unknown chunk support, tests & docs

Author: randy408

docs/chunk.md

@@ -310,3 +310,21 @@ Set image offset
 int spng_set_exif(spng_ctx *ctx, struct spng_exif *exif)
 ```
 Set EXIF data
+
+# spng_get_unknown_chunks()
+```c
+int spng_get_unknown_chunks(spng_ctx *ctx, struct spng_unknown_chunk *chunks, uint32_t *n_chunks)
+```
+
+Copies unknown chunk information to `chunks`.
+
+`n_chunks` should be greater than or equal to the number of stored unknown chunks.
+
+If `chunks` is NULL and `n_chunks` is non-NULL then `n_chunks` is set to the number
+of stored chunks.
+
+!!! note
+    To retrieve all unknown chunks call this functions after `spng_decode_image()`.
+
+!!! warning
+    Chunk data is freed when calling `spng_ctx_free()`.

spng/spng.c

@@ -171,6 +171,7 @@ struct spng_chunk_bitfield
     unsigned time: 1;
     unsigned offs: 1;
     unsigned exif: 1;
+    unsigned unknown: 1;
 };
 
 /* Packed sample iterator */
@@ -272,6 +273,9 @@ struct spng_ctx
     struct spng_offs offs;
     struct spng_exif exif;
 
+    uint32_t n_chunks;
+    struct spng_unknown_chunk *chunk_list;
+
     struct spng_subimage subimage[7];
 
     z_stream zstream;
@@ -1696,6 +1700,20 @@ static void text_undo(spng_ctx *ctx)
     ctx->n_text--;
 }
 
+static void chunk_undo(spng_ctx *ctx)
+{
+    struct spng_unknown_chunk *chunk = &ctx->chunk_list[ctx->n_chunks - 1];
+
+    spng__free(ctx, chunk->data);
+
+    decrease_cache_usage(ctx, chunk->length);
+    decrease_cache_usage(ctx, sizeof(struct spng_unknown_chunk));
+
+    chunk->data = NULL;
+
+    ctx->n_chunks--;
+}
+
 static int read_non_idat_chunks(spng_ctx *ctx)
 {
     int ret;
@@ -2389,6 +2407,48 @@ static int read_non_idat_chunks(spng_ctx *ctx)
 
                 ctx->stored.splt = 1;
             }
+            else /* Unknown chunk */
+            {
+                ctx->file.unknown = 1;
+
+                if(ctx->user.unknown) goto discard;
+
+                if(increase_cache_usage(ctx, chunk.length + sizeof(struct spng_unknown_chunk))) return SPNG_ECHUNK_LIMITS;
+
+                ctx->n_chunks++;
+                if(ctx->n_chunks < 1) return SPNG_EOVERFLOW;
+                if(sizeof(struct spng_unknown_chunk) > SIZE_MAX / ctx->n_chunks) return SPNG_EOVERFLOW;
+
+                void *buf = spng__realloc(ctx, ctx->chunk_list, ctx->n_chunks * sizeof(struct spng_unknown_chunk));
+                if(buf == NULL) return SPNG_EMEM;
+                ctx->chunk_list = buf;
+
+                struct spng_unknown_chunk *chunks = &ctx->chunk_list[ctx->n_chunks - 1];
+
+                memset(chunks, 0, sizeof(struct spng_unknown_chunk));
+
+                ctx->undo = chunk_undo;
+
+                memcpy(chunks->type, chunk.type, 4);
+
+                if(chunk.length > 0)
+                {
+                    void *t = spng__malloc(ctx, chunk.length);
+                    if(t == NULL) return SPNG_EMEM;
+
+                    ret = read_chunk_bytes2(ctx, t, chunk.length);
+                    if(ret)
+                    {
+                        spng__free(ctx, t);
+                        return ret;
+                    }
+
+                    chunks->length = chunk.length;
+                    chunks->data = t;
+                }
+
+                ctx->stored.unknown = 1;
+            }
 
 discard:
             ret = discard_chunk_bytes(ctx, ctx->cur_chunk_bytes_left);
@@ -3321,6 +3381,15 @@ void spng_ctx_free(spng_ctx *ctx)
         spng__free(ctx, ctx->text_list);
     }
 
+    if(ctx->chunk_list != NULL && !ctx->user.unknown)
+    {
+        for(i=0; i< ctx->n_chunks; i++)
+        {
+            spng__free(ctx, ctx->chunk_list[i].data);
+        }
+        spng__free(ctx, ctx->chunk_list);
+    }
+
     inflateEnd(&ctx->zstream);
 
     spng__free(ctx, ctx->gamma_lut16);
@@ -4092,6 +4161,27 @@ int spng_set_exif(spng_ctx *ctx, struct spng_exif *exif)
     return 0;
 }
 
+int spng_get_unknown_chunks(spng_ctx *ctx, struct spng_unknown_chunk *chunks, uint32_t *n_chunks)
+{
+    if(ctx == NULL) return 1;
+    int ret = read_chunks(ctx, 0);
+    if(ret) return ret;
+    if(!ctx->stored.unknown) return SPNG_ECHUNKAVAIL;
+    if(n_chunks == NULL) return 1;
+
+    if(chunks == NULL)
+    {
+        *n_chunks = ctx->n_chunks;
+        return 0;
+    }
+
+    if(*n_chunks < ctx->n_chunks) return 1;
+
+    memcpy(chunks, ctx->chunk_list, sizeof(struct spng_unknown_chunk));
+
+    return 0;
+}
+
 const char *spng_strerror(int err)
 {
     switch(err)
@@ -4185,7 +4275,7 @@ const char *spng_strerror(int err)
 
 const char *spng_version_string(void)
 {
-    return SPNG_VERSION_STRING "-rc1"
+    return SPNG_VERSION_STRING "-rc1";
 }
 
 #if defined(_MSC_VER)

spng/spng.h

@@ -348,6 +348,13 @@ struct spng_chunk
     uint32_t crc;
 };
 
+struct spng_unknown_chunk
+{
+    uint8_t type[4];
+    size_t length;
+    void *data;
+};
+
 typedef void* spng_malloc_fn(size_t size);
 typedef void* spng_realloc_fn(void* ptr, size_t size);
 typedef void* spng_calloc_fn(size_t count, size_t size);
@@ -441,6 +448,8 @@ SPNG_API int spng_set_time(spng_ctx *ctx, struct spng_time *time);
 SPNG_API int spng_set_offs(spng_ctx *ctx, struct spng_offs *offs);
 SPNG_API int spng_set_exif(spng_ctx *ctx, struct spng_exif *exif);
 
+SPNG_API int spng_get_unknown_chunks(spng_ctx *ctx, struct spng_unknown_chunk *chunks, uint32_t *n_chunks);
+
 SPNG_API const char *spng_strerror(int err);
 SPNG_API const char *spng_version_string(void);
 

tests/meson.build

@@ -31,6 +31,7 @@ test('cpp_test', cpp_exe)
 
 subdir('images')
 subdir('crashers')
+subdir('misc')
 
 if get_option('oss_fuzz') == false
     subdir_done()

tests/misc/meson.build

@@ -0,0 +1 @@
+test('unknown_chunk', test_exe, args : files('unknown.png'))

tests/misc/unknown.png

@@ -39,6 +39,8 @@ png_structp init_libpng(FILE *file, int flags, png_infop *iptr)
         return NULL;
     }
 
+    png_set_keep_unknown_chunks(png_ptr, PNG_HANDLE_CHUNK_ALWAYS, NULL, 0);
+
     png_read_info(png_ptr, info_ptr);
 
     *iptr = info_ptr;

tests/test_png.h

@@ -370,19 +370,19 @@ static int compare_chunks(spng_ctx *ctx, png_infop info_ptr, png_structp png_ptr
     spngt_chunk_bitfield spng_have = { 0 };
     spngt_chunk_bitfield png_have = { 0 };
 
+    int i, ret = 0;
     struct spng_plte plte;
     struct spng_trns trns;
     struct spng_chrm chrm;
-    struct spng_chrm_int chrm_int;
     double gamma;
     struct spng_iccp iccp;
     struct spng_sbit sbit;
     uint8_t srgb_rendering_intent;
-    struct spng_text *text;
+    struct spng_text *text = NULL;
     struct spng_bkgd bkgd;
     struct spng_hist hist;
     struct spng_phys phys;
-    struct spng_splt *splt;
+    struct spng_splt *splt = NULL;
     struct spng_time time;
     uint32_t n_text = 0, n_splt = 0;
     struct spng_offs offs;
@@ -404,9 +404,9 @@ static int compare_chunks(spng_ctx *ctx, png_infop info_ptr, png_structp png_ptr
     if(!spng_get_offs(ctx, &offs)) spng_have.offs = 1;
     if(!spng_get_exif(ctx, &exif)) spng_have.exif = 1;
 
-    png_text *libpng_text;
+    png_text *png_text;
     int png_n_text;
-    png_sPLT_tp png_splt_entries;
+    png_sPLT_t *png_splt_entries;
 
     if(png_get_valid(png_ptr, info_ptr, PNG_INFO_PLTE)) png_have.plte = 1;
     if(png_get_valid(png_ptr, info_ptr, PNG_INFO_tRNS)) png_have.trns = 1;
@@ -415,7 +415,7 @@ static int compare_chunks(spng_ctx *ctx, png_infop info_ptr, png_structp png_ptr
     if(png_get_valid(png_ptr, info_ptr, PNG_INFO_iCCP)) png_have.iccp = 1;
     if(png_get_valid(png_ptr, info_ptr, PNG_INFO_sBIT)) png_have.sbit = 1;
     if(png_get_valid(png_ptr, info_ptr, PNG_INFO_sRGB)) png_have.srgb = 1;
-    if(png_get_text(png_ptr, info_ptr, &libpng_text, &png_n_text)) png_have.text = 1;
+    if(png_get_text(png_ptr, info_ptr, &png_text, &png_n_text)) png_have.text = 1;
     if(png_get_valid(png_ptr, info_ptr, PNG_INFO_bKGD)) png_have.bkgd = 1;
     if(png_get_valid(png_ptr, info_ptr, PNG_INFO_hIST)) png_have.hist = 1;
     if(png_get_valid(png_ptr, info_ptr, PNG_INFO_pHYs)) png_have.phys = 1;
@@ -447,7 +447,59 @@ static int compare_chunks(spng_ctx *ctx, png_infop info_ptr, png_structp png_ptr
         return 1;
     }
 
-    return 0;
+    if(n_text)
+    {
+        text = malloc(n_text * sizeof(struct spng_text));
+        if(!text) return 1;
+
+        spng_get_text(ctx, text, &n_text);
+
+        for(i=0; i < n_text; i++)
+        {
+            if((strcmp(png_text[i].text, text[i].text)))
+            {
+                printf("text[%d]: text mismatch!\nspng: %s\n\nlibpng: %s\n", i, text[i].text, png_text[i].text);
+                ret = 1;
+            }
+        }
+    }
+
+    uint32_t n_spng_chunks = 0;
+    struct spng_unknown_chunk *spng_chunks = NULL;
+
+    int n_png_chunks;
+    png_unknown_chunkp png_chunks;
+
+    if(!spng_get_unknown_chunks(ctx, NULL, &n_spng_chunks))
+    {
+        spng_chunks = malloc(n_spng_chunks * sizeof(struct spng_unknown_chunk));
+        spng_get_unknown_chunks(ctx, spng_chunks, &n_spng_chunks);
+    }
+
+    n_png_chunks = png_get_unknown_chunks(png_ptr, info_ptr, &png_chunks);
+
+    if(n_png_chunks != n_spng_chunks)
+    {
+        printf("unknown chunk count mismatch: %u(spng), %d(libpng)\n", n_spng_chunks, n_png_chunks);
+        ret = 1;
+        goto cleanup;
+    }
+
+    for(i=0; i < n_spng_chunks; i++)
+    {
+        if(spng_chunks[i].length != png_chunks[i].size)
+        {
+            printf("chunk[%d]: size mismatch %" PRIu64 "(spng) %" PRIu64" (libpng)\n", i, spng_chunks[i].length, png_chunks[i].size);
+            ret = 1;
+        }
+    }
+
+cleanup:
+    free(splt);
+    free(text);
+    free(spng_chunks);
+
+    return ret;
 }
 
 static int decode_and_compare(const char *filename, int fmt, int flags, int test_flags)
@@ -670,6 +722,8 @@ int main(int argc, char **argv)
        it emulates the behavior of their old PNG loader which used libpng. */
     add_test_case(SPNGT_FMT_VIPS, SPNG_DECODE_TRNS, 0);
 
+    printf("%d test cases\n", n_test_cases);
+
     int ret = 0;
     int i;
     for(i=0; i < n_test_cases; i++)