AV_LOG_ERROR, "iCCP with invalid name!\n");
1167 ✗ ret = AVERROR_INVALIDDATA;
1168 ✗ goto fail;
1169 }
1170
1171
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 7 times.
 7 if (bytestream2_get_byte(gb) != 0) {
1172 ✗ av_log(s->avctx, AV_LOG_ERROR, "iCCP with invalid compression!\n");
1173 ✗ ret = AVERROR_INVALIDDATA;
1174 ✗ goto fail;
1175 }
1176
1177
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 7 times.
 7 if ((ret = decode_zbuf(&bp, gb->buffer, gb->buffer_end, s->avctx)) < 0)
1178 ✗ return ret;
1179
1180 7 av_freep(&s->iccp_data);
1181 7 ret = av_bprint_finalize(&bp, (char **)&s->iccp_data);
1182
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (ret < 0)
1183 ✗ return ret;
1184 7 s->iccp_data_len = bp.len;
1185
1186 7 return 0;
1187 ✗ fail:
1188 ✗ s->iccp_name[0] = 0;
1189 ✗ return ret;
1190 }
1191
1192 ✗ static int decode_sbit_chunk(AVCodecContext *avctx, PNGDecContext *s,
1193 GetByteContext *gb)
1194 {
1195 ✗ int bits = 0;
1196 int channels;
1197 ✗ int remainder = bytestream2_get_bytes_left(gb);
1198
1199 ✗ if (!(s->hdr_state & PNG_IHDR)) {
1200 ✗ av_log(avctx, AV_LOG_ERROR, "sBIT before IHDR\n");
1201 ✗ return AVERROR_INVALIDDATA;
1202 }
1203
1204 ✗ if (s->pic_state & PNG_IDAT) {
1205 ✗ av_log(avctx, AV_LOG_WARNING, "Ignoring illegal sBIT chunk after IDAT\n");
1206 ✗ return 0;
1207 }
1208
1209 ✗ channels = s->color_type & PNG_COLOR_MASK_PALETTE ? 3 : ff_png_get_nb_channels(s->color_type);
1210
1211 ✗ if (remainder != channels) {
1212 ✗ av_log(avctx, AV_LOG_WARNING, "Invalid sBIT size: %d, expected: %d\n", remainder, channels);
1213 /* not enough space left in chunk to read info */
1214 ✗ if (remainder < channels)
1215 ✗ return 0;
1216 }
1217
1218 ✗ for (int i = 0; i < channels; i++) {
1219 ✗ int b = bytestream2_get_byteu(gb);
1220 ✗ bits = FFMAX(b, bits);
1221 }
1222
1223 ✗ if (bits <= 0 || bits > (s->color_type & PNG_COLOR_MASK_PALETTE ? 8 : s->bit_depth)) {
1224 ✗ av_log(avctx, AV_LOG_WARNING, "Invalid significant bits: %d\n", bits);
1225 ✗ return 0;
1226 }
1227 ✗ s->significant_bits = bits;
1228
1229 ✗ return 0;
1230 }
1231
1232 /* expand one row of packed sub-8-bit samples to one byte per sample, in place */
1233 195 static void unpack_small_row(PNGDecContext *s, uint8_t *pd, int width)
1234 {
1235
3/4
✓ Branch 0 taken 65 times.
✓ Branch 1 taken 130 times.
✓ Branch 2 taken 65 times.
✗ Branch 3 not taken.
 260 if (s->bits_per_pixel == 1 && s->color_type == PNG_COLOR_TYPE_PALETTE) {
1236 int i, k;
1237
1238 65 i = width / 8;
1239
2/2
✓ Branch 0 taken 455 times.
✓ Branch 1 taken 65 times.
 520 for (k = 7; k >= 1; k--)
1240
2/2
✓ Branch 0 taken 175 times.
✓ Branch 1 taken 280 times.
 455 if ((width&7) >= k)
1241 175 pd[8*i + k - 1] = (pd[i]>>8-k) & 1;
1242
2/2
✓ Branch 0 taken 120 times.
✓ Branch 1 taken 65 times.
 185 for (i--; i >= 0; i--) {
1243 120 pd[8*i + 7]= pd[i] & 1;
1244 120 pd[8*i + 6]= (pd[i]>>1) & 1;
1245 120 pd[8*i + 5]= (pd[i]>>2) & 1;
1246 120 pd[8*i + 4]= (pd[i]>>3) & 1;
1247 120 pd[8*i + 3]= (pd[i]>>4) & 1;
1248 120 pd[8*i + 2]= (pd[i]>>5) & 1;
1249 120 pd[8*i + 1]= (pd[i]>>6) & 1;
1250 120 pd[8*i + 0]= pd[i]>>7;
1251 }
1252
2/2
✓ Branch 0 taken 65 times.
✓ Branch 1 taken 65 times.
 130 } else if (s->bits_per_pixel == 2) {
1253 int i;
1254
1255 65 i = width / 4;
1256
1/2
✓ Branch 0 taken 65 times.
✗ Branch 1 not taken.
 65 if (s->color_type == PNG_COLOR_TYPE_PALETTE) {
1257
2/2
✓ Branch 0 taken 25 times.
✓ Branch 1 taken 40 times.
 65 if ((width&3) >= 3) pd[4*i + 2]= (pd[i] >> 2) & 3;
1258
2/2
✓ Branch 0 taken 25 times.
✓ Branch 1 taken 40 times.
 65 if ((width&3) >= 2) pd[4*i + 1]= (pd[i] >> 4) & 3;
1259
2/2
✓ Branch 0 taken 25 times.
✓ Branch 1 taken 40 times.
 65 if ((width&3) >= 1) pd[4*i + 0]= pd[i] >> 6;
1260
2/2
✓ Branch 0 taken 265 times.
✓ Branch 1 taken 65 times.
 330 for (i--; i >= 0; i--) {
1261 265 pd[4*i + 3]= pd[i] & 3;
1262 265 pd[4*i + 2]= (pd[i]>>2) & 3;
1263 265 pd[4*i + 1]= (pd[i]>>4) & 3;
1264 265 pd[4*i + 0]= pd[i]>>6;
1265 }
1266 } else {
1267 ✗ if ((width&3) >= 3) pd[4*i + 2]= ((pd[i]>>2) & 3)*0x55;
1268 ✗ if ((width&3) >= 2) pd[4*i + 1]= ((pd[i]>>4) & 3)*0x55;
1269 ✗ if ((width&3) >= 1) pd[4*i + 0]= ( pd[i]>>6 )*0x55;
1270 ✗ for (i--; i >= 0; i--) {
1271 ✗ pd[4*i + 3]= ( pd[i] & 3)*0x55;
1272 ✗ pd[4*i + 2]= ((pd[i]>>2) & 3)*0x55;
1273 ✗ pd[4*i + 1]= ((pd[i]>>4) & 3)*0x55;
1274 ✗ pd[4*i + 0]= ( pd[i]>>6 )*0x55;
1275 }
1276 }
1277
1/2
✓ Branch 0 taken 65 times.
✗ Branch 1 not taken.
 65 } else if (s->bits_per_pixel == 4) {
1278 int i;
1279
1280 65 i = width/2;
1281
1/2
✓ Branch 0 taken 65 times.
✗ Branch 1 not taken.
 65 if (s->color_type == PNG_COLOR_TYPE_PALETTE) {
1282
2/2
✓ Branch 0 taken 25 times.
✓ Branch 1 taken 40 times.
 65 if (width&1) pd[2*i+0]= pd[i]>>4;
1283
2/2
✓ Branch 0 taken 555 times.
✓ Branch 1 taken 65 times.
 620 for (i--; i >= 0; i--) {
1284 555 pd[2*i + 1] = pd[i] & 15;
1285 555 pd[2*i + 0] = pd[i] >> 4;
1286 }
1287 } else {
1288 ✗ if (width & 1) pd[2*i + 0]= (pd[i] >> 4) * 0x11;
1289 ✗ for (i--; i >= 0; i--) {
1290 ✗ pd[2*i + 1] = (pd[i] & 15) * 0x11;
1291 ✗ pd[2*i + 0] = (pd[i] >> 4) * 0x11;
1292 }
1293 }
1294 }
1295 195 }
1296
1297 ✗ static void handle_small_bpp(PNGDecContext *s, AVFrame *p)
1298 {
1299 ✗ uint8_t *pd = p->data[0];
1300
1301 ✗ for (int j = 0; j < s->height; j++) {
1302 ✗ unpack_small_row(s, pd, s->width);
1303 ✗ pd += p->linesize[0];
1304 }
1305 ✗ }
1306
1307 /* The offsets of an APNG frame are pixel offsets, so they cannot be applied
1308 * to the packed rows: those are decoded at the start of the frame row and
1309 * moved to their position within the frame once unpacked. */
1310 21 static void handle_small_bpp_apng(PNGDecContext *s, AVFrame *p)
1311 {
1312 /* one byte per sample once unpacked, that is one palette index or one
1313 * gray sample per pixel */
1314 21 const int bpp = s->channels;
1315 21 uint8_t *pd = p->data[0] + s->y_offset * p->linesize[0];
1316
1317
2/2
✓ Branch 0 taken 195 times.
✓ Branch 1 taken 21 times.
 216 for (int j = 0; j < s->cur_h; j++) {
1318 195 unpack_small_row(s, pd, s->cur_w);
1319
2/2
✓ Branch 0 taken 75 times.
✓ Branch 1 taken 120 times.
 195 if (s->x_offset)
1320 75 memmove(pd + s->x_offset * bpp, pd, s->cur_w * bpp);
1321 195 pd += p->linesize[0];
1322 }
1323 21 }
1324
1325 283 static int decode_fctl_chunk(AVCodecContext *avctx, PNGDecContext *s,
1326 GetByteContext *gb)
1327 {
1328 uint32_t sequence_number;
1329 int cur_w, cur_h, x_offset, y_offset, dispose_op, blend_op;
1330
1331
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 283 times.
 283 if (bytestream2_get_bytes_left(gb) != APNG_FCTL_CHUNK_SIZE)
1332 ✗ return AVERROR_INVALIDDATA;
1333
1334
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 283 times.
 283 if (!(s->hdr_state & PNG_IHDR)) {
1335 ✗ av_log(avctx, AV_LOG_ERROR, "fctl before IHDR\n");
1336 ✗ return AVERROR_INVALIDDATA;
1337 }
1338
1339
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 283 times.
 283 if (s->pic_state & PNG_IDAT) {
1340 ✗ av_log(avctx, AV_LOG_ERROR, "fctl after IDAT\n");
1341 ✗ return AVERROR_INVALIDDATA;
1342 }
1343
1344 283 sequence_number = bytestream2_get_be32(gb);
1345 283 cur_w = bytestream2_get_be32(gb);
1346 283 cur_h = bytestream2_get_be32(gb);
1347 283 x_offset = bytestream2_get_be32(gb);
1348 283 y_offset = bytestream2_get_be32(gb);
1349 283 bytestream2_skip(gb, 4); /* delay_num (2), delay_den (2) */
1350 283 dispose_op = bytestream2_get_byte(gb);
1351 283 blend_op = bytestream2_get_byte(gb);
1352
1353
2/2
✓ Branch 0 taken 22 times.
✓ Branch 1 taken 261 times.
 283 if (sequence_number == 0 &&
1354
1/2
✓ Branch 0 taken 22 times.
✗ Branch 1 not taken.
 22 (cur_w != s->width ||
1355
2/4
✓ Branch 0 taken 22 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 22 times.
✗ Branch 3 not taken.
 22 cur_h != s->height ||
1356
1/2
✓ Branch 0 taken 22 times.
✗ Branch 1 not taken.
 22 x_offset != 0 ||
1357
1/2
✓ Branch 0 taken 283 times.
✗ Branch 1 not taken.
 283 y_offset != 0) ||
1358
2/4
✓ Branch 0 taken 283 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 283 times.
✗ Branch 3 not taken.
 283 cur_w <= 0 || cur_h <= 0 ||
1359
1/2
✓ Branch 0 taken 283 times.
✗ Branch 1 not taken.
 283 x_offset < 0 || y_offset < 0 ||
1360
2/4
✓ Branch 0 taken 283 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 283 times.
 283 cur_w > s->width - x_offset|| cur_h > s->height - y_offset)
1361 ✗ return AVERROR_INVALIDDATA;
1362
1363
3/4
✓ Branch 0 taken 240 times.
✓ Branch 1 taken 43 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 240 times.
 283 if (blend_op != APNG_BLEND_OP_OVER && blend_op != APNG_BLEND_OP_SOURCE) {
1364 ✗ av_log(avctx, AV_LOG_ERROR, "Invalid blend_op %d\n", blend_op);
1365 ✗ return AVERROR_INVALIDDATA;
1366 }
1367
1368
4/6
✓ Branch 0 taken 261 times.
✓ Branch 1 taken 22 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 261 times.
✗ Branch 4 not taken.
✓ Branch 5 taken 22 times.
 283 if ((sequence_number == 0 || !s->last_picture.f) &&
1369 dispose_op == APNG_DISPOSE_OP_PREVIOUS) {
1370 // No previous frame to revert to for the first frame
1371 // Spec says to just treat it as a APNG_DISPOSE_OP_BACKGROUND
1372 ✗ dispose_op = APNG_DISPOSE_OP_BACKGROUND;
1373 }
1374
1375
4/4
✓ Branch 0 taken 43 times.
✓ Branch 1 taken 240 times.
✓ Branch 2 taken 4 times.
✓ Branch 3 taken 39 times.
 283 if (blend_op == APNG_BLEND_OP_OVER && !s->has_trns && (
1376
1/2
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
 4 avctx->pix_fmt == AV_PIX_FMT_RGB24 ||
1377
1/2
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
 4 avctx->pix_fmt == AV_PIX_FMT_RGB48BE ||
1378
1/2
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
 4 avctx->pix_fmt == AV_PIX_FMT_GRAY8 ||
1379
1/2
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
 4 avctx->pix_fmt == AV_PIX_FMT_GRAY16BE ||
1380
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 4 times.
 4 avctx->pix_fmt == AV_PIX_FMT_MONOBLACK
1381 )) {
1382 // APNG_BLEND_OP_OVER is the same as APNG_BLEND_OP_SOURCE when there is no alpha channel
1383 ✗ blend_op = APNG_BLEND_OP_SOURCE;
1384 }
1385
1386 283 s->cur_w = cur_w;
1387 283 s->cur_h = cur_h;
1388 283 s->x_offset = x_offset;
1389 283 s->y_offset = y_offset;
1390 283 s->dispose_op = dispose_op;
1391 283 s->blend_op = blend_op;
1392
1393 283 return 0;
1394 }
1395
1396 ✗ static void handle_p_frame_png(PNGDecContext *s, AVFrame *p)
1397 {
1398 int i, j;
1399 ✗ uint8_t *pd = p->data[0];
1400 ✗ uint8_t *pd_last = s->last_picture.f->data[0];
1401 ✗ int ls = av_image_get_linesize(p->format, s->width, 0);
1402
1403 ✗ ls = FFMIN(ls, s->width * s->bpp);
1404
1405 ✗ ff_progress_frame_await(&s->last_picture, INT_MAX);
1406 ✗ for (j = 0; j < s->height; j++) {
1407 ✗ for (i = 0; i < ls; i++)
1408 ✗ pd[i] += pd_last[i];
1409 ✗ pd += p->linesize[0];
1410 ✗ pd_last += s->last_picture.f->linesize[0];
1411 }
1412 ✗ }
1413
1414 // divide by 255 and round to nearest
1415 // apply a fast variant: (X+127)/255 = ((X+127)*257+257)>>16 = ((X+128)*257)>>16
1416 #define FAST_DIV255(x) ((((x) + 128) * 257) >> 16)
1417
1418 76 static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s,
1419 AVFrame *p)
1420 {
1421 76 uint8_t *dst = p->data[0];
1422 76 ptrdiff_t dst_stride = p->linesize[0];
1423 76 const uint8_t *src = s->last_picture.f->data[0];
1424 76 ptrdiff_t src_stride = s->last_picture.f->linesize[0];
1425
2/2
✓ Branch 0 taken 22 times.
✓ Branch 1 taken 54 times.
 76 const int bpp = s->color_type == PNG_COLOR_TYPE_PALETTE ? 4 : s->bpp;
1426
1427 size_t x, y;
1428
1429
2/2
✓ Branch 0 taken 41 times.
✓ Branch 1 taken 35 times.
 76 if (s->blend_op == APNG_BLEND_OP_OVER &&
1430
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 41 times.
 41 avctx->pix_fmt != AV_PIX_FMT_RGBA &&
1431 ✗ avctx->pix_fmt != AV_PIX_FMT_GRAY8A) {
1432 ✗ avpriv_request_sample(avctx, "Blending with pixel format %s",
1433 av_get_pix_fmt_name(avctx->pix_fmt));
1434 ✗ return AVERROR_PATCHWELCOME;
1435 }
1436
1437 76 ff_progress_frame_await(&s->last_picture, INT_MAX);
1438
1439 // copy unchanged rectangles from the last frame
1440
2/2
✓ Branch 0 taken 2231 times.
✓ Branch 1 taken 76 times.
 2307 for (y = 0; y < s->y_offset; y++)
1441 2231 memcpy(dst + y * dst_stride, src + y * src_stride, p->width * bpp);
1442
2/2
✓ Branch 0 taken 3395 times.
✓ Branch 1 taken 76 times.
 3471 for (y = s->y_offset; y < s->y_offset + s->cur_h; y++) {
1443 3395 memcpy(dst + y * dst_stride, src + y * src_stride, s->x_offset * bpp);
1444 3395 memcpy(dst + y * dst_stride + (s->x_offset + s->cur_w) * bpp,
1445 3395 src + y * src_stride + (s->x_offset + s->cur_w) * bpp,
1446 3395 (p->width - s->cur_w - s->x_offset) * bpp);
1447 }
1448
2/2
✓ Branch 0 taken 2680 times.
✓ Branch 1 taken 76 times.
 2756 for (y = s->y_offset + s->cur_h; y < p->height; y++)
1449 2680 memcpy(dst + y * dst_stride, src + y * src_stride, p->width * bpp);
1450
1451
2/2
✓ Branch 0 taken 41 times.
✓ Branch 1 taken 35 times.
 76 if (s->blend_op == APNG_BLEND_OP_OVER) {
1452 // Perform blending
1453
2/2
✓ Branch 0 taken 1912 times.
✓ Branch 1 taken 41 times.
 1953 for (y = s->y_offset; y < s->y_offset + s->cur_h; ++y) {
1454 1912 uint8_t *foreground = dst + dst_stride * y + bpp * s->x_offset;
1455 1912 const uint8_t *background = src + src_stride * y + bpp * s->x_offset;
1456
2/2
✓ Branch 0 taken 143265 times.
✓ Branch 1 taken 1912 times.
 145177 for (x = s->x_offset; x < s->x_offset + s->cur_w; ++x, foreground += bpp, background += bpp) {
1457 size_t b;
1458 uint8_t foreground_alpha, background_alpha, output_alpha;
1459 uint8_t output[10];
1460
1461 // Since we might be blending alpha onto alpha, we use the following equations:
1462 // output_alpha = foreground_alpha + (1 - foreground_alpha) * background_alpha
1463 // output = (foreground_alpha * foreground + (1 - foreground_alpha) * background_alpha * background) / output_alpha
1464
1465
1/3
✓ Branch 0 taken 143265 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
 143265 switch (avctx->pix_fmt) {
1466 143265 case AV_PIX_FMT_RGBA:
1467 143265 foreground_alpha = foreground[3];
1468 143265 background_alpha = background[3];
1469 143265 break;
1470
1471 ✗ case AV_PIX_FMT_GRAY8A:
1472 ✗ foreground_alpha = foreground[1];
1473 ✗ background_alpha = background[1];
1474 ✗ break;
1475 }
1476
1477
2/2
✓ Branch 0 taken 21682 times.
✓ Branch 1 taken 121583 times.
 143265 if (foreground_alpha == 255)
1478 143265 continue;
1479
1480
1/2
✓ Branch 0 taken 121583 times.
✗ Branch 1 not taken.
 121583 if (foreground_alpha == 0) {
1481 121583 memcpy(foreground, background, bpp);
1482 121583 continue;
1483 }
1484
1485 ✗ output_alpha = foreground_alpha + FAST_DIV255((255 - foreground_alpha) * background_alpha);
1486
1487 ✗ av_assert0(bpp <= 10);
1488
1489 ✗ for (b = 0; b < bpp - 1; ++b) {
1490 ✗ if (output_alpha == 0) {
1491 ✗ output[b] = 0;
1492 ✗ } else if (background_alpha == 255) {
1493 ✗ output[b] = FAST_DIV255(foreground_alpha * foreground[b] + (255 - foreground_alpha) * background[b]);
1494 } else {
1495 ✗ output[b] = (255 * foreground_alpha * foreground[b] + (255 - foreground_alpha) * background_alpha * background[b]) / (255 * output_alpha);
1496 }
1497 }
1498 ✗ output[b] = output_alpha;
1499 ✗ memcpy(foreground, output, bpp);
1500 }
1501 }
1502 }
1503
1504 76 return 0;
1505 }
1506
1507 12 static void apng_reset_background(PNGDecContext *s, const AVFrame *p)
1508 {
1509 // need to reset a rectangle to black
1510 12 av_unused int ret = av_frame_copy(s->picture.f, p);
1511
1/2
✓ Branch 0 taken 12 times.
✗ Branch 1 not taken.
 12 const int bpp = s->color_type == PNG_COLOR_TYPE_PALETTE ? 4 : s->bpp;
1512 12 const ptrdiff_t dst_stride = s->picture.f->linesize[0];
1513 12 uint8_t *dst = s->picture.f->data[0] + s->y_offset * dst_stride + bpp * s->x_offset;
1514
1515 av_assert1(ret >= 0);
1516
1517
2/2
✓ Branch 0 taken 959 times.
✓ Branch 1 taken 12 times.
 971 for (size_t y = 0; y < s->cur_h; y++) {
1518 959 memset(dst, 0, bpp * s->cur_w);
1519 959 dst += dst_stride;
1520 }
1521 12 }
1522
1523 716 static int decode_frame_common(AVCodecContext *avctx, PNGDecContext *s,
1524 AVFrame *p, const AVPacket *avpkt)
1525 {
1526 716 const AVCRC *crc_tab = av_crc_get_table(AV_CRC_32_IEEE_LE);
1527 uint32_t tag, length;
1528 716 int decode_next_dat = 0;
1529 int i, ret;
1530
1531 14106 for (;;) {
1532 GetByteContext gb_chunk;
1533
1534 14822 length = bytestream2_get_bytes_left(&s->gb);
1535
2/2
✓ Branch 0 taken 389 times.
✓ Branch 1 taken 14433 times.
 14822 if (length <= 0) {
1536
1537
2/2
✓ Branch 0 taken 84 times.
✓ Branch 1 taken 305 times.
 389 if (avctx->codec_id == AV_CODEC_ID_PNG &&
1538
1/2
✓ Branch 0 taken 84 times.
✗ Branch 1 not taken.
 84 avctx->skip_frame == AVDISCARD_ALL) {
1539 106 return 0;
1540 }
1541
1542
2/4
✓ Branch 0 taken 305 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 305 times.
✗ Branch 3 not taken.
 305 if (CONFIG_APNG_DECODER && avctx->codec_id == AV_CODEC_ID_APNG && length == 0) {
1543
2/2
✓ Branch 0 taken 22 times.
✓ Branch 1 taken 283 times.
 305 if (!(s->pic_state & PNG_IDAT))
1544 22 return 0;
1545 else
1546 609 goto exit_loop;
1547 }
1548 ✗ av_log(avctx, AV_LOG_ERROR, "%d bytes left\n", length);
1549 ✗ if ( s->pic_state & PNG_ALLIMAGE
1550 ✗ && avctx->strict_std_compliance <= FF_COMPLIANCE_NORMAL)
1551 ✗ goto exit_loop;
1552 ✗ ret = AVERROR_INVALIDDATA;
1553 1 goto fail;
1554 }
1555
1556 14433 length = bytestream2_get_be32(&s->gb);
1557
3/4
✓ Branch 0 taken 14433 times.
✗ Branch 1 not taken.
✓ Branch 3 taken 1 times.
✓ Branch 4 taken 14432 times.
 14433 if (length > 0x7fffffff || length + 8 > bytestream2_get_bytes_left(&s->gb)) {
1558 1 av_log(avctx, AV_LOG_ERROR, "chunk too big\n");
1559 1 ret = AVERROR_INVALIDDATA;
1560 1 goto fail;
1561 }
1562
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 14432 times.
 14432 if (avctx->err_recognition & (AV_EF_CRCCHECK | AV_EF_IGNORE_ERR)) {
1563 ✗ uint32_t crc_sig = AV_RB32(s->gb.buffer + length + 4);
1564 ✗ uint32_t crc_cal = ~av_crc(crc_tab, UINT32_MAX, s->gb.buffer, length + 4);
1565 ✗ if (crc_sig ^ crc_cal) {
1566 ✗ av_log(avctx, AV_LOG_ERROR, "CRC mismatch in chunk");
1567 ✗ if (avctx->err_recognition & AV_EF_EXPLODE) {
1568 ✗ av_log(avctx, AV_LOG_ERROR, ", quitting\n");
1569 ✗ ret = AVERROR_INVALIDDATA;
1570 ✗ goto fail;
1571 }
1572 ✗ av_log(avctx, AV_LOG_ERROR, ", skipping\n");
1573 ✗ bytestream2_skip(&s->gb, length + 8); /* tag */
1574 153 continue;
1575 }
1576 }
1577 14432 tag = bytestream2_get_le32(&s->gb);
1578
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 14432 times.
 14432 if (avctx->debug & FF_DEBUG_STARTCODE)
1579 ✗ av_log(avctx, AV_LOG_DEBUG, "png: tag=%s length=%u\n",
1580 ✗ av_fourcc2str(tag), length);
1581
1582 14432 bytestream2_init(&gb_chunk, s->gb.buffer, length);
1583 14432 bytestream2_skip(&s->gb, length + 4);
1584
1585
2/2
✓ Branch 0 taken 11803 times.
✓ Branch 1 taken 2629 times.
 14432 if (avctx->codec_id == AV_CODEC_ID_PNG &&
1586
2/2
✓ Branch 0 taken 1574 times.
✓ Branch 1 taken 10229 times.
 11803 avctx->skip_frame == AVDISCARD_ALL) {
1587
2/2
✓ Branch 0 taken 1421 times.
✓ Branch 1 taken 153 times.
 1574 switch(tag) {
1588 1421 case MKTAG('I', 'H', 'D', 'R'):
1589 case MKTAG('p', 'H', 'Y', 's'):
1590 case MKTAG('t', 'E', 'X', 't'):
1591 case MKTAG('I', 'D', 'A', 'T'):
1592 case MKTAG('t', 'R', 'N', 'S'):
1593 case MKTAG('s', 'R', 'G', 'B'):
1594 case MKTAG('c', 'I', 'C', 'P'):
1595 case MKTAG('c', 'H', 'R', 'M'):
1596 case MKTAG('g', 'A', 'M', 'A'):
1597 1421 break;
1598 153 default:
1599 153 continue;
1600 }
1601 }
1602
1603
18/21
✓ Branch 0 taken 433 times.
✓ Branch 1 taken 394 times.
✓ Branch 2 taken 283 times.
✓ Branch 3 taken 2069 times.
✓ Branch 4 taken 10431 times.
✓ Branch 5 taken 9 times.
✓ Branch 6 taken 7 times.
✓ Branch 7 taken 138 times.
✗ Branch 8 not taken.
✗ Branch 9 not taken.
✓ Branch 10 taken 4 times.
✓ Branch 11 taken 41 times.
✓ Branch 12 taken 7 times.
✓ Branch 13 taken 18 times.
✗ Branch 14 not taken.
✓ Branch 15 taken 35 times.
✓ Branch 16 taken 2 times.
✓ Branch 17 taken 2 times.
✓ Branch 18 taken 2 times.
✓ Branch 19 taken 326 times.
✓ Branch 20 taken 78 times.
 14279 switch (tag) {
1604 433 case MKTAG('I', 'H', 'D', 'R'):
1605
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 433 times.
 433 if ((ret = decode_ihdr_chunk(avctx, s, &gb_chunk)) < 0)
1606 ✗ goto fail;
1607 433 break;
1608 394 case MKTAG('p', 'H', 'Y', 's'):
1609
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 394 times.
 394 if ((ret = decode_phys_chunk(avctx, s, &gb_chunk)) < 0)
1610 ✗ goto fail;
1611 394 break;
1612 283 case MKTAG('f', 'c', 'T', 'L'):
1613
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 283 times.
 283 if (!CONFIG_APNG_DECODER || avctx->codec_id != AV_CODEC_ID_APNG)
1614 ✗ continue;
1615
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 283 times.
 283 if ((ret = decode_fctl_chunk(avctx, s, &gb_chunk)) < 0)
1616 ✗ goto fail;
1617 283 decode_next_dat = 1;
1618 283 break;
1619 2069 case MKTAG('f', 'd', 'A', 'T'):
1620
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2069 times.
 2069 if (!CONFIG_APNG_DECODER || avctx->codec_id != AV_CODEC_ID_APNG)
1621 ✗ continue;
1622
2/4
✓ Branch 0 taken 2069 times.
✗ Branch 1 not taken.
✗ Branch 3 not taken.
✓ Branch 4 taken 2069 times.
 2069 if (!decode_next_dat || bytestream2_get_bytes_left(&gb_chunk) < 4) {
1623 ✗ ret = AVERROR_INVALIDDATA;
1624 ✗ goto fail;
1625 }
1626 2069 bytestream2_get_be32(&gb_chunk);
1627 av_fallthrough;
1628 12500 case MKTAG('I', 'D', 'A', 'T'):
1629
3/4
✓ Branch 0 taken 2281 times.
✓ Branch 1 taken 10219 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 2281 times.
 12500 if (CONFIG_APNG_DECODER && avctx->codec_id == AV_CODEC_ID_APNG && !decode_next_dat)
1630 ✗ continue;
1631
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 12500 times.
 12500 if ((ret = decode_idat_chunk(avctx, s, &gb_chunk, p)) < 0)
1632 ✗ goto fail;
1633 12500 break;
1634 9 case MKTAG('P', 'L', 'T', 'E'):
1635 9 decode_plte_chunk(avctx, s, &gb_chunk);
1636 9 break;
1637 7 case MKTAG('t', 'R', 'N', 'S'):
1638 7 decode_trns_chunk(avctx, s, &gb_chunk);
1639 7 break;
1640 138 case MKTAG('t', 'E', 'X', 't'):
1641
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 138 times.
 138 if (decode_text_chunk(s, &gb_chunk, 0) < 0)
1642 ✗ av_log(avctx, AV_LOG_WARNING, "Broken tEXt chunk\n");
1643 138 break;
1644 ✗ case MKTAG('z', 'T', 'X', 't'):
1645 ✗ if (decode_text_chunk(s, &gb_chunk, 1) < 0)
1646 ✗ av_log(avctx, AV_LOG_WARNING, "Broken zTXt chunk\n");
1647 ✗ break;
1648 ✗ case MKTAG('s', 'T', 'E', 'R'): {
1649 ✗ int mode = bytestream2_get_byte(&gb_chunk);
1650
1651 ✗ if (mode == 0 || mode == 1) {
1652 ✗ s->stereo_mode = mode;
1653 } else {
1654 ✗ av_log(avctx, AV_LOG_WARNING,
1655 "Unknown value in sTER chunk (%d)\n", mode);
1656 }
1657 ✗ break;
1658 }
1659 4 case MKTAG('c', 'I', 'C', 'P'):
1660 4 s->cicp_primaries = bytestream2_get_byte(&gb_chunk);
1661 4 s->cicp_trc = bytestream2_get_byte(&gb_chunk);
1662
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 4 times.
 4 if (bytestream2_get_byte(&gb_chunk) != 0)
1663 ✗ av_log(avctx, AV_LOG_WARNING, "nonzero cICP matrix\n");
1664 4 s->cicp_range = bytestream2_get_byte(&gb_chunk);
1665
2/4
✓ Branch 0 taken 4 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 4 times.
 4 if (s->cicp_range != 0 && s->cicp_range != 1)
1666 ✗ av_log(avctx, AV_LOG_WARNING, "invalid cICP range: %d\n", s->cicp_range);
1667 4 s->have_cicp = 1;
1668 4 break;
1669 41 case MKTAG('s', 'R', 'G', 'B'):
1670 /* skip rendering intent byte */
1671 41 bytestream2_skip(&gb_chunk, 1);
1672 41 s->have_srgb = 1;
1673 41 break;
1674 7 case MKTAG('i', 'C', 'C', 'P'): {
1675
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 7 times.
 7 if ((ret = decode_iccp_chunk(s, &gb_chunk)) < 0)
1676 ✗ goto fail;
1677 7 break;
1678 }
1679 18 case MKTAG('c', 'H', 'R', 'M'): {
1680 18 s->have_chrm = 1;
1681
1682 18 s->white_point[0] = bytestream2_get_be32(&gb_chunk);
1683 18 s->white_point[1] = bytestream2_get_be32(&gb_chunk);
1684
1685 /* RGB Primaries */
1686
2/2
✓ Branch 0 taken 54 times.
✓ Branch 1 taken 18 times.
 72 for (i = 0; i < 3; i++) {
1687 54 s->display_primaries[i][0] = bytestream2_get_be32(&gb_chunk);
1688 54 s->display_primaries[i][1] = bytestream2_get_be32(&gb_chunk);
1689 }
1690
1691 18 break;
1692 }
1693 ✗ case MKTAG('s', 'B', 'I', 'T'):
1694 ✗ if ((ret = decode_sbit_chunk(avctx, s, &gb_chunk)) < 0)
1695 ✗ goto fail;
1696 ✗ break;
1697 35 case MKTAG('g', 'A', 'M', 'A'): {
1698 AVBPrint bp;
1699 char *gamma_str;
1700 35 s->gamma = bytestream2_get_be32(&gb_chunk);
1701
1702 35 av_bprint_init(&bp, 0, AV_BPRINT_SIZE_UNLIMITED);
1703 35 av_bprintf(&bp, "%i/%i", s->gamma, 100000);
1704 35 ret = av_bprint_finalize(&bp, &gamma_str);
1705
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 35 times.
 35 if (ret < 0)
1706 ✗ return ret;
1707
1708 35 av_dict_set(&s->frame_metadata, "gamma", gamma_str, AV_DICT_DONT_STRDUP_VAL);
1709
1710 35 break;
1711 }
1712 2 case MKTAG('c', 'L', 'L', 'i'): /* legacy spelling, for backwards compat */
1713 case MKTAG('c', 'L', 'L', 'I'):
1714
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 2 times.
 2 if (bytestream2_get_bytes_left(&gb_chunk) != 8) {
1715 ✗ av_log(avctx, AV_LOG_WARNING, "Invalid cLLI chunk size: %d\n", bytestream2_get_bytes_left(&gb_chunk));
1716 ✗ break;
1717 }
1718 2 s->have_clli = 1;
1719 2 s->clli_max = bytestream2_get_be32u(&gb_chunk);
1720 2 s->clli_avg = bytestream2_get_be32u(&gb_chunk);
1721 2 break;
1722 2 case MKTAG('m', 'D', 'C', 'v'): /* legacy spelling, for backward compat */
1723 case MKTAG('m', 'D', 'C', 'V'):
1724
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 2 times.
 2 if (bytestream2_get_bytes_left(&gb_chunk) != 24) {
1725 ✗ av_log(avctx, AV_LOG_WARNING, "Invalid mDCV chunk size: %d\n", bytestream2_get_bytes_left(&gb_chunk));
1726 ✗ break;
1727 }
1728 2 s->have_mdcv = 1;
1729
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 2 times.
 8 for (int i = 0; i < 3; i++) {
1730 6 s->mdcv_primaries[i][0] = bytestream2_get_be16u(&gb_chunk);
1731 6 s->mdcv_primaries[i][1] = bytestream2_get_be16u(&gb_chunk);
1732 }
1733 2 s->mdcv_white_point[0] = bytestream2_get_be16u(&gb_chunk);
1734 2 s->mdcv_white_point[1] = bytestream2_get_be16u(&gb_chunk);
1735 2 s->mdcv_max_lum = bytestream2_get_be32u(&gb_chunk);
1736 2 s->mdcv_min_lum = bytestream2_get_be32u(&gb_chunk);
1737 2 break;
1738 2 case MKTAG('e', 'X', 'I', 'f'):
1739 2 ret = decode_exif_chunk(avctx, s, &gb_chunk);
1740
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (ret < 0)
1741 ✗ goto fail;
1742 2 break;
1743 326 case MKTAG('I', 'E', 'N', 'D'):
1744
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 326 times.
 326 if (!(s->pic_state & PNG_ALLIMAGE))
1745 ✗ av_log(avctx, AV_LOG_ERROR, "IEND without all image\n");
1746
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 326 times.
 326 if (!(s->pic_state & (PNG_ALLIMAGE|PNG_IDAT))) {
1747 ✗ ret = AVERROR_INVALIDDATA;
1748 ✗ goto fail;
1749 }
1750 326 goto exit_loop;
1751 }
1752 }
1753 609 exit_loop:
1754
1755
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 609 times.
 609 if (!p)
1756 ✗ return AVERROR_INVALIDDATA;
1757
1758
2/2
✓ Branch 0 taken 326 times.
✓ Branch 1 taken 283 times.
 609 if (avctx->codec_id == AV_CODEC_ID_PNG &&
1759
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 326 times.
 326 avctx->skip_frame == AVDISCARD_ALL) {
1760 ✗ return 0;
1761 }
1762
1763
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 609 times.
 609 if (percent_missing(s) > avctx->discard_damaged_percentage) {
1764 ✗ ret = AVERROR_INVALIDDATA;
1765 ✗ goto fail;
1766 }
1767
1768
2/2
✓ Branch 0 taken 21 times.
✓ Branch 1 taken 588 times.
 609 if (s->bits_per_pixel <= 4) {
1769
1/2
✓ Branch 0 taken 21 times.
✗ Branch 1 not taken.
 21 if (CONFIG_APNG_DECODER && s->subframe_packed)
1770 21 handle_small_bpp_apng(s, p);
1771 else
1772 ✗ handle_small_bpp(s, p);
1773 }
1774
1775
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 607 times.
 609 if (s->exif_data) {
1776 // we swap because ff_decode_exif_attach_buffer adds to p->metadata
1777 2 FFSWAP(AVDictionary *, p->metadata, s->frame_metadata);
1778 2 ret = ff_decode_exif_attach_buffer(avctx, p, &s->exif_data, AV_EXIF_TIFF_HEADER);
1779 2 FFSWAP(AVDictionary *, p->metadata, s->frame_metadata);
1780
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (ret < 0) {
1781 ✗ av_log(avctx, AV_LOG_WARNING, "unable to attach EXIF buffer\n");
1782 ✗ return ret;
1783 }
1784 }
1785
1786
3/4
✓ Branch 0 taken 63 times.
✓ Branch 1 taken 546 times.
✓ Branch 2 taken 63 times.
✗ Branch 3 not taken.
 609 if (s->color_type == PNG_COLOR_TYPE_PALETTE && avctx->codec_id == AV_CODEC_ID_APNG) {
1787
2/2
✓ Branch 0 taken 6720 times.
✓ Branch 1 taken 63 times.
 6783 for (int y = 0; y < s->height; y++) {
1788 6720 uint8_t *row = &p->data[0][p->linesize[0] * y];
1789
1790
2/2
✓ Branch 0 taken 955080 times.
✓ Branch 1 taken 6720 times.
 961800 for (int x = s->width - 1; x >= 0; x--) {
1791 955080 const uint8_t idx = row[x];
1792
1793 955080 row[4*x+2] = s->palette[idx] & 0xFF;
1794 955080 row[4*x+1] = (s->palette[idx] >> 8 ) & 0xFF;
1795 955080 row[4*x+0] = (s->palette[idx] >> 16) & 0xFF;
1796 955080 row[4*x+3] = s->palette[idx] >> 24;
1797 }
1798 }
1799 }
1800
1801 /* apply transparency if needed */
1802
4/4
✓ Branch 0 taken 178 times.
✓ Branch 1 taken 431 times.
✓ Branch 2 taken 136 times.
✓ Branch 3 taken 42 times.
 609 if (s->has_trns && s->color_type != PNG_COLOR_TYPE_PALETTE) {
1803
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 136 times.
 136 size_t byte_depth = s->bit_depth > 8 ? 2 : 1;
1804 136 size_t raw_bpp = s->bpp - byte_depth;
1805 ptrdiff_t x, y;
1806
1807
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 136 times.
 136 av_assert0(s->bit_depth > 1);
1808
1809
2/2
✓ Branch 0 taken 17610 times.
✓ Branch 1 taken 136 times.
 17746 for (y = 0; y < s->height; ++y) {
1810 17610 uint8_t *row = &p->data[0][p->linesize[0] * y];
1811
1812
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 17610 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 17610 if (s->bpp == 2 && byte_depth == 1) {
1813 ✗ uint8_t *pixel = &row[2 * s->width - 1];
1814 ✗ uint8_t *rowp = &row[1 * s->width - 1];
1815 ✗ int tcolor = s->transparent_color_be[0];
1816 ✗ for (x = s->width; x > 0; --x) {
1817 ✗ *pixel-- = *rowp == tcolor ? 0 : 0xff;
1818 ✗ *pixel-- = *rowp--;
1819 }
1820
2/4
✓ Branch 0 taken 17610 times.
✗ Branch 1 not taken.
✓ Branch 2 taken 17610 times.
✗ Branch 3 not taken.
 35220 } else if (s->bpp == 4 && byte_depth == 1) {
1821 17610 uint8_t *pixel = &row[4 * s->width - 1];
1822 17610 uint8_t *rowp = &row[3 * s->width - 1];
1823 17610 int tcolor = AV_RL24(s->transparent_color_be);
1824
2/2
✓ Branch 0 taken 1577700 times.
✓ Branch 1 taken 17610 times.
 1595310 for (x = s->width; x > 0; --x) {
1825
2/2
✓ Branch 0 taken 82906 times.
✓ Branch 1 taken 1494794 times.
 1577700 *pixel-- = AV_RL24(rowp-2) == tcolor ? 0 : 0xff;
1826 1577700 *pixel-- = *rowp--;
1827 1577700 *pixel-- = *rowp--;
1828 1577700 *pixel-- = *rowp--;
1829 }
1830 } else {
1831 /* since we're updating in-place, we have to go from right to left */
1832 ✗ for (x = s->width; x > 0; --x) {
1833 ✗ uint8_t *pixel = &row[s->bpp * (x - 1)];
1834 ✗ memmove(pixel, &row[raw_bpp * (x - 1)], raw_bpp);
1835
1836 ✗ if (!memcmp(pixel, s->transparent_color_be, raw_bpp)) {
1837 ✗ memset(&pixel[raw_bpp], 0, byte_depth);
1838 } else {
1839 ✗ memset(&pixel[raw_bpp], 0xff, byte_depth);
1840 }
1841 }
1842 }
1843 }
1844 }
1845
1846 /* handle P-frames only if a predecessor frame is available */
1847
2/2
✓ Branch 0 taken 521 times.
✓ Branch 1 taken 88 times.
 609 if (s->last_picture.f) {
1848
3/4
✓ Branch 0 taken 76 times.
✓ Branch 1 taken 445 times.
✓ Branch 2 taken 76 times.
✗ Branch 3 not taken.
 521 if ( !(avpkt->flags & AV_PKT_FLAG_KEY) && avctx->codec_tag != AV_RL32("MPNG")
1849
1/2
✓ Branch 0 taken 76 times.
✗ Branch 1 not taken.
 76 && s->last_picture.f->width == p->width
1850
1/2
✓ Branch 0 taken 76 times.
✗ Branch 1 not taken.
 76 && s->last_picture.f->height== p->height
1851
1/2
✓ Branch 0 taken 76 times.
✗ Branch 1 not taken.
 76 && s->last_picture.f->format== p->format
1852 ) {
1853
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 76 times.
 76 if (CONFIG_PNG_DECODER && avctx->codec_id != AV_CODEC_ID_APNG)
1854 ✗ handle_p_frame_png(s, p);
1855 76 else if (CONFIG_APNG_DECODER &&
1856
2/4
✓ Branch 0 taken 76 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 76 times.
 152 avctx->codec_id == AV_CODEC_ID_APNG &&
1857 76 (ret = handle_p_frame_apng(avctx, s, p)) < 0)
1858 ✗ goto fail;
1859 }
1860 }
1861
2/2
✓ Branch 0 taken 12 times.
✓ Branch 1 taken 597 times.
 609 if (CONFIG_APNG_DECODER && s->dispose_op == APNG_DISPOSE_OP_BACKGROUND)
1862 12 apng_reset_background(s, p);
1863
1864 609 ret = 0;
1865 610 fail:
1866
2/2
✓ Branch 0 taken 608 times.
✓ Branch 1 taken 2 times.
 610 if (s->picture.f)
1867 608 ff_progress_frame_report(&s->picture, INT_MAX);
1868
1869 610 return ret;
1870 }
1871
1872 694 static void clear_frame_metadata(PNGDecContext *s)
1873 {
1874 694 av_freep(&s->iccp_data);
1875 694 s->iccp_data_len = 0;
1876 694 s->iccp_name[0] = 0;
1877
1878 694 s->stereo_mode = -1;
1879
1880 694 s->have_chrm = 0;
1881 694 s->have_srgb = 0;
1882 694 s->have_cicp = 0;
1883
1884 694 av_dict_free(&s->frame_metadata);
1885 694 }
1886
1887 609 static int output_frame(PNGDecContext *s, AVFrame *f)
1888 {
1889 int ret;
1890
1891
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 609 times.
 609 if (s->stereo_mode >= 0) {
1892 ✗ AVStereo3D *stereo3d = av_stereo3d_create_side_data(f);
1893 ✗ if (!stereo3d) {
1894 ✗ ret = AVERROR(ENOMEM);
1895 ✗ goto fail;
1896 }
1897
1898 ✗ stereo3d->type = AV_STEREO3D_SIDEBYSIDE;
1899 ✗ stereo3d->flags = s->stereo_mode ? 0 : AV_STEREO3D_FLAG_INVERT;
1900 }
1901
1902 609 ret = av_dict_copy(&f->metadata, s->frame_metadata, 0);
1903
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 609 times.
 609 if (ret < 0)
1904 ✗ goto fail;
1905
1906 609 av_dict_free(&s->frame_metadata);
1907
1908 609 return 0;
1909 ✗ fail:
1910 ✗ av_frame_unref(f);
1911 ✗ return ret;
1912 }
1913
1914 #if CONFIG_PNG_DECODER
1915 411 static int decode_frame_png(AVCodecContext *avctx, AVFrame *p,
1916 int *got_frame, AVPacket *avpkt)
1917 {
1918 411 PNGDecContext *const s = avctx->priv_data;
1919 411 const uint8_t *buf = avpkt->data;
1920 411 int buf_size = avpkt->size;
1921 int64_t sig;
1922 int ret;
1923
1924 411 clear_frame_metadata(s);
1925
1926 411 bytestream2_init(&s->gb, buf, buf_size);
1927
1928 /* check signature */
1929 411 sig = bytestream2_get_be64(&s->gb);
1930
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 411 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 411 if (sig != PNGSIG &&
1931 sig != MNGSIG) {
1932 ✗ av_log(avctx, AV_LOG_ERROR, "Invalid PNG signature 0x%08"PRIX64".\n", sig);
1933 ✗ return AVERROR_INVALIDDATA;
1934 }
1935
1936 411 s->y = s->has_trns = 0;
1937 411 s->hdr_state = 0;
1938 411 s->pic_state = 0;
1939
1940 /* Reset z_stream */
1941 411 ret = inflateReset(&s->zstream.zstream);
1942
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 411 times.
 411 if (ret != Z_OK)
1943 ✗ return AVERROR_EXTERNAL;
1944
1945
2/2
✓ Branch 1 taken 1 times.
✓ Branch 2 taken 410 times.
 411 if ((ret = decode_frame_common(avctx, s, p, avpkt)) < 0)
1946 1 goto the_end;
1947
1948
2/2
✓ Branch 0 taken 84 times.
✓ Branch 1 taken 326 times.
 410 if (avctx->skip_frame == AVDISCARD_ALL) {
1949 84 *got_frame = 0;
1950 84 ret = bytestream2_tell(&s->gb);
1951 84 goto the_end;
1952 }
1953
1954 326 ret = output_frame(s, p);
1955
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 326 times.
 326 if (ret < 0)
1956 ✗ goto the_end;
1957
1958
1/2
✓ Branch 0 taken 326 times.
✗ Branch 1 not taken.
 326 if (!(avctx->active_thread_type & FF_THREAD_FRAME)) {
1959 326 ff_progress_frame_unref(&s->last_picture);
1960 326 FFSWAP(ProgressFrame, s->picture, s->last_picture);
1961 }
1962
1963 326 *got_frame = 1;
1964
1965 326 ret = bytestream2_tell(&s->gb);
1966 411 the_end:
1967 411 s->crow_buf = NULL;
1968 411 return ret;
1969 }
1970 #endif
1971
1972 #if CONFIG_APNG_DECODER
1973 283 static int decode_frame_apng(AVCodecContext *avctx, AVFrame *p,
1974 int *got_frame, AVPacket *avpkt)
1975 {
1976 283 PNGDecContext *const s = avctx->priv_data;
1977 int ret;
1978
1979 283 clear_frame_metadata(s);
1980
1981
2/2
✓ Branch 0 taken 22 times.
✓ Branch 1 taken 261 times.
 283 if (!(s->hdr_state & PNG_IHDR)) {
1982
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 22 times.
 22 if (!avctx->extradata_size)
1983 ✗ return AVERROR_INVALIDDATA;
1984
1985
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 22 times.
 22 if ((ret = inflateReset(&s->zstream.zstream)) != Z_OK)
1986 ✗ return AVERROR_EXTERNAL;
1987 22 bytestream2_init(&s->gb, avctx->extradata, avctx->extradata_size);
1988
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 22 times.
 22 if ((ret = decode_frame_common(avctx, s, NULL, avpkt)) < 0)
1989 ✗ return ret;
1990 }
1991
1992 /* reset state for a new frame */
1993
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 283 times.
 283 if ((ret = inflateReset(&s->zstream.zstream)) != Z_OK)
1994 ✗ return AVERROR_EXTERNAL;
1995 283 s->y = 0;
1996 283 s->pic_state = 0;
1997 283 bytestream2_init(&s->gb, avpkt->data, avpkt->size);
1998
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 283 times.
 283 if ((ret = decode_frame_common(avctx, s, p, avpkt)) < 0)
1999 ✗ return ret;
2000
2001
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 283 times.
 283 if (!(s->pic_state & PNG_ALLIMAGE))
2002 ✗ av_log(avctx, AV_LOG_WARNING, "Frame did not contain a complete image\n");
2003
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 283 times.
 283 if (!(s->pic_state & (PNG_ALLIMAGE|PNG_IDAT)))
2004 ✗ return AVERROR_INVALIDDATA;
2005
2006 283 ret = output_frame(s, p);
2007
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 283 times.
 283 if (ret < 0)
2008 ✗ return ret;
2009
2010
1/2
✓ Branch 0 taken 283 times.
✗ Branch 1 not taken.
 283 if (!(avctx->active_thread_type & FF_THREAD_FRAME)) {
2011
2/2
✓ Branch 0 taken 282 times.
✓ Branch 1 taken 1 times.
 283 if (s->dispose_op != APNG_DISPOSE_OP_PREVIOUS)
2012 282 FFSWAP(ProgressFrame, s->picture, s->last_picture);
2013 283 ff_progress_frame_unref(&s->picture);
2014 }
2015
2016 283 *got_frame = 1;
2017 283 return bytestream2_tell(&s->gb);
2018 }
2019 #endif
2020
2021 #if HAVE_THREADS
2022 ✗ static int update_thread_context(AVCodecContext *dst, const AVCodecContext *src)
2023 {
2024 ✗ PNGDecContext *psrc = src->priv_data;
2025 ✗ PNGDecContext *pdst = dst->priv_data;
2026 const ProgressFrame *src_frame;
2027
2028 ✗ if (dst == src)
2029 ✗ return 0;
2030
2031 ✗ if (CONFIG_APNG_DECODER && dst->codec_id == AV_CODEC_ID_APNG) {
2032
2033 ✗ pdst->width = psrc->width;
2034 ✗ pdst->height = psrc->height;
2035 ✗ pdst->bit_depth = psrc->bit_depth;
2036 ✗ pdst->color_type = psrc->color_type;
2037 ✗ pdst->compression_type = psrc->compression_type;
2038 ✗ pdst->interlace_type = psrc->interlace_type;
2039 ✗ pdst->filter_type = psrc->filter_type;
2040 ✗ pdst->has_trns = psrc->has_trns;
2041 ✗ memcpy(pdst->transparent_color_be, psrc->transparent_color_be, sizeof(pdst->transparent_color_be));
2042
2043 ✗ memcpy(pdst->palette, psrc->palette, sizeof(pdst->palette));
2044
2045 ✗ pdst->hdr_state |= psrc->hdr_state;
2046 }
2047
2048 ✗ src_frame = psrc->dispose_op == APNG_DISPOSE_OP_PREVIOUS ?
2049 &psrc->last_picture : &psrc->picture;
2050
2051 ✗ ff_progress_frame_replace(&pdst->last_picture, src_frame);
2052
2053 ✗ return 0;
2054 }
2055 #endif
2056
2057 180 static av_cold int png_dec_init(AVCodecContext *avctx)
2058 {
2059 180 PNGDecContext *s = avctx->priv_data;
2060
2061 180 s->avctx = avctx;
2062
2063 180 ff_pngdsp_init(&s->dsp);
2064
2065 180 return ff_inflate_init(&s->zstream, avctx);
2066 }
2067
2068 180 static av_cold int png_dec_end(AVCodecContext *avctx)
2069 {
2070 180 PNGDecContext *s = avctx->priv_data;
2071
2072 180 ff_progress_frame_unref(&s->last_picture);
2073 180 ff_progress_frame_unref(&s->picture);
2074 180 av_freep(&s->buffer);
2075 180 s->buffer_size = 0;
2076 180 av_freep(&s->last_row);
2077 180 s->last_row_size = 0;
2078 180 av_freep(&s->tmp_row);
2079 180 s->tmp_row_size = 0;
2080
2081 180 av_freep(&s->iccp_data);
2082 180 av_buffer_unref(&s->exif_data);
2083 180 av_dict_free(&s->frame_metadata);
2084 180 ff_inflate_end(&s->zstream);
2085
2086 180 return 0;
2087 }
2088
2089 #if CONFIG_APNG_DECODER
2090 const FFCodec ff_apng_decoder = {
2091 .p.name = "apng",
2092 CODEC_LONG_NAME("APNG (Animated Portable Network Graphics) image"),
2093 .p.type = AVMEDIA_TYPE_VIDEO,
2094 .p.id = AV_CODEC_ID_APNG,
2095 .priv_data_size = sizeof(PNGDecContext),
2096 .init = png_dec_init,
2097 .close = png_dec_end,
2098 FF_CODEC_DECODE_CB(decode_frame_apng),
2099 UPDATE_THREAD_CONTEXT(update_thread_context),
2100 .p.capabilities = AV_CODEC_CAP_DR1 | AV_CODEC_CAP_FRAME_THREADS,
2101 .caps_internal = FF_CODEC_CAP_INIT_CLEANUP |
2102 FF_CODEC_CAP_USES_PROGRESSFRAMES |
2103 FF_CODEC_CAP_ICC_PROFILES,
2104 };
2105 #endif
2106
2107 #if CONFIG_PNG_DECODER
2108 const FFCodec ff_png_decoder = {
2109 .p.name = "png",
2110 CODEC_LONG_NAME("PNG (Portable Network Graphics) image"),
2111 .p.type = AVMEDIA_TYPE_VIDEO,
2112 .p.id = AV_CODEC_ID_PNG,
2113 .priv_data_size = sizeof(PNGDecContext),
2114 .init = png_dec_init,
2115 .close = png_dec_end,
2116 FF_CODEC_DECODE_CB(decode_frame_png),
2117 UPDATE_THREAD_CONTEXT(update_thread_context),
2118 .p.capabilities = AV_CODEC_CAP_DR1 | AV_CODEC_CAP_FRAME_THREADS,
2119 .caps_internal = FF_CODEC_CAP_SKIP_FRAME_FILL_PARAM |
2120 FF_CODEC_CAP_INIT_CLEANUP |
2121 FF_CODEC_CAP_USES_PROGRESSFRAMES |
2122 FF_CODEC_CAP_ICC_PROFILES,
2123 };
2124 #endif
2125