Mercurial > hg > xemacs-beta
annotate src/glyphs-eimage.c @ 4698:a9493cab536f
Fix crash due to mishandling transparency.
| author | Stephen J. Turnbull <stephen@xemacs.org> |
|---|---|
| date | Wed, 23 Sep 2009 20:04:51 +0900 |
| parents | 648f4a0dac3e |
| children | 1cecc3e9f0a0 |
| rev | line source |
|---|---|
| 428 | 1 /* EImage-specific Lisp objects. |
| 2 Copyright (C) 1993, 1994, 1998 Free Software Foundation, Inc. | |
| 3 Copyright (C) 1995 Board of Trustees, University of Illinois. | |
| 4 Copyright (C) 1995 Tinker Systems | |
| 2959 | 5 Copyright (C) 1995, 1996, 2001, 2002, 2004, 2005 Ben Wing |
| 428 | 6 Copyright (C) 1995 Sun Microsystems |
| 7 | |
| 8 This file is part of XEmacs. | |
| 9 | |
| 10 XEmacs is free software; you can redistribute it and/or modify it | |
| 11 under the terms of the GNU General Public License as published by the | |
| 12 Free Software Foundation; either version 2, or (at your option) any | |
| 13 later version. | |
| 14 | |
| 15 XEmacs is distributed in the hope that it will be useful, but WITHOUT | |
| 16 ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or | |
| 17 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License | |
| 18 for more details. | |
| 19 | |
| 20 You should have received a copy of the GNU General Public License | |
| 21 along with XEmacs; see the file COPYING. If not, write to | |
| 22 the Free Software Foundation, Inc., 59 Temple Place - Suite 330, | |
| 23 Boston, MA 02111-1307, USA. */ | |
| 24 | |
| 25 /* Synched up with: Not in FSF. */ | |
| 26 | |
| 2959 | 27 /* Originally part of glyphs.c. |
| 28 | |
| 428 | 29 GIF/JPEG support added by Ben Wing for 19.14 |
| 30 PNG support added by Bill Perry for 19.14 | |
| 31 Improved GIF/JPEG support added by Bill Perry for 19.14 | |
| 32 Cleanup/simplification of error handling by Ben Wing for 19.14 | |
| 33 GIF support changed to external Gifreader lib by Jareth Hein for 21.0 | |
| 34 Many changes for color work and optimizations by Jareth Hein for 21.0 | |
| 35 Switch of GIF/JPEG/PNG to new EImage intermediate code by Jareth Hein for 21.0 | |
| 36 TIFF code by Jareth Hein for 21.0 | |
| 37 TODO: | |
| 38 Convert images.el to C and stick it in here? | |
| 3094 | 39 This file is really repetitious; can we refactor? |
| 428 | 40 */ |
| 41 | |
| 42 #include <config.h> | |
| 43 #include "lisp.h" | |
| 44 #include "lstream.h" | |
| 45 #include "console.h" | |
| 872 | 46 #include "device-impl.h" |
| 428 | 47 #include "faces.h" |
| 48 #include "glyphs.h" | |
| 872 | 49 #include "objects-impl.h" |
| 428 | 50 |
| 51 #include "buffer.h" | |
| 52 #include "frame.h" | |
| 53 #include "opaque.h" | |
| 442 | 54 #include "window.h" |
| 428 | 55 |
| 56 #include "sysfile.h" | |
| 57 | |
| 58 #ifdef HAVE_PNG | |
| 1743 | 59 |
| 60 BEGIN_C_DECLS | |
| 61 | |
| 647 | 62 #define message message_ /* Yuck */ |
| 428 | 63 #include <png.h> |
| 647 | 64 #undef message |
| 1743 | 65 |
| 66 END_C_DECLS | |
| 67 | |
| 428 | 68 #else |
| 69 #include <setjmp.h> | |
| 70 #endif | |
| 71 #include "file-coding.h" | |
| 72 | |
| 73 #ifdef HAVE_TIFF | |
| 74 DEFINE_IMAGE_INSTANTIATOR_FORMAT (tiff); | |
| 75 Lisp_Object Qtiff; | |
| 76 #endif | |
| 77 | |
| 78 #ifdef HAVE_JPEG | |
| 79 DEFINE_IMAGE_INSTANTIATOR_FORMAT (jpeg); | |
| 80 Lisp_Object Qjpeg; | |
| 81 #endif | |
| 82 | |
| 83 #ifdef HAVE_GIF | |
| 84 DEFINE_IMAGE_INSTANTIATOR_FORMAT (gif); | |
| 85 Lisp_Object Qgif; | |
| 86 #endif | |
| 87 | |
| 88 #ifdef HAVE_PNG | |
| 89 DEFINE_IMAGE_INSTANTIATOR_FORMAT (png); | |
| 90 Lisp_Object Qpng; | |
| 91 #endif | |
| 92 | |
| 93 | |
| 94 #ifdef HAVE_JPEG | |
| 95 | |
| 96 /********************************************************************** | |
| 97 * JPEG * | |
| 98 **********************************************************************/ | |
| 99 | |
| 1743 | 100 BEGIN_C_DECLS |
| 101 | |
| 2500 | 102 #ifdef WIN32_NATIVE |
| 2563 | 103 /* #### Yuck! More horrifitude. tiffio.h, below, includes <windows.h>, |
| 104 which defines INT32 and INT16, the former differently and incompatibly | |
| 105 from jmorecfg.h, included by jpeglib.h. We can disable the stuff in | |
| 106 jmorecfg.h by defining XMD_H (clever, huh?); then we define these | |
| 107 typedefs the way that <windows.h> wants them (which is more correct, | |
| 108 anyway; jmorecfg.h defines INT32 as `long'). */ | |
| 2500 | 109 #define XMD_H |
| 110 typedef signed int INT32; | |
| 111 typedef signed short INT16; | |
|
4326
a5ff7e67ac1b
Don't let libtiff override the size of a boolean, Win32. From Ron Isaacson.
Aidan Kehoe <kehoea@parhasard.net>
parents:
3839
diff
changeset
|
112 |
|
a5ff7e67ac1b
Don't let libtiff override the size of a boolean, Win32. From Ron Isaacson.
Aidan Kehoe <kehoea@parhasard.net>
parents:
3839
diff
changeset
|
113 /* And another one... jmorecfg.h defines the 'boolean' type as int, |
|
a5ff7e67ac1b
Don't let libtiff override the size of a boolean, Win32. From Ron Isaacson.
Aidan Kehoe <kehoea@parhasard.net>
parents:
3839
diff
changeset
|
114 which conflicts with the standard Windows 'boolean' definition as |
|
a5ff7e67ac1b
Don't let libtiff override the size of a boolean, Win32. From Ron Isaacson.
Aidan Kehoe <kehoea@parhasard.net>
parents:
3839
diff
changeset
|
115 unsigned char. Ref: http://www.asmail.be/msg0054688232.html */ |
|
a5ff7e67ac1b
Don't let libtiff override the size of a boolean, Win32. From Ron Isaacson.
Aidan Kehoe <kehoea@parhasard.net>
parents:
3839
diff
changeset
|
116 #ifndef __RPCNDR_H__ /* don't conflict if rpcndr.h already read */ |
|
a5ff7e67ac1b
Don't let libtiff override the size of a boolean, Win32. From Ron Isaacson.
Aidan Kehoe <kehoea@parhasard.net>
parents:
3839
diff
changeset
|
117 typedef unsigned char boolean; |
|
a5ff7e67ac1b
Don't let libtiff override the size of a boolean, Win32. From Ron Isaacson.
Aidan Kehoe <kehoea@parhasard.net>
parents:
3839
diff
changeset
|
118 #endif |
|
a5ff7e67ac1b
Don't let libtiff override the size of a boolean, Win32. From Ron Isaacson.
Aidan Kehoe <kehoea@parhasard.net>
parents:
3839
diff
changeset
|
119 #define HAVE_BOOLEAN /* prevent jmorecfg.h from redefining it */ |
| 2500 | 120 #endif |
| 121 | |
| 428 | 122 #include <jpeglib.h> |
| 123 #include <jerror.h> | |
| 1743 | 124 |
| 125 END_C_DECLS | |
| 428 | 126 |
| 127 /*#define USE_TEMP_FILES_FOR_JPEG_IMAGES 1*/ | |
| 128 static void | |
| 129 jpeg_validate (Lisp_Object instantiator) | |
| 130 { | |
| 131 file_or_data_must_be_present (instantiator); | |
| 132 } | |
| 133 | |
| 134 static Lisp_Object | |
| 442 | 135 jpeg_normalize (Lisp_Object inst, Lisp_Object console_type, |
| 2286 | 136 Lisp_Object UNUSED (dest_mask)) |
| 428 | 137 { |
| 138 return simple_image_type_normalize (inst, console_type, Qjpeg); | |
| 139 } | |
| 140 | |
| 141 static int | |
| 142 jpeg_possible_dest_types (void) | |
| 143 { | |
| 144 return IMAGE_COLOR_PIXMAP_MASK; | |
| 145 } | |
| 146 | |
| 147 /* To survive the otherwise baffling complexity of making sure | |
| 148 everything gets cleaned up in the presence of an error, we | |
| 149 use an unwind_protect(). */ | |
| 150 | |
| 151 struct jpeg_unwind_data | |
| 152 { | |
| 153 /* Stream that we need to close */ | |
| 154 FILE *instream; | |
| 155 /* Object that holds state info for JPEG decoding */ | |
| 156 struct jpeg_decompress_struct *cinfo_ptr; | |
| 157 /* EImage data */ | |
| 2367 | 158 Binbyte *eimage; |
| 428 | 159 }; |
| 160 | |
| 161 static Lisp_Object | |
| 162 jpeg_instantiate_unwind (Lisp_Object unwind_obj) | |
| 163 { | |
| 164 struct jpeg_unwind_data *data = | |
| 165 (struct jpeg_unwind_data *) get_opaque_ptr (unwind_obj); | |
| 166 | |
| 167 free_opaque_ptr (unwind_obj); | |
| 168 if (data->cinfo_ptr) | |
| 169 jpeg_destroy_decompress (data->cinfo_ptr); | |
| 170 | |
| 171 if (data->instream) | |
| 771 | 172 retry_fclose (data->instream); |
| 428 | 173 |
| 1726 | 174 if (data->eimage) |
| 2367 | 175 xfree (data->eimage, Binbyte *); |
| 428 | 176 |
| 177 return Qnil; | |
| 178 } | |
| 179 | |
| 180 /* | |
| 181 * ERROR HANDLING: | |
| 182 * | |
| 183 * The JPEG library's standard error handler (jerror.c) is divided into | |
| 184 * several "methods" which you can override individually. This lets you | |
| 185 * adjust the behavior without duplicating a lot of code, which you might | |
| 186 * have to update with each future release. | |
| 187 * | |
| 188 * Our example here shows how to override the "error_exit" method so that | |
| 189 * control is returned to the library's caller when a fatal error occurs, | |
| 190 * rather than calling exit() as the standard error_exit method does. | |
| 191 * | |
| 192 * We use C's setjmp/longjmp facility to return control. This means that the | |
| 193 * routine which calls the JPEG library must first execute a setjmp() call to | |
| 194 * establish the return point. We want the replacement error_exit to do a | |
| 195 * longjmp(). But we need to make the setjmp buffer accessible to the | |
| 196 * error_exit routine. To do this, we make a private extension of the | |
| 197 * standard JPEG error handler object. (If we were using C++, we'd say we | |
| 198 * were making a subclass of the regular error handler.) | |
| 199 * | |
| 200 * Here's the extended error handler struct: | |
| 201 */ | |
| 202 | |
| 203 struct my_jpeg_error_mgr | |
| 204 { | |
| 205 struct jpeg_error_mgr pub; /* "public" fields */ | |
| 206 jmp_buf setjmp_buffer; /* for return to caller */ | |
| 207 }; | |
| 208 | |
| 209 #if defined(JPEG_LIB_VERSION) && (JPEG_LIB_VERSION >= 61) | |
| 210 METHODDEF(void) | |
| 211 #else | |
| 212 METHODDEF void | |
| 213 #endif | |
| 2286 | 214 our_init_source (j_decompress_ptr UNUSED (cinfo)) |
| 428 | 215 { |
| 216 } | |
| 217 | |
| 218 #if defined(JPEG_LIB_VERSION) && (JPEG_LIB_VERSION >= 61) | |
| 219 METHODDEF(boolean) | |
| 220 #else | |
| 221 METHODDEF boolean | |
| 222 #endif | |
| 223 our_fill_input_buffer (j_decompress_ptr cinfo) | |
| 224 { | |
| 225 /* Insert a fake EOI marker */ | |
| 226 struct jpeg_source_mgr *src = cinfo->src; | |
| 227 static JOCTET buffer[2]; | |
| 228 | |
| 229 buffer[0] = (JOCTET) 0xFF; | |
| 230 buffer[1] = (JOCTET) JPEG_EOI; | |
| 231 | |
| 232 src->next_input_byte = buffer; | |
| 233 src->bytes_in_buffer = 2; | |
| 234 return TRUE; | |
| 235 } | |
| 236 | |
| 237 #if defined(JPEG_LIB_VERSION) && (JPEG_LIB_VERSION >= 61) | |
| 238 METHODDEF(void) | |
| 239 #else | |
| 240 METHODDEF void | |
| 241 #endif | |
| 242 our_skip_input_data (j_decompress_ptr cinfo, long num_bytes) | |
| 243 { | |
| 244 struct jpeg_source_mgr *src = NULL; | |
| 245 | |
| 246 src = (struct jpeg_source_mgr *) cinfo->src; | |
| 247 | |
| 248 if (!src) | |
| 647 | 249 return; |
| 250 else if (num_bytes > (long) src->bytes_in_buffer) | |
| 428 | 251 { |
| 647 | 252 ERREXIT (cinfo, JERR_INPUT_EOF); |
| 253 /*NOTREACHED*/ | |
| 254 } | |
| 428 | 255 |
| 256 src->bytes_in_buffer -= num_bytes; | |
| 257 src->next_input_byte += num_bytes; | |
| 258 } | |
| 259 | |
| 260 #if defined(JPEG_LIB_VERSION) && (JPEG_LIB_VERSION >= 61) | |
| 261 METHODDEF(void) | |
| 262 #else | |
| 263 METHODDEF void | |
| 264 #endif | |
| 2286 | 265 our_term_source (j_decompress_ptr UNUSED (cinfo)) |
| 428 | 266 { |
| 267 } | |
| 268 | |
| 269 typedef struct | |
| 270 { | |
| 271 struct jpeg_source_mgr pub; | |
| 272 } our_jpeg_source_mgr; | |
| 273 | |
| 274 static void | |
| 665 | 275 jpeg_memory_src (j_decompress_ptr cinfo, JOCTET *data, Bytecount len) |
| 428 | 276 { |
| 277 struct jpeg_source_mgr *src; | |
| 278 | |
| 279 if (cinfo->src == NULL) | |
| 280 { /* first time for this JPEG object? */ | |
| 281 cinfo->src = (struct jpeg_source_mgr *) | |
| 282 (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_PERMANENT, | |
| 283 sizeof(our_jpeg_source_mgr)); | |
| 284 src = (struct jpeg_source_mgr *) cinfo->src; | |
| 285 src->next_input_byte = data; | |
| 286 } | |
| 287 src = (struct jpeg_source_mgr *) cinfo->src; | |
| 288 src->init_source = our_init_source; | |
| 289 src->fill_input_buffer = our_fill_input_buffer; | |
| 290 src->skip_input_data = our_skip_input_data; | |
| 291 src->resync_to_restart = jpeg_resync_to_restart; /* use default method */ | |
| 292 src->term_source = our_term_source; | |
| 293 src->bytes_in_buffer = len; | |
| 294 src->next_input_byte = data; | |
| 295 } | |
| 296 | |
| 297 #if defined(JPEG_LIB_VERSION) && (JPEG_LIB_VERSION >= 61) | |
| 298 METHODDEF(void) | |
| 299 #else | |
| 300 METHODDEF void | |
| 301 #endif | |
| 302 my_jpeg_error_exit (j_common_ptr cinfo) | |
| 303 { | |
| 304 /* cinfo->err really points to a my_error_mgr struct, so coerce pointer */ | |
| 305 struct my_jpeg_error_mgr *myerr = (struct my_jpeg_error_mgr *) cinfo->err; | |
| 306 | |
| 307 /* Return control to the setjmp point */ | |
| 308 longjmp (myerr->setjmp_buffer, 1); | |
| 309 } | |
| 310 | |
| 311 #if defined(JPEG_LIB_VERSION) && (JPEG_LIB_VERSION >= 61) | |
| 312 METHODDEF(void) | |
| 313 #else | |
| 314 METHODDEF void | |
| 315 #endif | |
| 316 my_jpeg_output_message (j_common_ptr cinfo) | |
| 317 { | |
| 771 | 318 Extbyte buffer[JMSG_LENGTH_MAX]; |
| 867 | 319 Ibyte *intbuf; |
| 428 | 320 |
| 321 /* Create the message */ | |
| 322 (*cinfo->err->format_message) (cinfo, buffer); | |
| 771 | 323 EXTERNAL_TO_C_STRING (buffer, intbuf, Qnative); |
| 324 warn_when_safe (Qjpeg, Qinfo, "%s", intbuf); | |
| 428 | 325 } |
| 326 | |
| 327 /* The code in this routine is based on example.c from the JPEG library | |
| 328 source code and from gif_instantiate() */ | |
| 329 static void | |
| 330 jpeg_instantiate (Lisp_Object image_instance, Lisp_Object instantiator, | |
| 2959 | 331 Lisp_Object pointer_fg, Lisp_Object pointer_bg, |
| 428 | 332 int dest_mask, Lisp_Object domain) |
| 333 { | |
| 440 | 334 Lisp_Image_Instance *ii = XIMAGE_INSTANCE (image_instance); |
| 428 | 335 /* It is OK for the unwind data to be local to this function, |
| 336 because the unwind-protect is always executed when this | |
| 337 stack frame is still valid. */ | |
| 338 struct jpeg_unwind_data unwind; | |
| 339 int speccount = specpdl_depth (); | |
| 340 | |
| 341 /* This struct contains the JPEG decompression parameters and pointers to | |
| 342 * working space (which is allocated as needed by the JPEG library). | |
| 343 */ | |
| 344 struct jpeg_decompress_struct cinfo; | |
| 345 /* We use our private extension JPEG error handler. | |
| 346 * Note that this struct must live as long as the main JPEG parameter | |
| 347 * struct, to avoid dangling-pointer problems. | |
| 348 */ | |
| 349 struct my_jpeg_error_mgr jerr; | |
| 350 | |
| 351 /* Step -1: First record our unwind-protect, which will clean up after | |
| 352 any exit, normal or not */ | |
| 353 | |
| 354 xzero (unwind); | |
| 355 record_unwind_protect (jpeg_instantiate_unwind, make_opaque_ptr (&unwind)); | |
| 356 | |
| 357 /* Step 1: allocate and initialize JPEG decompression object */ | |
| 358 | |
| 359 /* We set up the normal JPEG error routines, then override error_exit. */ | |
| 360 cinfo.err = jpeg_std_error (&jerr.pub); | |
| 361 jerr.pub.error_exit = my_jpeg_error_exit; | |
| 362 jerr.pub.output_message = my_jpeg_output_message; | |
| 363 | |
| 364 /* Establish the setjmp return context for my_error_exit to use. */ | |
| 365 if (setjmp (jerr.setjmp_buffer)) | |
| 366 { | |
| 367 /* If we get here, the JPEG code has signaled an error. | |
| 368 * We need to clean up the JPEG object, close the input file, and return. | |
| 369 */ | |
| 370 | |
| 371 { | |
| 372 Lisp_Object errstring; | |
| 771 | 373 Extbyte buffer[JMSG_LENGTH_MAX]; |
| 428 | 374 |
| 375 /* Create the message */ | |
| 376 (*cinfo.err->format_message) ((j_common_ptr) &cinfo, buffer); | |
| 771 | 377 errstring = build_ext_string (buffer, Qnative); |
| 428 | 378 |
| 379 signal_image_error_2 ("JPEG decoding error", | |
| 380 errstring, instantiator); | |
| 381 } | |
| 382 } | |
| 383 | |
| 384 /* Now we can initialize the JPEG decompression object. */ | |
| 385 jpeg_create_decompress (&cinfo); | |
| 386 unwind.cinfo_ptr = &cinfo; | |
| 387 | |
| 388 /* Step 2: specify data source (eg, a file) */ | |
| 389 | |
| 390 { | |
| 391 Lisp_Object data = find_keyword_in_vector (instantiator, Q_data); | |
| 2367 | 392 const Binbyte *bytes; |
| 665 | 393 Bytecount len; |
| 428 | 394 |
| 395 /* #### This is a definite problem under Mule due to the amount of | |
| 396 stack data it might allocate. Need to be able to convert and | |
| 397 write out to a file. */ | |
| 440 | 398 TO_EXTERNAL_FORMAT (LISP_STRING, data, ALLOCA, (bytes, len), Qbinary); |
| 428 | 399 jpeg_memory_src (&cinfo, (JOCTET *) bytes, len); |
| 400 } | |
| 401 | |
| 402 /* Step 3: read file parameters with jpeg_read_header() */ | |
| 403 | |
| 404 jpeg_read_header (&cinfo, TRUE); | |
| 405 /* We can ignore the return value from jpeg_read_header since | |
| 406 * (a) suspension is not possible with the stdio data source, and | |
| 407 * (b) we passed TRUE to reject a tables-only JPEG file as an error. | |
| 408 * See libjpeg.doc for more info. | |
| 409 */ | |
| 410 | |
| 411 { | |
|
4646
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
412 UINT_64_BIT pixels_sq; |
| 428 | 413 int jpeg_gray = 0; /* if we're dealing with a grayscale */ |
| 414 /* Step 4: set parameters for decompression. */ | |
| 415 | |
| 416 /* Now that we're using EImages, send all data as 24bit color. | |
| 417 The backend routine will take care of any necessary reductions. | |
| 418 We do have to handle the grayscale case ourselves, however. */ | |
| 419 if (cinfo.jpeg_color_space == JCS_GRAYSCALE) | |
| 420 { | |
| 421 cinfo.out_color_space = JCS_GRAYSCALE; | |
| 422 jpeg_gray = 1; | |
| 423 } | |
| 424 else | |
| 425 { | |
| 426 /* we're relying on the jpeg driver to do any other conversions, | |
| 427 or signal an error if the conversion isn't supported. */ | |
| 428 cinfo.out_color_space = JCS_RGB; | |
| 429 } | |
| 430 | |
| 431 /* Step 5: Start decompressor */ | |
| 432 jpeg_start_decompress (&cinfo); | |
| 433 | |
| 434 /* Step 6: Read in the data and put into EImage format (8bit RGB triples)*/ | |
|
4646
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
435 pixels_sq = |
|
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
436 (UINT_64_BIT) cinfo.output_width * (UINT_64_BIT) cinfo.output_height; |
|
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
437 if (pixels_sq > ((size_t) -1) / 3) |
|
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
438 signal_image_error ("JPEG image too large to instantiate", instantiator); |
| 2367 | 439 unwind.eimage = |
| 440 xnew_binbytes (cinfo.output_width * cinfo.output_height * 3); | |
| 428 | 441 if (!unwind.eimage) |
| 442 signal_image_error("Unable to allocate enough memory for image", instantiator); | |
| 443 | |
| 444 { | |
| 445 JSAMPARRAY row_buffer; /* Output row buffer */ | |
| 446 JSAMPLE *jp; | |
| 447 int row_stride; /* physical row width in output buffer */ | |
| 2367 | 448 Binbyte *op = unwind.eimage; |
| 428 | 449 |
| 450 /* We may need to do some setup of our own at this point before reading | |
| 451 * the data. After jpeg_start_decompress() we have the correct scaled | |
| 452 * output image dimensions available | |
| 453 * We need to make an output work buffer of the right size. | |
| 454 */ | |
| 455 /* JSAMPLEs per row in output buffer. */ | |
| 456 row_stride = cinfo.output_width * cinfo.output_components; | |
| 457 /* Make a one-row-high sample array that will go away when done | |
| 458 with image */ | |
| 459 row_buffer = ((*cinfo.mem->alloc_sarray) | |
| 460 ((j_common_ptr) &cinfo, JPOOL_IMAGE, row_stride, 1)); | |
| 461 | |
| 462 /* Here we use the library's state variable cinfo.output_scanline as the | |
| 463 * loop counter, so that we don't have to keep track ourselves. | |
| 464 */ | |
| 465 while (cinfo.output_scanline < cinfo.output_height) | |
| 466 { | |
| 467 int i; | |
| 468 | |
| 469 /* jpeg_read_scanlines expects an array of pointers to scanlines. | |
| 470 * Here the array is only one element long, but you could ask for | |
| 471 * more than one scanline at a time if that's more convenient. | |
| 472 */ | |
| 473 (void) jpeg_read_scanlines (&cinfo, row_buffer, 1); | |
| 474 jp = row_buffer[0]; | |
| 647 | 475 for (i = 0; i < (int) cinfo.output_width; i++) |
| 428 | 476 { |
| 477 int clr; | |
| 478 if (jpeg_gray) | |
| 479 { | |
| 2367 | 480 Binbyte val; |
| 428 | 481 #if (BITS_IN_JSAMPLE == 8) |
| 2367 | 482 val = (Binbyte) *jp++; |
| 428 | 483 #else /* other option is 12 */ |
| 2367 | 484 val = (Binbyte) (*jp++ >> 4); |
| 428 | 485 #endif |
| 486 for (clr = 0; clr < 3; clr++) /* copy the same value into RGB */ | |
| 487 *op++ = val; | |
| 488 } | |
| 489 else | |
| 490 { | |
| 491 for (clr = 0; clr < 3; clr++) | |
| 492 #if (BITS_IN_JSAMPLE == 8) | |
| 2367 | 493 *op++ = (Binbyte)*jp++; |
| 428 | 494 #else /* other option is 12 */ |
| 2367 | 495 *op++ = (Binbyte)(*jp++ >> 4); |
| 428 | 496 #endif |
| 497 } | |
| 498 } | |
| 499 } | |
| 500 } | |
| 501 } | |
| 502 | |
| 503 /* Step 6.5: Create the pixmap and set up the image instance */ | |
| 504 /* now instantiate */ | |
| 442 | 505 MAYBE_DEVMETH (DOMAIN_XDEVICE (ii->domain), |
| 428 | 506 init_image_instance_from_eimage, |
| 507 (ii, cinfo.output_width, cinfo.output_height, 1, | |
| 508 unwind.eimage, dest_mask, | |
| 2959 | 509 instantiator, pointer_fg, pointer_bg, domain)); |
| 428 | 510 |
| 511 /* Step 7: Finish decompression */ | |
| 512 | |
| 513 jpeg_finish_decompress (&cinfo); | |
| 514 /* We can ignore the return value since suspension is not possible | |
| 515 * with the stdio data source. | |
| 516 */ | |
| 517 | |
| 518 /* And we're done! */ | |
| 519 /* This will clean up everything else. */ | |
| 771 | 520 unbind_to (speccount); |
| 428 | 521 } |
| 522 | |
| 523 #endif /* HAVE_JPEG */ | |
| 524 | |
| 525 #ifdef HAVE_GIF | |
| 526 /********************************************************************** | |
| 527 * GIF * | |
| 528 **********************************************************************/ | |
| 529 | |
| 530 #include "gifrlib.h" | |
| 531 | |
| 532 static void | |
| 533 gif_validate (Lisp_Object instantiator) | |
| 534 { | |
| 535 file_or_data_must_be_present (instantiator); | |
| 536 } | |
| 537 | |
| 538 static Lisp_Object | |
| 442 | 539 gif_normalize (Lisp_Object inst, Lisp_Object console_type, |
| 2286 | 540 Lisp_Object UNUSED (dest_mask)) |
| 428 | 541 { |
| 542 return simple_image_type_normalize (inst, console_type, Qgif); | |
| 543 } | |
| 544 | |
| 545 static int | |
| 546 gif_possible_dest_types (void) | |
| 547 { | |
| 548 return IMAGE_COLOR_PIXMAP_MASK; | |
| 549 } | |
| 550 | |
| 551 /* To survive the otherwise baffling complexity of making sure | |
| 552 everything gets cleaned up in the presence of an error, we | |
| 553 use an unwind_protect(). */ | |
| 554 | |
| 555 struct gif_unwind_data | |
| 556 { | |
| 2367 | 557 Binbyte *eimage; |
| 428 | 558 /* Object that holds the decoded data from a GIF file */ |
| 559 GifFileType *giffile; | |
| 560 }; | |
| 561 | |
| 562 static Lisp_Object | |
| 563 gif_instantiate_unwind (Lisp_Object unwind_obj) | |
| 564 { | |
| 565 struct gif_unwind_data *data = | |
| 566 (struct gif_unwind_data *) get_opaque_ptr (unwind_obj); | |
| 567 | |
| 568 free_opaque_ptr (unwind_obj); | |
| 569 if (data->giffile) | |
| 570 { | |
| 571 DGifCloseFile (data->giffile); | |
| 572 GifFree(data->giffile); | |
| 573 } | |
| 647 | 574 if (data->eimage) |
| 2367 | 575 xfree (data->eimage, Binbyte *); |
| 428 | 576 |
| 577 return Qnil; | |
| 578 } | |
| 579 | |
| 580 typedef struct gif_memory_storage | |
| 581 { | |
| 2367 | 582 Binbyte *bytes; /* The data */ |
| 665 | 583 Bytecount len; /* How big is it? */ |
| 584 Bytecount index; /* Where are we? */ | |
| 428 | 585 } gif_memory_storage; |
| 586 | |
| 665 | 587 static Bytecount |
| 588 gif_read_from_memory (GifByteType *buf, Bytecount size, VoidPtr data) | |
| 428 | 589 { |
| 647 | 590 gif_memory_storage *mem = (gif_memory_storage *) data; |
| 428 | 591 |
| 592 if (size > (mem->len - mem->index)) | |
| 647 | 593 return -1; |
| 594 memcpy (buf, mem->bytes + mem->index, size); | |
| 428 | 595 mem->index = mem->index + size; |
| 596 return size; | |
| 597 } | |
| 598 | |
| 599 static int | |
| 2286 | 600 gif_memory_close (VoidPtr UNUSED (data)) |
| 428 | 601 { |
| 602 return 0; | |
| 603 } | |
| 604 | |
| 605 struct gif_error_struct | |
| 606 { | |
| 771 | 607 const Extbyte *err_str; /* return the error string */ |
| 428 | 608 jmp_buf setjmp_buffer; /* for return to caller */ |
| 609 }; | |
| 610 | |
| 611 static void | |
| 771 | 612 gif_error_func (const Extbyte *err_str, VoidPtr error_ptr) |
| 428 | 613 { |
| 647 | 614 struct gif_error_struct *error_data = (struct gif_error_struct *) error_ptr; |
| 428 | 615 |
| 616 /* return to setjmp point */ | |
| 617 error_data->err_str = err_str; | |
| 618 longjmp (error_data->setjmp_buffer, 1); | |
| 619 } | |
| 620 | |
| 621 static void | |
| 622 gif_instantiate (Lisp_Object image_instance, Lisp_Object instantiator, | |
| 2959 | 623 Lisp_Object pointer_fg, Lisp_Object pointer_bg, |
| 428 | 624 int dest_mask, Lisp_Object domain) |
| 625 { | |
| 440 | 626 Lisp_Image_Instance *ii = XIMAGE_INSTANCE (image_instance); |
| 428 | 627 /* It is OK for the unwind data to be local to this function, |
| 628 because the unwind-protect is always executed when this | |
| 629 stack frame is still valid. */ | |
| 630 struct gif_unwind_data unwind; | |
| 631 int speccount = specpdl_depth (); | |
| 632 gif_memory_storage mem_struct; | |
| 633 struct gif_error_struct gif_err; | |
| 2367 | 634 Binbyte *bytes; |
| 665 | 635 Bytecount len; |
| 428 | 636 int height = 0; |
| 637 int width = 0; | |
| 638 | |
| 639 xzero (unwind); | |
| 640 record_unwind_protect (gif_instantiate_unwind, make_opaque_ptr (&unwind)); | |
| 641 | |
| 642 /* 1. Now decode the data. */ | |
| 643 | |
| 644 { | |
| 645 Lisp_Object data = find_keyword_in_vector (instantiator, Q_data); | |
| 646 | |
| 647 assert (!NILP (data)); | |
| 648 | |
| 649 if (!(unwind.giffile = GifSetup())) | |
| 440 | 650 signal_image_error ("Insufficient memory to instantiate GIF image", instantiator); |
| 428 | 651 |
| 652 /* set up error facilities */ | |
| 653 if (setjmp(gif_err.setjmp_buffer)) | |
| 654 { | |
| 655 /* An error was signaled. No clean up is needed, as unwind handles that | |
| 656 for us. Just pass the error along. */ | |
| 867 | 657 Ibyte *interr; |
| 428 | 658 Lisp_Object errstring; |
| 771 | 659 EXTERNAL_TO_C_STRING (gif_err.err_str, interr, Qnative); |
| 660 errstring = build_msg_intstring (interr); | |
| 428 | 661 signal_image_error_2 ("GIF decoding error", errstring, instantiator); |
| 662 } | |
| 663 GifSetErrorFunc(unwind.giffile, (Gif_error_func)gif_error_func, (VoidPtr)&gif_err); | |
| 664 | |
| 440 | 665 TO_EXTERNAL_FORMAT (LISP_STRING, data, ALLOCA, (bytes, len), Qbinary); |
| 428 | 666 mem_struct.bytes = bytes; |
| 667 mem_struct.len = len; | |
| 668 mem_struct.index = 0; | |
| 669 GifSetReadFunc(unwind.giffile, gif_read_from_memory, (VoidPtr)&mem_struct); | |
| 670 GifSetCloseFunc(unwind.giffile, gif_memory_close, (VoidPtr)&mem_struct); | |
| 671 DGifInitRead(unwind.giffile); | |
| 672 | |
| 673 /* Then slurp the image into memory, decoding along the way. | |
| 674 The result is the image in a simple one-byte-per-pixel | |
| 675 format (#### the GIF routines only support 8-bit GIFs, | |
| 676 it appears). */ | |
| 677 DGifSlurp (unwind.giffile); | |
| 678 } | |
| 679 | |
| 680 /* 3. Now create the EImage(s) */ | |
| 681 { | |
| 682 ColorMapObject *cmo = unwind.giffile->SColorMap; | |
| 683 int i, j, row, pass, interlace, slice; | |
|
4646
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
684 UINT_64_BIT pixels_sq; |
| 2367 | 685 Binbyte *eip; |
| 428 | 686 /* interlaced gifs have rows in this order: |
| 687 0, 8, 16, ..., 4, 12, 20, ..., 2, 6, 10, ..., 1, 3, 5, ... */ | |
| 688 static int InterlacedOffset[] = { 0, 4, 2, 1 }; | |
| 689 static int InterlacedJumps[] = { 8, 8, 4, 2 }; | |
| 690 | |
| 691 height = unwind.giffile->SHeight; | |
| 692 width = unwind.giffile->SWidth; | |
|
4646
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
693 pixels_sq = (UINT_64_BIT) width * (UINT_64_BIT) height; |
|
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
694 if (pixels_sq > ((size_t) -1) / (3 * unwind.giffile->ImageCount)) |
|
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
695 signal_image_error ("GIF image too large to instantiate", instantiator); |
| 2367 | 696 unwind.eimage = |
| 697 xnew_binbytes (width * height * 3 * unwind.giffile->ImageCount); | |
| 428 | 698 if (!unwind.eimage) |
| 699 signal_image_error("Unable to allocate enough memory for image", instantiator); | |
| 700 | |
| 701 /* write the data in EImage format (8bit RGB triples) */ | |
| 702 | |
| 703 for (slice = 0; slice < unwind.giffile->ImageCount; slice++) | |
| 704 { | |
| 638 | 705 /* We check here that the current image covers the full "screen" size. */ |
| 428 | 706 if (unwind.giffile->SavedImages[slice].ImageDesc.Height != height |
| 707 || unwind.giffile->SavedImages[slice].ImageDesc.Width != width | |
| 708 || unwind.giffile->SavedImages[slice].ImageDesc.Left != 0 | |
| 709 || unwind.giffile->SavedImages[slice].ImageDesc.Top != 0) | |
| 710 signal_image_error ("Image in GIF file is not full size", | |
| 711 instantiator); | |
| 712 | |
| 713 interlace = unwind.giffile->SavedImages[slice].ImageDesc.Interlace; | |
| 714 pass = 0; | |
| 715 row = interlace ? InterlacedOffset[pass] : 0; | |
| 716 eip = unwind.eimage + (width * height * 3 * slice); | |
| 717 for (i = 0; i < height; i++) | |
| 718 { | |
| 719 if (interlace) | |
| 720 if (row >= height) { | |
| 721 row = InterlacedOffset[++pass]; | |
| 722 while (row >= height) | |
| 723 row = InterlacedOffset[++pass]; | |
| 724 } | |
| 725 eip = unwind.eimage + (width * height * 3 * slice) + (row * width * 3); | |
| 726 for (j = 0; j < width; j++) | |
| 727 { | |
| 2367 | 728 Binbyte pixel = |
| 428 | 729 unwind.giffile->SavedImages[slice].RasterBits[(i * width) + j]; |
| 730 *eip++ = cmo->Colors[pixel].Red; | |
| 731 *eip++ = cmo->Colors[pixel].Green; | |
| 732 *eip++ = cmo->Colors[pixel].Blue; | |
| 733 } | |
| 734 row += interlace ? InterlacedJumps[pass] : 1; | |
| 735 } | |
| 736 } | |
| 737 | |
| 738 /* now instantiate */ | |
| 442 | 739 MAYBE_DEVMETH (DOMAIN_XDEVICE (ii->domain), |
| 428 | 740 init_image_instance_from_eimage, |
| 2959 | 741 (ii, width, height, unwind.giffile->ImageCount, |
| 742 unwind.eimage, dest_mask, instantiator, pointer_fg, | |
| 743 pointer_bg, domain)); | |
| 428 | 744 } |
| 745 | |
| 746 /* We read the gif successfully. If we have more than one slice then | |
| 747 animate the gif. */ | |
| 748 if (unwind.giffile->ImageCount > 1) | |
| 749 { | |
| 750 /* See if there is a timeout value. In theory there could be one | |
| 751 for every image - but that makes the implementation way to | |
| 752 complicated for now so we just take the first. */ | |
| 753 unsigned short timeout = 0; | |
| 754 Lisp_Object tid; | |
| 755 | |
| 756 if (unwind.giffile->SavedImages[0].Function == GRAPHICS_EXT_FUNC_CODE | |
| 757 && | |
| 758 unwind.giffile->SavedImages[0].ExtensionBlockCount) | |
| 759 { | |
| 760 timeout = (unsigned short) | |
| 438 | 761 ((unwind.giffile->SavedImages[0].ExtensionBlocks[0].Bytes[2] << 8) + |
| 428 | 762 unwind.giffile-> SavedImages[0].ExtensionBlocks[0].Bytes[1]) * 10; |
| 763 } | |
| 764 | |
| 765 /* Too short a timeout will crucify us performance-wise. */ | |
| 766 tid = add_glyph_animated_timeout (timeout > 10 ? timeout : 10, image_instance); | |
| 767 | |
| 768 if (!NILP (tid)) | |
| 769 IMAGE_INSTANCE_PIXMAP_TIMEOUT (ii) = XINT (tid); | |
| 770 } | |
| 438 | 771 |
| 771 | 772 unbind_to (speccount); |
| 428 | 773 } |
| 774 | |
| 775 #endif /* HAVE_GIF */ | |
| 776 | |
| 777 | |
| 778 #ifdef HAVE_PNG | |
| 779 | |
| 780 /********************************************************************** | |
| 781 * PNG * | |
| 782 **********************************************************************/ | |
| 783 static void | |
| 784 png_validate (Lisp_Object instantiator) | |
| 785 { | |
| 786 file_or_data_must_be_present (instantiator); | |
| 787 } | |
| 788 | |
| 789 static Lisp_Object | |
| 442 | 790 png_normalize (Lisp_Object inst, Lisp_Object console_type, |
| 2286 | 791 Lisp_Object UNUSED (dest_mask)) |
| 428 | 792 { |
| 793 return simple_image_type_normalize (inst, console_type, Qpng); | |
| 794 } | |
| 795 | |
| 796 static int | |
| 797 png_possible_dest_types (void) | |
| 798 { | |
| 799 return IMAGE_COLOR_PIXMAP_MASK; | |
| 800 } | |
| 801 | |
| 802 struct png_memory_storage | |
| 803 { | |
| 2367 | 804 const Binbyte *bytes; /* The data */ |
| 665 | 805 Bytecount len; /* How big is it? */ |
| 806 Bytecount index; /* Where are we? */ | |
| 428 | 807 }; |
| 808 | |
| 809 static void | |
| 647 | 810 png_read_from_memory (png_structp png_ptr, png_bytep data, |
| 811 png_size_t length) | |
| 428 | 812 { |
| 813 struct png_memory_storage *tbr = | |
| 814 (struct png_memory_storage *) png_get_io_ptr (png_ptr); | |
| 815 | |
| 665 | 816 if ((Bytecount) length > (tbr->len - tbr->index)) |
| 428 | 817 png_error (png_ptr, (png_const_charp) "Read Error"); |
| 647 | 818 memcpy (data, tbr->bytes + tbr->index,length); |
| 428 | 819 tbr->index = tbr->index + length; |
| 820 } | |
| 821 | |
| 822 struct png_error_struct | |
| 823 { | |
| 442 | 824 const char *err_str; |
| 428 | 825 jmp_buf setjmp_buffer; /* for return to caller */ |
| 826 }; | |
| 827 | |
| 828 /* jh 98/03/12 - #### AARRRGH! libpng includes jmp_buf inside its own | |
| 829 structure, and there are cases where the size can be different from | |
| 830 between inside the library, and inside the code! To do an end run | |
| 831 around this, use our own error functions, and don't rely on things | |
| 832 passed in the png_ptr to them. This is an ugly hack and must | |
| 833 go away when the lisp engine is threaded! */ | |
| 834 static struct png_error_struct png_err_stct; | |
| 835 | |
| 836 static void | |
| 2286 | 837 png_error_func (png_structp UNUSED (png_ptr), png_const_charp msg) |
| 428 | 838 { |
| 839 png_err_stct.err_str = msg; | |
| 840 longjmp (png_err_stct.setjmp_buffer, 1); | |
| 841 } | |
| 842 | |
| 843 static void | |
| 2286 | 844 png_warning_func (png_structp UNUSED (png_ptr), png_const_charp msg) |
| 428 | 845 { |
| 3734 | 846 DECLARE_EISTRING (eimsg); |
| 847 | |
| 848 eicpy_ext(eimsg, msg, Qbinary); | |
| 849 warn_when_safe (Qpng, Qinfo, "%s", eidata(eimsg)); | |
| 428 | 850 } |
| 851 | |
| 852 struct png_unwind_data | |
| 853 { | |
| 854 FILE *instream; | |
| 2367 | 855 Binbyte *eimage; |
| 428 | 856 png_structp png_ptr; |
| 857 png_infop info_ptr; | |
| 858 }; | |
| 859 | |
| 860 static Lisp_Object | |
| 861 png_instantiate_unwind (Lisp_Object unwind_obj) | |
| 862 { | |
| 863 struct png_unwind_data *data = | |
| 864 (struct png_unwind_data *) get_opaque_ptr (unwind_obj); | |
| 865 | |
| 866 free_opaque_ptr (unwind_obj); | |
| 867 if (data->png_ptr) | |
| 3839 | 868 { |
| 869 /* ensure we can't get here again */ | |
| 870 png_structp tmp = data->png_ptr; | |
| 871 data->png_ptr = NULL; | |
| 872 png_destroy_read_struct (&tmp, &(data->info_ptr), (png_infopp)NULL); | |
| 873 } | |
| 874 | |
| 428 | 875 if (data->instream) |
| 771 | 876 retry_fclose (data->instream); |
| 428 | 877 |
| 1726 | 878 if (data->eimage) |
| 2367 | 879 xfree(data->eimage, Binbyte *); |
| 428 | 880 |
| 881 return Qnil; | |
| 882 } | |
| 883 | |
| 884 static void | |
| 885 png_instantiate (Lisp_Object image_instance, Lisp_Object instantiator, | |
| 2959 | 886 Lisp_Object pointer_fg, Lisp_Object pointer_bg, |
| 428 | 887 int dest_mask, Lisp_Object domain) |
| 888 { | |
| 440 | 889 Lisp_Image_Instance *ii = XIMAGE_INSTANCE (image_instance); |
| 428 | 890 struct png_unwind_data unwind; |
| 891 int speccount = specpdl_depth (); | |
| 892 int height, width; | |
| 893 struct png_memory_storage tbr; /* Data to be read */ | |
| 894 | |
| 895 /* PNG variables */ | |
| 896 png_structp png_ptr; | |
| 897 png_infop info_ptr; | |
| 898 | |
| 3839 | 899 xzero (unwind); |
| 900 record_unwind_protect (png_instantiate_unwind, make_opaque_ptr (&unwind)); | |
| 901 | |
| 902 if (setjmp (png_err_stct.setjmp_buffer)) | |
| 903 { | |
| 904 /* Something blew up: | |
| 905 just display the error (cleanup happens in the unwind) */ | |
| 906 signal_image_error_2 ("Error decoding PNG", | |
| 907 build_string(png_err_stct.err_str), | |
| 908 instantiator); | |
| 909 } | |
| 910 | |
| 428 | 911 /* Initialize all PNG structures */ |
| 3839 | 912 png_ptr = png_create_read_struct (PNG_LIBPNG_VER_STRING, |
| 913 (void *) &png_err_stct, | |
| 428 | 914 png_error_func, png_warning_func); |
| 915 if (!png_ptr) | |
| 916 signal_image_error ("Error obtaining memory for png_read", instantiator); | |
| 3839 | 917 unwind.png_ptr = png_ptr; |
| 918 | |
| 428 | 919 info_ptr = png_create_info_struct (png_ptr); |
| 920 if (!info_ptr) | |
| 921 { | |
| 3839 | 922 unwind.png_ptr = NULL; /* avoid re-calling png_destroy_read_struct |
| 923 when unwinding */ | |
| 428 | 924 png_destroy_read_struct (&png_ptr, (png_infopp)NULL, (png_infopp)NULL); |
| 925 signal_image_error ("Error obtaining memory for png_read", instantiator); | |
| 926 } | |
| 927 unwind.info_ptr = info_ptr; | |
| 928 | |
| 929 /* This code is a mixture of stuff from Ben's GIF/JPEG stuff from | |
| 930 this file, example.c from the libpng 0.81 distribution, and the | |
| 931 pngtopnm sources. -WMP- | |
| 932 */ | |
| 933 /* It has been further modified to handle the API changes for 0.96, | |
| 934 and is no longer usable for previous versions. jh | |
| 935 */ | |
| 936 | |
| 937 /* Initialize the IO layer and read in header information */ | |
| 938 { | |
| 939 Lisp_Object data = find_keyword_in_vector (instantiator, Q_data); | |
| 2367 | 940 const Binbyte *bytes; |
| 665 | 941 Bytecount len; |
| 428 | 942 |
| 943 assert (!NILP (data)); | |
| 944 | |
| 945 /* #### This is a definite problem under Mule due to the amount of | |
| 946 stack data it might allocate. Need to think about using Lstreams */ | |
| 440 | 947 TO_EXTERNAL_FORMAT (LISP_STRING, data, ALLOCA, (bytes, len), Qbinary); |
| 428 | 948 tbr.bytes = bytes; |
| 949 tbr.len = len; | |
| 950 tbr.index = 0; | |
| 951 png_set_read_fn (png_ptr,(void *) &tbr, png_read_from_memory); | |
| 952 } | |
| 953 | |
| 954 png_read_info (png_ptr, info_ptr); | |
| 955 | |
| 956 { | |
|
4698
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
957 int y, padding; |
| 2367 | 958 Binbyte **row_pointers; |
|
4646
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
959 UINT_64_BIT pixels_sq; |
| 428 | 960 height = info_ptr->height; |
| 961 width = info_ptr->width; | |
|
4646
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
962 pixels_sq = (UINT_64_BIT) width * (UINT_64_BIT) height; |
|
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
963 if (pixels_sq > ((size_t) -1) / 3) |
|
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
964 signal_image_error ("PNG image too large to instantiate", instantiator); |
| 428 | 965 |
|
4698
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
966 /* Wow, allocate all the memory. Truly, exciting. |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
967 Well, yes, there's excitement to be had. It turns out that libpng |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
968 strips in place, so the last row overruns the buffer if depth is 16 |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
969 or there's an alpha channel. This is a crash on Linux. So we need |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
970 to add padding. |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
971 The worst case is reducing 8 bytes (16-bit RGBA) to 3 (8-bit RGB). */ |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
972 |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
973 padding = 5 * width; |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
974 unwind.eimage = xnew_array_and_zero (Binbyte, |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
975 (size_t) (pixels_sq * 3 + padding)); |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
976 |
| 428 | 977 /* libpng expects that the image buffer passed in contains a |
| 978 picture to draw on top of if the png has any transparencies. | |
| 979 This could be a good place to pass that in... */ | |
| 980 | |
| 981 row_pointers = xnew_array (png_byte *, height); | |
| 982 for (y = 0; y < height; y++) | |
| 983 row_pointers[y] = unwind.eimage + (width * 3 * y); | |
| 984 | |
| 985 { | |
| 986 /* if the png specifies a background chunk, go ahead and | |
| 987 use it, else use what we can get from the default face. */ | |
| 988 png_color_16 my_background, *image_background; | |
| 989 Lisp_Object bkgd = Qnil; | |
| 990 | |
| 991 my_background.red = 0x7fff; | |
| 992 my_background.green = 0x7fff; | |
| 993 my_background.blue = 0x7fff; | |
| 994 bkgd = FACE_BACKGROUND (Vdefault_face, domain); | |
| 995 if (!COLOR_INSTANCEP (bkgd)) | |
| 996 { | |
| 997 warn_when_safe (Qpng, Qinfo, "Couldn't get background color!"); | |
| 998 } | |
| 999 else | |
| 1000 { | |
|
4698
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1001 Lisp_Color_Instance *c = XCOLOR_INSTANCE (bkgd); |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1002 Lisp_Object rgb = MAYBE_LISP_DEVMETH (XDEVICE (c->device), |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1003 color_instance_rgb_components, |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1004 (c)); |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1005 #define GETCOLOR(col) my_background.col = (unsigned short) XINT (XCAR (rgb)) |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1006 GETCOLOR(red); rgb = XCDR (rgb); |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1007 GETCOLOR(green); rgb = XCDR (rgb); |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1008 GETCOLOR(blue); |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1009 #undef GETCOLOR |
| 428 | 1010 } |
| 1011 | |
| 1012 if (png_get_bKGD (png_ptr, info_ptr, &image_background)) | |
| 1013 png_set_background (png_ptr, image_background, | |
| 1014 PNG_BACKGROUND_GAMMA_FILE, 1, 1.0); | |
| 1015 else | |
| 1016 png_set_background (png_ptr, &my_background, | |
| 1017 PNG_BACKGROUND_GAMMA_SCREEN, 0, 1.0); | |
| 1018 } | |
| 1019 | |
| 1020 /* Now that we're using EImage, ask for 8bit RGB triples for any type | |
| 1021 of image*/ | |
|
4698
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1022 /* convert palette images to RGB */ |
| 428 | 1023 if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE) |
|
4698
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1024 png_set_palette_to_rgb (png_ptr); |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1025 /* convert grayscale images to RGB */ |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1026 else if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY || |
| 428 | 1027 info_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) |
| 1028 png_set_gray_to_rgb (png_ptr); | |
|
4698
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1029 /* pad images with depth < 8 bits */ |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1030 else if (info_ptr->bit_depth < 8) |
| 428 | 1031 { |
| 1032 if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY) | |
| 1033 png_set_expand (png_ptr); | |
| 1034 else | |
| 1035 png_set_packing (png_ptr); | |
| 1036 } | |
|
4698
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1037 /* strip 16-bit depth files down to 8 bits */ |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1038 if (info_ptr->bit_depth == 16) |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1039 png_set_strip_16 (png_ptr); |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1040 /* strip alpha channel |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1041 #### shouldn't we handle this? |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1042 first call png_read_update_info in case above transformations |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1043 have generated an alpha channel */ |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1044 png_read_update_info(png_ptr, info_ptr); |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1045 if (info_ptr->color_type & PNG_COLOR_MASK_ALPHA) |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1046 png_set_strip_alpha (png_ptr); |
| 428 | 1047 |
| 1048 png_read_image (png_ptr, row_pointers); | |
| 1049 png_read_end (png_ptr, info_ptr); | |
| 1050 | |
|
4698
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1051 /* #### There should be some way to pass this type of data down |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1052 * into the glyph code, where you can get to it from lisp |
|
a9493cab536f
Fix crash due to mishandling transparency.
Stephen J. Turnbull <stephen@xemacs.org>
parents:
4682
diff
changeset
|
1053 * anyway. - WMP */ |
| 428 | 1054 { |
| 1055 int i; | |
| 3734 | 1056 DECLARE_EISTRING (key); |
| 1057 DECLARE_EISTRING (text); | |
| 428 | 1058 |
| 1059 for (i = 0 ; i < info_ptr->num_text ; i++) | |
| 1060 { | |
| 1061 /* How paranoid do I have to be about no trailing NULLs, and | |
| 1062 using (int)info_ptr->text[i].text_length, and strncpy and a temp | |
| 1063 string somewhere? */ | |
| 3734 | 1064 eireset(key); |
| 1065 eireset(text); | |
| 1066 eicpy_ext(key, info_ptr->text[i].key, Qbinary); | |
| 1067 eicpy_ext(text, info_ptr->text[i].text, Qbinary); | |
| 428 | 1068 |
| 1069 warn_when_safe (Qpng, Qinfo, "%s - %s", | |
| 3734 | 1070 eidata(key), eidata(text)); |
| 428 | 1071 } |
| 1072 } | |
| 1073 | |
| 2367 | 1074 xfree (row_pointers, Binbyte **); |
| 428 | 1075 } |
| 1076 | |
| 1077 /* now instantiate */ | |
| 442 | 1078 MAYBE_DEVMETH (DOMAIN_XDEVICE (ii->domain), |
| 428 | 1079 init_image_instance_from_eimage, |
| 1080 (ii, width, height, 1, unwind.eimage, dest_mask, | |
| 2959 | 1081 instantiator, pointer_fg, pointer_bg, domain)); |
| 428 | 1082 |
| 1083 /* This will clean up everything else. */ | |
| 771 | 1084 unbind_to (speccount); |
| 428 | 1085 } |
| 1086 | |
| 1087 #endif /* HAVE_PNG */ | |
| 1088 | |
| 1089 | |
| 1090 #ifdef HAVE_TIFF | |
| 1091 #include "tiffio.h" | |
| 1092 | |
| 1093 /********************************************************************** | |
| 1094 * TIFF * | |
| 1095 **********************************************************************/ | |
| 1096 static void | |
| 1097 tiff_validate (Lisp_Object instantiator) | |
| 1098 { | |
| 1099 file_or_data_must_be_present (instantiator); | |
| 1100 } | |
| 1101 | |
| 1102 static Lisp_Object | |
| 442 | 1103 tiff_normalize (Lisp_Object inst, Lisp_Object console_type, |
| 2286 | 1104 Lisp_Object UNUSED (dest_mask)) |
| 428 | 1105 { |
| 1106 return simple_image_type_normalize (inst, console_type, Qtiff); | |
| 1107 } | |
| 1108 | |
| 1109 static int | |
| 1110 tiff_possible_dest_types (void) | |
| 1111 { | |
| 1112 return IMAGE_COLOR_PIXMAP_MASK; | |
| 1113 } | |
| 1114 | |
| 1115 struct tiff_unwind_data | |
| 1116 { | |
| 2367 | 1117 Binbyte *eimage; |
| 428 | 1118 /* Object that holds the decoded data from a TIFF file */ |
| 1119 TIFF *tiff; | |
| 1120 }; | |
| 1121 | |
| 1122 static Lisp_Object | |
| 1123 tiff_instantiate_unwind (Lisp_Object unwind_obj) | |
| 1124 { | |
| 1125 struct tiff_unwind_data *data = | |
| 1126 (struct tiff_unwind_data *) get_opaque_ptr (unwind_obj); | |
| 1127 | |
| 1128 free_opaque_ptr (unwind_obj); | |
| 1129 if (data->tiff) | |
| 1130 { | |
| 1131 TIFFClose(data->tiff); | |
| 1132 } | |
| 1133 if (data->eimage) | |
| 2367 | 1134 xfree (data->eimage, Binbyte *); |
| 428 | 1135 |
| 1136 return Qnil; | |
| 1137 } | |
| 1138 | |
| 1139 typedef struct tiff_memory_storage | |
| 1140 { | |
| 2367 | 1141 Binbyte *bytes; /* The data */ |
| 665 | 1142 Bytecount len; /* How big is it? */ |
| 1143 Bytecount index; /* Where are we? */ | |
| 428 | 1144 } tiff_memory_storage; |
| 1145 | |
| 1146 static size_t | |
| 647 | 1147 tiff_memory_read (thandle_t data, tdata_t buf, tsize_t size) |
| 428 | 1148 { |
| 647 | 1149 tiff_memory_storage *mem = (tiff_memory_storage *) data; |
| 428 | 1150 |
| 665 | 1151 if ((Bytecount) size > (mem->len - mem->index)) |
| 428 | 1152 return (size_t) -1; |
| 647 | 1153 memcpy (buf, mem->bytes + mem->index, size); |
| 428 | 1154 mem->index = mem->index + size; |
| 1155 return size; | |
| 1156 } | |
| 1157 | |
| 647 | 1158 static size_t |
| 2286 | 1159 tiff_memory_write (thandle_t UNUSED (data), tdata_t UNUSED (buf), |
| 1160 tsize_t UNUSED (size)) | |
| 428 | 1161 { |
| 2500 | 1162 ABORT(); |
| 2270 | 1163 return 0; |
| 428 | 1164 } |
| 1165 | |
| 647 | 1166 static toff_t |
| 1167 tiff_memory_seek (thandle_t data, toff_t off, int whence) | |
| 428 | 1168 { |
| 647 | 1169 tiff_memory_storage *mem = (tiff_memory_storage *) data; |
| 428 | 1170 int newidx; |
| 647 | 1171 switch(whence) |
| 1172 { | |
| 1173 case SEEK_SET: | |
| 1174 newidx = off; | |
| 1175 break; | |
| 1176 case SEEK_END: | |
| 1177 newidx = mem->len + off; | |
| 1178 break; | |
| 1179 case SEEK_CUR: | |
| 1180 newidx = mem->index + off; | |
| 1181 break; | |
| 1182 default: | |
| 1183 fprintf (stderr, "Eh? invalid seek mode in tiff_memory_seek\n"); | |
| 1184 return (toff_t) -1; | |
| 1185 } | |
| 428 | 1186 |
| 1187 if ((newidx > mem->len) || (newidx < 0)) | |
| 593 | 1188 return (toff_t) -1; |
| 428 | 1189 |
| 1190 mem->index = newidx; | |
| 1191 return newidx; | |
| 1192 } | |
| 1193 | |
| 1194 static int | |
| 2286 | 1195 tiff_memory_close (thandle_t UNUSED (data)) |
| 428 | 1196 { |
| 1197 return 0; | |
| 1198 } | |
| 1199 | |
| 1200 static int | |
| 2286 | 1201 tiff_map_noop (thandle_t UNUSED (data), tdata_t* UNUSED (pbase), |
| 1202 toff_t* UNUSED (psize)) | |
| 428 | 1203 { |
| 1204 return 0; | |
| 1205 } | |
| 1206 | |
| 1207 static void | |
| 2286 | 1208 tiff_unmap_noop (thandle_t UNUSED (data), tdata_t UNUSED (pbase), |
| 1209 toff_t UNUSED (psize)) | |
| 428 | 1210 { |
| 1211 return; | |
| 1212 } | |
| 1213 | |
| 1214 static toff_t | |
| 647 | 1215 tiff_memory_size (thandle_t data) |
| 428 | 1216 { |
| 1217 tiff_memory_storage *mem = (tiff_memory_storage*)data; | |
| 1218 return mem->len; | |
| 1219 } | |
| 1220 | |
| 1221 struct tiff_error_struct | |
| 1222 { | |
| 438 | 1223 #ifdef HAVE_VSNPRINTF |
| 428 | 1224 char err_str[256]; |
| 1225 #else | |
| 1226 char err_str[1024]; /* return the error string */ | |
| 1227 #endif | |
| 1228 jmp_buf setjmp_buffer; /* for return to caller */ | |
| 1229 }; | |
| 1230 | |
| 1231 /* jh 98/03/12 - ###This struct for passing data to the error functions | |
| 1232 is an ugly hack caused by the fact that libtiff (as of v3.4) doesn't | |
| 1233 have any place to store error func data. This should be rectified | |
| 1234 before XEmacs gets threads! */ | |
| 1235 static struct tiff_error_struct tiff_err_data; | |
| 1236 | |
| 1237 static void | |
| 2286 | 1238 tiff_error_func (const char *UNUSED (module), const char *fmt, ...) |
| 428 | 1239 { |
| 1240 va_list vargs; | |
| 1241 | |
| 1242 va_start (vargs, fmt); | |
| 438 | 1243 #ifdef HAVE_VSNPRINTF |
| 428 | 1244 vsnprintf (tiff_err_data.err_str, 255, fmt, vargs); |
| 1245 #else | |
| 1246 /* pray this doesn't overflow... */ | |
| 1247 vsprintf (tiff_err_data.err_str, fmt, vargs); | |
| 1248 #endif | |
| 1249 va_end (vargs); | |
| 1250 /* return to setjmp point */ | |
| 1251 longjmp (tiff_err_data.setjmp_buffer, 1); | |
| 1252 } | |
| 1253 | |
| 1254 static void | |
| 647 | 1255 tiff_warning_func (const char *module, const char *fmt, ...) |
| 428 | 1256 { |
| 1257 va_list vargs; | |
| 438 | 1258 #ifdef HAVE_VSNPRINTF |
| 428 | 1259 char warn_str[256]; |
| 1260 #else | |
| 1261 char warn_str[1024]; | |
| 1262 #endif | |
| 3734 | 1263 DECLARE_EISTRING (eimodule); |
| 1264 DECLARE_EISTRING (eiwarnstr); | |
| 428 | 1265 |
| 1266 va_start (vargs, fmt); | |
| 438 | 1267 #ifdef HAVE_VSNPRINTF |
| 428 | 1268 vsnprintf (warn_str, 255, fmt, vargs); |
| 1269 #else | |
| 1270 vsprintf (warn_str, fmt, vargs); | |
| 1271 #endif | |
| 1272 va_end (vargs); | |
| 3734 | 1273 |
| 1274 eicpy_ext(eimodule, module, Qbinary); | |
| 1275 eicpy_ext(eiwarnstr, warn_str, Qbinary); | |
| 1276 | |
| 428 | 1277 warn_when_safe (Qtiff, Qinfo, "%s - %s", |
| 3734 | 1278 eidata(eimodule), |
| 1279 eidata(eiwarnstr)); | |
| 428 | 1280 } |
| 1281 | |
| 1282 static void | |
| 1283 tiff_instantiate (Lisp_Object image_instance, Lisp_Object instantiator, | |
| 2959 | 1284 Lisp_Object pointer_fg, Lisp_Object pointer_bg, |
| 428 | 1285 int dest_mask, Lisp_Object domain) |
| 1286 { | |
| 440 | 1287 Lisp_Image_Instance *ii = XIMAGE_INSTANCE (image_instance); |
| 428 | 1288 tiff_memory_storage mem_struct; |
| 1289 /* It is OK for the unwind data to be local to this function, | |
| 1290 because the unwind-protect is always executed when this | |
| 1291 stack frame is still valid. */ | |
| 1292 struct tiff_unwind_data unwind; | |
| 1293 int speccount = specpdl_depth (); | |
| 1294 uint32 width, height; | |
| 1295 | |
| 1296 xzero (unwind); | |
| 1297 record_unwind_protect (tiff_instantiate_unwind, make_opaque_ptr (&unwind)); | |
| 1298 | |
| 1299 /* set up error facilities */ | |
| 1300 if (setjmp (tiff_err_data.setjmp_buffer)) | |
| 1301 { | |
| 1302 /* An error was signaled. No clean up is needed, as unwind handles that | |
| 1303 for us. Just pass the error along. */ | |
| 1304 signal_image_error_2 ("TIFF decoding error", | |
| 1305 build_string(tiff_err_data.err_str), | |
| 1306 instantiator); | |
| 1307 } | |
| 1308 TIFFSetErrorHandler ((TIFFErrorHandler)tiff_error_func); | |
| 1309 TIFFSetWarningHandler ((TIFFErrorHandler)tiff_warning_func); | |
| 1310 { | |
| 1311 Lisp_Object data = find_keyword_in_vector (instantiator, Q_data); | |
| 2367 | 1312 Binbyte *bytes; |
| 665 | 1313 Bytecount len; |
| 428 | 1314 |
| 1315 uint32 *raster; | |
| 2367 | 1316 Binbyte *ep; |
|
4646
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
1317 UINT_64_BIT pixels_sq; |
| 428 | 1318 |
| 1319 assert (!NILP (data)); | |
| 1320 | |
| 1321 /* #### This is a definite problem under Mule due to the amount of | |
| 1322 stack data it might allocate. Think about Lstreams... */ | |
| 440 | 1323 TO_EXTERNAL_FORMAT (LISP_STRING, data, |
| 1324 ALLOCA, (bytes, len), | |
| 1325 Qbinary); | |
| 428 | 1326 mem_struct.bytes = bytes; |
| 1327 mem_struct.len = len; | |
| 1328 mem_struct.index = 0; | |
| 1329 | |
| 442 | 1330 unwind.tiff = TIFFClientOpen ("memfile", "r", (thandle_t) &mem_struct, |
| 428 | 1331 (TIFFReadWriteProc)tiff_memory_read, |
| 1332 (TIFFReadWriteProc)tiff_memory_write, | |
| 1333 tiff_memory_seek, tiff_memory_close, tiff_memory_size, | |
| 1334 tiff_map_noop, tiff_unmap_noop); | |
| 1335 if (!unwind.tiff) | |
| 440 | 1336 signal_image_error ("Insufficient memory to instantiate TIFF image", instantiator); |
| 428 | 1337 |
| 1338 TIFFGetField (unwind.tiff, TIFFTAG_IMAGEWIDTH, &width); | |
| 1339 TIFFGetField (unwind.tiff, TIFFTAG_IMAGELENGTH, &height); | |
|
4646
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
1340 pixels_sq = (UINT_64_BIT) width * (UINT_64_BIT) height; |
|
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
1341 if (pixels_sq >= 1 << 29) |
|
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
1342 signal_image_error ("TIFF image too large to instantiate", instantiator); |
|
4682
648f4a0dac3e
Fix build problems on WIN32 platforms caused by the large image crash fix.
Jerry James <james@xemacs.org>
parents:
4646
diff
changeset
|
1343 unwind.eimage = xnew_binbytes ((size_t) pixels_sq * 3); |
| 428 | 1344 |
| 440 | 1345 /* #### This is little more than proof-of-concept/function testing. |
| 428 | 1346 It needs to be reimplemented via scanline reads for both memory |
| 1347 compactness. */ | |
|
4646
6c6bfdb80a0c
Prevent integer overflow and subsequent crashes when attempting to load large
Jerry James <james@xemacs.org>
parents:
4326
diff
changeset
|
1348 raster = (uint32*) _TIFFmalloc ((tsize_t) (pixels_sq * sizeof (uint32))); |
| 428 | 1349 if (raster != NULL) |
| 1350 { | |
| 647 | 1351 int i, j; |
| 428 | 1352 uint32 *rp; |
| 1353 ep = unwind.eimage; | |
| 1354 rp = raster; | |
| 1355 if (TIFFReadRGBAImage (unwind.tiff, width, height, raster, 0)) | |
| 1356 { | |
| 1357 for (i = height - 1; i >= 0; i--) | |
| 1358 { | |
| 1359 /* This is to get around weirdness in the libtiff library where properly | |
| 1360 made TIFFs will come out upside down. libtiff bug or jhod-brainlock? */ | |
| 1361 rp = raster + (i * width); | |
| 647 | 1362 for (j = 0; j < (int) width; j++) |
| 428 | 1363 { |
| 2367 | 1364 *ep++ = (Binbyte)TIFFGetR(*rp); |
| 1365 *ep++ = (Binbyte)TIFFGetG(*rp); | |
| 1366 *ep++ = (Binbyte)TIFFGetB(*rp); | |
| 428 | 1367 rp++; |
| 1368 } | |
| 1369 } | |
| 1370 } | |
| 1371 _TIFFfree (raster); | |
| 1372 } else | |
| 1373 signal_image_error ("Unable to allocate memory for TIFFReadRGBA", instantiator); | |
| 1374 | |
| 1375 } | |
| 1376 | |
| 1377 /* now instantiate */ | |
| 442 | 1378 MAYBE_DEVMETH (DOMAIN_XDEVICE (ii->domain), |
| 428 | 1379 init_image_instance_from_eimage, |
| 1380 (ii, width, height, 1, unwind.eimage, dest_mask, | |
| 2959 | 1381 instantiator, pointer_fg, pointer_bg, domain)); |
| 428 | 1382 |
| 771 | 1383 unbind_to (speccount); |
| 428 | 1384 } |
| 1385 | |
| 1386 #endif /* HAVE_TIFF */ | |
| 1387 | |
| 1388 | |
| 1389 /************************************************************************/ | |
| 1390 /* initialization */ | |
| 1391 /************************************************************************/ | |
| 1392 | |
| 1393 void | |
| 1394 syms_of_glyphs_eimage (void) | |
| 1395 { | |
| 1396 } | |
| 1397 | |
| 1398 void | |
| 1399 image_instantiator_format_create_glyphs_eimage (void) | |
| 1400 { | |
| 1401 /* image-instantiator types */ | |
| 1402 #ifdef HAVE_JPEG | |
| 1403 INITIALIZE_IMAGE_INSTANTIATOR_FORMAT (jpeg, "jpeg"); | |
| 1404 | |
| 1405 IIFORMAT_HAS_METHOD (jpeg, validate); | |
| 1406 IIFORMAT_HAS_METHOD (jpeg, normalize); | |
| 1407 IIFORMAT_HAS_METHOD (jpeg, possible_dest_types); | |
| 1408 IIFORMAT_HAS_METHOD (jpeg, instantiate); | |
| 1409 | |
| 1410 IIFORMAT_VALID_KEYWORD (jpeg, Q_data, check_valid_string); | |
| 1411 IIFORMAT_VALID_KEYWORD (jpeg, Q_file, check_valid_string); | |
| 1412 #endif | |
| 1413 | |
| 1414 #ifdef HAVE_GIF | |
| 1415 INITIALIZE_IMAGE_INSTANTIATOR_FORMAT (gif, "gif"); | |
| 1416 | |
| 1417 IIFORMAT_HAS_METHOD (gif, validate); | |
| 1418 IIFORMAT_HAS_METHOD (gif, normalize); | |
| 1419 IIFORMAT_HAS_METHOD (gif, possible_dest_types); | |
| 1420 IIFORMAT_HAS_METHOD (gif, instantiate); | |
| 1421 | |
| 1422 IIFORMAT_VALID_KEYWORD (gif, Q_data, check_valid_string); | |
| 1423 IIFORMAT_VALID_KEYWORD (gif, Q_file, check_valid_string); | |
| 1424 #endif | |
| 1425 | |
| 1426 #ifdef HAVE_PNG | |
| 1427 INITIALIZE_IMAGE_INSTANTIATOR_FORMAT (png, "png"); | |
| 1428 | |
| 1429 IIFORMAT_HAS_METHOD (png, validate); | |
| 1430 IIFORMAT_HAS_METHOD (png, normalize); | |
| 1431 IIFORMAT_HAS_METHOD (png, possible_dest_types); | |
| 1432 IIFORMAT_HAS_METHOD (png, instantiate); | |
| 1433 | |
| 1434 IIFORMAT_VALID_KEYWORD (png, Q_data, check_valid_string); | |
| 1435 IIFORMAT_VALID_KEYWORD (png, Q_file, check_valid_string); | |
| 1436 #endif | |
| 1437 | |
| 1438 #ifdef HAVE_TIFF | |
| 1439 INITIALIZE_IMAGE_INSTANTIATOR_FORMAT (tiff, "tiff"); | |
| 1440 | |
| 1441 IIFORMAT_HAS_METHOD (tiff, validate); | |
| 1442 IIFORMAT_HAS_METHOD (tiff, normalize); | |
| 1443 IIFORMAT_HAS_METHOD (tiff, possible_dest_types); | |
| 1444 IIFORMAT_HAS_METHOD (tiff, instantiate); | |
| 1445 | |
| 1446 IIFORMAT_VALID_KEYWORD (tiff, Q_data, check_valid_string); | |
| 1447 IIFORMAT_VALID_KEYWORD (tiff, Q_file, check_valid_string); | |
| 1448 #endif | |
| 1449 | |
| 1450 } | |
| 1451 | |
| 1452 void | |
| 1453 vars_of_glyphs_eimage (void) | |
| 1454 { | |
| 1455 #ifdef HAVE_JPEG | |
| 1456 Fprovide (Qjpeg); | |
| 1457 #endif | |
| 1458 | |
| 1459 #ifdef HAVE_GIF | |
| 1460 Fprovide (Qgif); | |
| 1461 #endif | |
| 1462 | |
| 1463 #ifdef HAVE_PNG | |
| 1464 Fprovide (Qpng); | |
| 1465 #endif | |
| 1466 | |
| 1467 #ifdef HAVE_TIFF | |
| 1468 Fprovide (Qtiff); | |
| 1469 #endif | |
| 1470 | |
| 1471 } |