ERROR REPORTING: CRC errors in ancillary chunks may cancel the warning about a damaged chunk

[jbowler]

The meme used in pngrutil.c:

      png_crc_finish(png_ptr, length);
      png_chunk_benign_error(png_ptr, <description of error>);

Does not work well on a damaged PNG stream if the CRC errors are set to png_error out; this is the default. The damage is detected but png_crc_finish never returns (it calls png_error) so the useful information never gets output. Both png_crc_finish and png_chunk_benign_error can call png_error but by default png_chunk_benign_error does not do so on read (it does on write), whereas png_crc_finish does, by default call png_error (this can be turned off and often is.)

The calls should be done in the opposite order, indeed png_crc_finish is best called just once at the end of the png_handle_chnk function where possible.

[jbowler]

Of course swapping the two calls leaves the stream in a different position if png_chunk_benign_error errors out, but trying to read even to the CRC on a damaged stream may also cause the io to error out...

Perhaps better to extract all the cases into a simple function which just checks the CRC without error then calls png_chunk_error or png_chunk_warning according to either the CRC handling, if there is a CRC error or the auxiliary chunk error handling if no CRC error. That's the current behaviour (CRC first) but with a better, single, message.