`PNG_LIBPNG_VER_BUILD` should be zero for public releases and non-zero
for development versions. The ci_verify_version.sh script should check
this requirement as such.

Work around a limitation in the `shellcheck source` directive, which
does not recognize quotes in shellcheck versions older than 0.9.

Also extend the checks for YAML files over the entire source tree, in
preparation for the introduction of the GitHub Actions config file.

By definition, `sizeof(png_byte)` is 1.

Remove all the occurences of `sizeof(png_byte)` from the code, and fix
a related typo in the libpng manual.

Also update the main .editorconfig file to reflect the fixing expected
by a FIXME note.

Introduce the environment option CI_FORCE:
 * ci_verify_configure.sh is known to fail if an existing build
   configuration is found in the top-level directory.
   Setting CI_FORCE=1 will run `make distclean` before verification.
 * ci_verify_makefiles.sh cannot be reliably executed if random
   object files are found in the top-level directory.
   Setting CI_FORCE=1 will run `rm *.o *.obj` before verification.
 * ci_verify_cmake.sh is not known at this time to fail for similar
   reasons; but if it does, we will use CI_FORCE to trigger any
   necessary pre-build cleanup.

The variable `CI_LINT_COUNTER` was incremented inside subshells, but
remained unchanged in the main shell process. The errors detected by
the internal linters remained unreported by the main script. (Oopsie!)

Besides fixing this defect, considering that only a pass/fail status
is needed, we are replacing `CI_LINT_COUNTER` with `CI_LINT_STATUS`.

This fixes commit dddaf0c.

The way to reliably `find` executable files is different on BSD, Mac
and Linux, unfortunately.

This fixes commit 4edbb4d.

During the move of CMake scripts to the scripts/cmake/ subdirectory,
some of the workflows have been broken.

Signed-off-by: Cosmin Truta <[email protected]>

Update the PNG_TOOLS option: set it to OFF by default when the
target is an embedded system, yet still allow it to be overridden.

Update the PNG_FRAMEWORK option: force it back to OFF and print a
warning if the option was ON but the target is not an Apple system.

Add nawk to the list of AWK-processing programs that are known to work,
and show the search result in the CMake log.

Declare AWK explicitly via the AC_ARG_VAR directive, in order to make
it "precious", and to include it in the list of influential variables
at the end of the configure help text.

Rephrase a few comments and config traces.

Finally, regenerate the configure script.

In the configure script, checking whether the LoongArch LSX intrinsics
are supported by the compiler was done unconditionally, regardless of
the targetted host platform. Compared to how we support the other SIMD
platforms and compilers, this is rather unconventional.

We are placing this check under the guard of its own platform, for the
time being. A full solution, in line with the rest of the configure.ac
patterns concering SIMD optimizations, is TODO.

We also do an overall cleanup in the SIMD section of configure.ac, and,
finally, we regenerate the configure script.

Modern compilers can disable the warnings that originate from system
headers. This change allows them to do so with the libpng headers.

Signed-off-by: Cosmin Truta <[email protected]>

We used this experimental project in the development of the PNG-EXIF
("eXIf") specification, back in 2017. The project evolved together
with the draft specification, which was finalized on 2017-Jun-15 and
approved by the PNG Group on 2017-Jul-13.

The EXIF specification, outside of the scope of PNG and libpng, is
quite complex. The libpng implementation cannot grow too much beyond
performing basic integrity checks on top of serialization. In order
to create and manipulate PNG-EXIF image files, the use of external
libraries and tools such as ExifTool is necessary.

Now, with the addition of contrib/pngexif to the libpng repository,
offline tasks like metadata inspection and linting can be performed
without importing external dependencies.

The release tags are redundant in the CI process. It is the main branch
that is always verified.

This fixes the bug #505
"libpng does not support PAC/BTI on aarch64 targets" which arises
because the build mechanisms (both cmake and configure) assemble
arm/filter_neon.S even though it ends up completely empty.  The empty
file effectively poisons the so that the PAC/BTI support gets disabled.

The fix is minimal; it simply removes arm/filter_neon.S from the list of
sources included in the 64-bit ARM builds build.  Note that this was
already done in cmake for MSVC - it's not clear whether this change was
a partial fix for the same issue.

This version of the fix ONLY affects aarch64 (arm64) builds; 32-bit ARM
systems can still invoke the assembler if required and, indeed, there
should be no change whatsover to those builds.

The assembler code could not be used on 64-bit systems in any case so
in practice there is no material change to 64-bit builds either.

TESTING: pull the changes then type "autoreconf" if using configure (not
required for cmake).

TESTS: cmake has not been tested because cross-builds with cmake
currently fail to find the zlib installation from the cmake system root
path.  The following has been tested with configure cross builds:

armv7-linux-gnueabi [no neon support]
armv7a-linux-gnueabi [no neon support]
armv7a-hardfloat-linux-gnueabi [neon support not enabled]
armv7a-hardfloat-linux-gnueabi -mfpu=neon [uses intrinics]
armv7a-hardfloat-linux-gnueabi -mfpu=neon
        -DPNG_ARM_NEON_IMPLEMENTATION=2 [uses assembler]
aarch64-linux-gnu [uses intrinsics]
aarch64-linux-gnu -DPNG_ARM_NEON_OPT=0 [neon support disabled]

Signed-off-by: John Bowler <[email protected]>

This file contains hand-coded assembler implementations of the filter
functions for 32-bit Arm platforms.  These are only used when the
compiler doesn't support neon intrinsics (added to GCC 4.3 in 2008) or
is exactly GCC 4.5.4 (released 2012), both of which are sufficiently
unlikely to be true that it's fair to say the assembler is no longer
used.

This commit deletes filter_neon.S and removes the now obsolete
preprocessor logic in pngpriv.h.

Signed-off-by: Bill Roberts <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

In the previous commit 9e53875
we removed the obsolete assembler implementation `filter_neon.S`.

In this commit we add a stand-in for the original file, restoring
the original source tree structure, for the benefit of continuing
hassle-free libpng source upgrades in the 1.6.x line.

Initialize the arch-specific MSYSTEM environment variable, to ensure
that msys2 bash picks up and executes /etc/profile correctly.

Install and use the host-specific cmake and ninja, to ensure that
msys2 cmake picks up the host-specific zlib build correctly.

Because of a missing "amd64" string (in lowercase) in a regex match,
the CMake build was unable to pick up the PNG_HARDWARE_OPTIMIZATIONS
flag on FreeBSD/amd64 (and possibly other amd64 systems as well).

Rename the target arch variable from TARGET_ARCH to a more idiomatic
PNG_TARGET_ARCHITECTURE, and set it to an always-lowercase string.
The follow-on checks are now simpler and easier to get right.

Signed-off-by: Cosmin Truta <[email protected]>

Considering that a non-trivial amount of libpng code is arch-specific,
we should perform cross-platform builds (with cross-platform toolchains)
and test runs (on emulated architectures) in our routine verification.

The content of ci/targets/ shall consist of target description files,
written in the standard shell language. These files may be source'd as
needed, before running the verification scripts ci/ci_verify_*.sh.

Here is the initial list of target systems:
Android, Cygwin, FreeBSD, Linux, MSDOS, Windows.

And here is the initial list of target architectures:
ARM, MIPS, PowerPC, RISC-V, x86.

ACES AP1 has a red endpoint with a negative Z, this triggers the checks
in libpng that ensure that x, y and z (chromaticities) are all >=0.
This removes the checks on the sign of the chromaticities since it is
valid to use negative values for any of them and converts the "internal"
error code return to external (because the internal cases correspond to
negative x, y or z.)

Reviewed-by: Cosmin Truta <[email protected]>
Signed-off-by: John Bowler <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

In "test: Add consistency checks for the PNG_LIBPNG_VER* number" [0] the
`STDERR` macro was moved from outside an `ifdef` to inside an `ifdef`.
This broke the code in the `else` of this `ifdef` which also uses the
`STDERR` macro. Move `STDERR` back to where it was to avoid compile
errors in the `else` case.

[0] cc8006c

Fixes: #560
Reviewed-by: Cosmin Truta <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

Going forward, we will continue developing and using ci/ci_lint.sh

Going forward, we will continue to verify the cmake build and the
configure build with the hardware optimizations enabled by default,
and the makefile build with the hardware optimizations disabled by
default.

The Travis CI configuration file is simpler, and, more importantly,
the Travis CI verification process will be shorter and cheaper.

Co-authored-by: Cosmin Truta <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

New target added to libpng_read_fuzzer.cc for simplified READ API.

Properly declare target include directories for generated includes.
Previously the non targeted `include_directories()` was used, which
had issue when using the `png_static` target in a submodule.

Signed-off-by: Cosmin Truta <[email protected]>

…ctories"

This reverts commit 1d1cc9a.

The verification has failed. (Oopsie!)

Properly declare target include directories for generated includes.
Previously the non targeted `include_directories()` was used, which
had issue when using the `png_static` target in a submodule.

Signed-off-by: Cosmin Truta <[email protected]>

In `png_xy_from_XYZ` X+Y+Z was calculated without checking for overflow.
This fixes that by moving the correct code from `png_XYZ_normalize` into
a static function which is now used from `png_xy_from_XYZ`.

Reviewed-by: Cosmin Truta <[email protected]>
Signed-off-by: John Bowler <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

A new repository named "pngfuzz", dedicated to fuzz testing PNG
processing software in general and libpng in particular, has been
created:

https://github.com/pnggroup/pngfuzz

Signed-off-by: Cosmin Truta <[email protected]>

Ignore the files and the directories that are typically produced by
text editors, development tools, development environments, etc.

This is a cherry-pick of commit 050aa7b
from branch 'libpng18'.

Also add an .editorconfig-checker.json file. We need to instruct the
editorconfig-checker program to skip the checks for the indent size.
(As of this commit time, editorconfig-checker is too rigid to recognize
"smart indentations".)

This is a cherry-pick of commit 67c99f7
from branch 'libpng18'.

Co-authored-by: John Bowler <[email protected]>
Signed-off-by: John Bowler <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

As the editorconfig-checker program is transitioning from using
the .ecrc config file to the .editorconfig-checker.json config file,
the older program versions do not recognize the new config file name.

Update ci_lint.sh to instruct editorconfig-checker to pick up its
configuration from the new config file name, regardless of the program
version.

Also update ci_lint.sh to instruct yamllint to check all *.json files,
including .editorconfig-checker.json.

This is a cherry-pick of commit 77f8833
from branch 'libpng18'.

…epo"

This reverts commit b7276ec.

Although the brand new pngfuzz repo is coming up next, it turned out
that the deletion of contrib/oss-fuzz/ from the 'libpng16' branch was
premature. (Oopsie!)

Signed-off-by: Cosmin Truta <[email protected]>

…ld script"

This reverts commit 3117b5f.

A regression was introduced. (Oopsie!)

Signed-off-by: Cosmin Truta <[email protected]>

This corrects the checks to that libpng 10800 does not turn on the
enhanced transform checks in either pngvalid or pngstest.  The correct
fix is to change the 10700 code for comments which explain what aspect
or aspects of the transforms are broken (ideally) or at least state that
the transforms are broken.

This is a cherry-pick of commit aec888a
from branch 'libpng18'.

Reviewed-by: Cosmin Truta <[email protected]>
Signed-off-by: John Bowler <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

Adjust the warning levels across the entire solution in order to tidy
up the build log.

Also remove the vestigial macro definition _USRDLL and add the missing
macro definition _CRT_SECURE_NO_WARNINGS.

This is a cherry-pick of commit 719705a
from branch 'libpng18'.

Add projects/vstudio/build.bat, a wrapper for `devenv [...] /build`.

This is a cherry-pick of commit f1c01b5
from branch 'libpng18'.

Ignore artifacts produced by IDEs such as Embarcadero RAD Studio,
JetBrains Fleet, Qt Creator, and possibly others.

Also update the list of artifacts produced by C/C++ workflows and
CMake workflows in Microsoft Visual Studio and Qt Creator.

This is a cherry-pick of commit 10c76f3
from branch 'libpng18'.

The MIPS MSA code contains // comments and the use of an "asm"
directive, neither of which are part of ISO-C90.  This removes the //
comments and converts asm to __asm__, which GCC allows.

The code compiles but maintenance is required; it's not clear it will
work on anything other than one specific compiler/isa combination.  It
should be rewritten using intrinsics, not assembler; as it stands it is
a security risk.

This is a cherry-pick of commit bd39ebb
from branch 'libpng18'.

Co-authored-by: Cosmin Truta <[email protected]>
Reviewed-by: Chris Blume <[email protected]>
Signed-off-by: John Bowler <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

The subtracts in PNG_XYZ_from_xy are producing integer overflow with
some valid but extreme xy values.  This re-introduces the previous
checks, but with less limited bounds; sufficient to accomodate the
ACEScg end points (ACES AP1), but not for the ACES AP0 end points.
Those were not working anyway because libpng reads the cHRM parameters
as unsigned values, so they must always be at least 0.

A better solution requires recognizing reasonable negative values (ones
which violate the current spec) and allowing them too, at least on read.

Reviewed-by: Cosmin Truta <[email protected]>
Signed-off-by: John Bowler <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

…sics

This changes the arm/palette_neon_intrinsics.c code from using a bare
cast to using the portable macro `png_aligncastconst`.  This removes
the `-Wcast-align` warning.

The cast is safe because the pointer was allocated by `malloc(1024)`,
and `malloc` is required to return a pointer with sufficient alignment
for anything the allocation can accomodate.

Nevertheless, this is a quick and dirty fix; the use of `png_bytep` in
the `png_struct` declaration of the pointer is machine-specific.  Other
architectures may need different types and, consequently, the only type
which is portable to other companies' CPUs is `(void*)`.

This is a cherry-pick of commit a604b12
from branch 'libpng18'.

Reviewed-by: Cosmin Truta <[email protected]>
Signed-off-by: John Bowler <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

Start using the features guaranteed to be available in CMake 3.14.
Specifically, use the ability of `find_package(ZLIB)` to pick up zlib
from the ZLIB_ROOT variable (if given).

This is a cherry-pick of commit 00343a7
from branch 'libpng18'.

This is a cherry-pick of commit 2e416c6
from branch 'libpng18'.

Due to raising the minimum CMake version to 3.14, we can now run the
CMake build verification (ci_verify_cmake.sh) from the libpng source
dir, just as in the other scripts (ci_verify_*.sh). This is possible
thanks to the modern CMake command options `cmake -B` and `cmake -S`.

We can finally simplify the implementation of ci_verify_cmake.sh by
removing a code complication that was annoying, and yet, necessary in
peculiar Bash-on-Windows setups.

Fun fact:
CMake version 3.14 was released on 2019-03-14. Reportedly, on purpose!

This is a cherry-pick of commit 558dfbb
from branch 'libpng18'.

Allow ci_verify_configure.sh to pass regardless whether the configure
script and the associated configure control files are present.
This is necessary for the branches newer than 'libpng16', where these
artifacts are no longer auto-generated by default.

This is a cherry-pick of commit 09ec97e
from branch 'libpng18'.

The code erroneously evaluated `addend0+addend1` in the case where
`addend1` is less than zero.  The function is meant to subtract the
second argument from the first.

This is a cherry-pick of commit 79fd6d1
from branch 'libpng18'.

Reviewed-by: Cosmin Truta <[email protected]>
Signed-off-by: John Bowler <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

The leading blank lines are apparently an artefact of an older source
control system.  They are not required and they look like accidents,
because starting a source file with a blank line is not a regular habit
of software developers nowadays.

This is a cherry-pick of commit 37cc20a
from branch 'libpng18'.

Signed-off-by: John Bowler <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

Introduce CMake file linting, based on the cmakelang project by
Josh Bialkowski (@cheshirekow).

Fix various style issues in the CMake files:
 * Add the missing copyright header to PNGConfig.cmake.
 * Resolve a "missing docstring" warning raised by cmake-lint.
 * Rewrite all docstrings in the style of CMake's own documentation.
 * Fix whitespace inconsistencies.

References:
 * https://pypi.org/project/cmakelang
 * https://github.com/cheshirekow/cmake_format

This is a cherry-pick of commit c317fe3
from branch 'libpng18'.

Resolve the indentation issues raised by cmake-lint on a fragment of
CMakeLists.txt that no longer exists in branch 'libpng18'.

This is a cherry-picked of commit f45531c
from branch 'libpng18'.

Reviewed-by: Cosmin Truta <[email protected]>
Signed-off-by: John Bowler <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

…ilure

Disable the check on `interlace_method` inside function `compare_read`
in pngimage.c, if WRITE_INTERLACING is not supported.

If interlaced encoding is disabled inside libpng, the encoded images
are non-interlaced silently and unconditionally.  This commit updates
the image comparison to skip the interlace check in the resultant
image; other behavior is still checked.

This is a cherry-pick of commit d9f13d8
from branch 'libpng18'.

Reviewed-by: Cosmin Truta <[email protected]>
Signed-off-by: John Bowler <[email protected]>
Signed-off-by: Cosmin Truta <[email protected]>

Move the definitions of interlace arrays to the top of their respective
translation units, to reduce their repeated copying in various places of
the codebase.

TODO:
As they still exist in three copies, in pngpread.c, in pngrutil.c, and
in pngwutil.c, they should all be further moved to a common place.

This is a cherry-pick of commit 620a2b7
from branch 'libpng18'.

Embarcadero's compilers, old (Borland-based) and new (Clang-based),
do have full support for Standard C. The Clang-based compiler is
claiming, through the macro __STDC_VERSION__, to support C99 and C11,
whereas the Borland-based compiler supports ANSI C, as it has for
decades.

However, their run-time library is exposing global functions beyond
the scope of Standard C, for backwards compatibility with the older
Borland products. One of these functions is `randomize`, which clashes
with a function inside pngvalid.c that incidentally has the same name.

Building libpng in "Strict ANSI C" mode, in which all Borland-specific
globals are hidden (e.g. via `bcc32 -A`), would have been a workable
solution for the Borland-based ANSI C compiler, but no such solution
appears to exist for the Clang-based C90/C99/C11 compiler.

Fortunately, renaming a private function inside a test program is a
cost-free alternative fix.

This is a cherry-pick of commit 6184164
from branch 'libpng18'.