Update libpng to 1.2.38 to patch a minor security issue.

1 files changed, 68 insertions, 43 deletions

diff --git a/pngwio.c b/pngwio.c
index 52eb7c0..f77b2db 100644
--- a/pngwio.c
+++ b/pngwio.c
@@ -1,12 +1,15 @@
 
 /* pngwio.c - functions for data output
  *
- * Last changed in libpng 1.2.35 [February 14, 2009]
- * For conditions of distribution and use, see copyright notice in png.h
+ * Last changed in libpng 1.2.37 [June 4, 2009]
  * Copyright (c) 1998-2009 Glenn Randers-Pehrson
  * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger)
  * (Version 0.88 Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc.)
  *
+ * This code is released under the libpng license.
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
  * This file provides a location for all output.  Users who need
  * special handling are expected to write functions that have the same
  * arguments as these and perform similar functions, but that possibly
@@ -20,10 +23,11 @@
 #ifdef PNG_WRITE_SUPPORTED
 
 /* Write the data to whatever output you are using.  The default routine
-   writes to a file pointer.  Note that this routine sometimes gets called
-   with very small lengths, so you should implement some kind of simple
-   buffering if you are using unbuffered writes.  This should never be asked
-   to write more than 64K on a 16 bit machine.  */
+ * writes to a file pointer.  Note that this routine sometimes gets called
+ * with very small lengths, so you should implement some kind of simple
+ * buffering if you are using unbuffered writes.  This should never be asked
+ * to write more than 64K on a 16 bit machine.
+ */
 
 void /* PRIVATE */
 png_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
@@ -36,16 +40,18 @@ png_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
 
 #if !defined(PNG_NO_STDIO)
 /* This is the function that does the actual writing of data.  If you are
-   not writing to a standard C stream, you should create a replacement
-   write_data function and use it at run time with png_set_write_fn(), rather
-   than changing the library. */
+ * not writing to a standard C stream, you should create a replacement
+ * write_data function and use it at run time with png_set_write_fn(), rather
+ * than changing the library.
+ */
 #ifndef USE_FAR_KEYWORD
 void PNGAPI
 png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
 {
    png_uint_32 check;
 
-   if (png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
 #if defined(_WIN32_WCE)
    if ( !WriteFile((HANDLE)(png_ptr->io_ptr), data, length, &check, NULL) )
       check = 0;
@@ -56,10 +62,10 @@ png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
       png_error(png_ptr, "Write Error");
 }
 #else
-/* this is the model-independent version. Since the standard I/O library
-   can't handle far buffers in the medium and small models, we have to copy
-   the data.
-*/
+/* This is the model-independent version. Since the standard I/O library
+ * can't handle far buffers in the medium and small models, we have to copy
+ * the data.
+ */
 
 #define NEAR_BUF_SIZE 1024
 #define MIN(a,b) (a <= b ? a : b)
@@ -71,7 +77,8 @@ png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
    png_byte *near_data;  /* Needs to be "png_byte *" instead of "png_bytep" */
    png_FILE_p io_ptr;
 
-   if (png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
    /* Check if data really is near. If so, use usual code. */
    near_data = (png_byte *)CVT_PTR_NOCHECK(data);
    io_ptr = (png_FILE_p)CVT_PTR(png_ptr->io_ptr);
@@ -93,7 +100,7 @@ png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
       do
       {
          written = MIN(NEAR_BUF_SIZE, remaining);
-         png_memcpy(buf, data, written); /* copy far buffer to near buffer */
+         png_memcpy(buf, data, written); /* Copy far buffer to near buffer */
 #if defined(_WIN32_WCE)
          if ( !WriteFile(io_ptr, buf, written, &err, NULL) )
             err = 0;
@@ -102,8 +109,10 @@ png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
 #endif
          if (err != written)
             break;
+
          else
             check += err;
+
          data += written;
          remaining -= written;
       }
@@ -117,8 +126,9 @@ png_default_write_data(png_structp png_ptr, png_bytep data, png_size_t length)
 #endif
 
 /* This function is called to output any data pending writing (normally
-   to disk).  After png_flush is called, there should be no data pending
-   writing in any buffers. */
+ * to disk).  After png_flush is called, there should be no data pending
+ * writing in any buffers.
+ */
 #if defined(PNG_WRITE_FLUSH_SUPPORTED)
 void /* PRIVATE */
 png_flush(png_structp png_ptr)
@@ -134,48 +144,58 @@ png_default_flush(png_structp png_ptr)
 #if !defined(_WIN32_WCE)
    png_FILE_p io_ptr;
 #endif
-   if (png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
 #if !defined(_WIN32_WCE)
    io_ptr = (png_FILE_p)CVT_PTR((png_ptr->io_ptr));
-   if (io_ptr != NULL && fileno(io_ptr) != -1)
-      fflush(io_ptr);
+   fflush(io_ptr);
 #endif
 }
 #endif
 #endif
 
 /* This function allows the application to supply new output functions for
-   libpng if standard C streams aren't being used.
-
-   This function takes as its arguments:
-   png_ptr       - pointer to a png output data structure
-   io_ptr        - pointer to user supplied structure containing info about
-                   the output functions.  May be NULL.
-   write_data_fn - pointer to a new output function that takes as its
-                   arguments a pointer to a png_struct, a pointer to
-                   data to be written, and a 32-bit unsigned int that is
-                   the number of bytes to be written.  The new write
-                   function should call png_error(png_ptr, "Error msg")
-                   to exit and output any fatal error messages.
-   flush_data_fn - pointer to a new flush function that takes as its
-                   arguments a pointer to a png_struct.  After a call to
-                   the flush function, there should be no data in any buffers
-                   or pending transmission.  If the output method doesn't do
-                   any buffering of ouput, a function prototype must still be
-                   supplied although it doesn't have to do anything.  If
-                   PNG_WRITE_FLUSH_SUPPORTED is not defined at libpng compile
-                   time, output_flush_fn will be ignored, although it must be
-                   supplied for compatibility. */
+ * libpng if standard C streams aren't being used.
+ *
+ * This function takes as its arguments:
+ * png_ptr       - pointer to a png output data structure
+ * io_ptr        - pointer to user supplied structure containing info about
+ *                 the output functions.  May be NULL.
+ * write_data_fn - pointer to a new output function that takes as its
+ *                 arguments a pointer to a png_struct, a pointer to
+ *                 data to be written, and a 32-bit unsigned int that is
+ *                 the number of bytes to be written.  The new write
+ *                 function should call png_error(png_ptr, "Error msg")
+ *                 to exit and output any fatal error messages.  May be
+ *                 NULL, in which case libpng's default function will
+ *                 be used.
+ * flush_data_fn - pointer to a new flush function that takes as its
+ *                 arguments a pointer to a png_struct.  After a call to
+ *                 the flush function, there should be no data in any buffers
+ *                 or pending transmission.  If the output method doesn't do
+ *                 any buffering of ouput, a function prototype must still be
+ *                 supplied although it doesn't have to do anything.  If
+ *                 PNG_WRITE_FLUSH_SUPPORTED is not defined at libpng compile
+ *                 time, output_flush_fn will be ignored, although it must be
+ *                 supplied for compatibility.  May be NULL, in which case
+ *                 libpng's default function will be used, if
+ *                 PNG_WRITE_FLUSH_SUPPORTED is defined.  This is not
+ *                 a good idea if io_ptr does not point to a standard
+ *                 *FILE structure.
+ */
 void PNGAPI
 png_set_write_fn(png_structp png_ptr, png_voidp io_ptr,
    png_rw_ptr write_data_fn, png_flush_ptr output_flush_fn)
 {
-   if (png_ptr == NULL) return;
+   if (png_ptr == NULL)
+      return;
+
    png_ptr->io_ptr = io_ptr;
 
 #if !defined(PNG_NO_STDIO)
    if (write_data_fn != NULL)
       png_ptr->write_data_fn = write_data_fn;
+
    else
       png_ptr->write_data_fn = png_default_write_data;
 #else
@@ -186,6 +206,7 @@ png_set_write_fn(png_structp png_ptr, png_voidp io_ptr,
 #if !defined(PNG_NO_STDIO)
    if (output_flush_fn != NULL)
       png_ptr->output_flush_fn = output_flush_fn;
+
    else
       png_ptr->output_flush_fn = png_default_flush;
 #else
@@ -212,9 +233,11 @@ void *png_far_to_near(png_structp png_ptr, png_voidp ptr, int check)
    void FAR *far_ptr;
    FP_OFF(near_ptr) = FP_OFF(ptr);
    far_ptr = (void FAR *)near_ptr;
+
    if (check != 0)
       if (FP_SEG(ptr) != FP_SEG(far_ptr))
          png_error(png_ptr, "segment lost in conversion");
+
    return(near_ptr);
 }
 #  else
@@ -224,9 +247,11 @@ void *png_far_to_near(png_structp png_ptr, png_voidp ptr, int check)
    void FAR *far_ptr;
    near_ptr = (void FAR *)ptr;
    far_ptr = (void FAR *)near_ptr;
+
    if (check != 0)
       if (far_ptr != ptr)
          png_error(png_ptr, "segment lost in conversion");
+
    return(near_ptr);
 }
 #   endif