Coverage Report

Created: 2024-01-20 12:28

/src/libjpeg-turbo.main/jdhuff.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * jdhuff.c
3
 *
4
 * This file was part of the Independent JPEG Group's software:
5
 * Copyright (C) 1991-1997, Thomas G. Lane.
6
 * Lossless JPEG Modifications:
7
 * Copyright (C) 1999, Ken Murchison.
8
 * libjpeg-turbo Modifications:
9
 * Copyright (C) 2009-2011, 2016, 2018-2019, 2022, D. R. Commander.
10
 * Copyright (C) 2018, Matthias Räncker.
11
 * For conditions of distribution and use, see the accompanying README.ijg
12
 * file.
13
 *
14
 * This file contains Huffman entropy decoding routines.
15
 *
16
 * Much of the complexity here has to do with supporting input suspension.
17
 * If the data source module demands suspension, we want to be able to back
18
 * up to the start of the current MCU.  To do this, we copy state variables
19
 * into local working storage, and update them back to the permanent
20
 * storage only upon successful completion of an MCU.
21
 *
22
 * NOTE: All referenced figures are from
23
 * Recommendation ITU-T T.81 (1992) | ISO/IEC 10918-1:1994.
24
 */
25
26
#define JPEG_INTERNALS
27
#include "jinclude.h"
28
#include "jpeglib.h"
29
#include "jdhuff.h"             /* Declarations shared with jd*huff.c */
30
#include "jpegapicomp.h"
31
#include "jstdhuff.c"
32
33
34
/*
35
 * Expanded entropy decoder object for Huffman decoding.
36
 *
37
 * The savable_state subrecord contains fields that change within an MCU,
38
 * but must not be updated permanently until we complete the MCU.
39
 */
40
41
typedef struct {
42
  int last_dc_val[MAX_COMPS_IN_SCAN]; /* last DC coef for each component */
43
} savable_state;
44
45
typedef struct {
46
  struct jpeg_entropy_decoder pub; /* public fields */
47
48
  /* These fields are loaded into local variables at start of each MCU.
49
   * In case of suspension, we exit WITHOUT updating them.
50
   */
51
  bitread_perm_state bitstate;  /* Bit buffer at start of MCU */
52
  savable_state saved;          /* Other state at start of MCU */
53
54
  /* These fields are NOT loaded into local working state. */
55
  unsigned int restarts_to_go;  /* MCUs left in this restart interval */
56
57
  /* Pointers to derived tables (these workspaces have image lifespan) */
58
  d_derived_tbl *dc_derived_tbls[NUM_HUFF_TBLS];
59
  d_derived_tbl *ac_derived_tbls[NUM_HUFF_TBLS];
60
61
  /* Precalculated info set up by start_pass for use in decode_mcu: */
62
63
  /* Pointers to derived tables to be used for each block within an MCU */
64
  d_derived_tbl *dc_cur_tbls[D_MAX_BLOCKS_IN_MCU];
65
  d_derived_tbl *ac_cur_tbls[D_MAX_BLOCKS_IN_MCU];
66
  /* Whether we care about the DC and AC coefficient values for each block */
67
  boolean dc_needed[D_MAX_BLOCKS_IN_MCU];
68
  boolean ac_needed[D_MAX_BLOCKS_IN_MCU];
69
} huff_entropy_decoder;
70
71
typedef huff_entropy_decoder *huff_entropy_ptr;
72
73
74
/*
75
 * Initialize for a Huffman-compressed scan.
76
 */
77
78
METHODDEF(void)
79
start_pass_huff_decoder(j_decompress_ptr cinfo)
80
181k
{
81
181k
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
82
181k
  int ci, blkn, dctbl, actbl;
83
181k
  d_derived_tbl **pdtbl;
84
181k
  jpeg_component_info *compptr;
85
86
  /* Check that the scan parameters Ss, Se, Ah/Al are OK for sequential JPEG.
87
   * This ought to be an error condition, but we make it a warning because
88
   * there are some baseline files out there with all zeroes in these bytes.
89
   */
90
181k
  if (cinfo->Ss != 0 || cinfo->Se != DCTSIZE2 - 1 ||
91
181k
      cinfo->Ah != 0 || cinfo->Al != 0)
92
145k
    WARNMS(cinfo, JWRN_NOT_SEQUENTIAL);
93
94
447k
  for (ci = 0; ci < cinfo->comps_in_scan; ci++) {
95
266k
    compptr = cinfo->cur_comp_info[ci];
96
266k
    dctbl = compptr->dc_tbl_no;
97
266k
    actbl = compptr->ac_tbl_no;
98
    /* Compute derived values for Huffman tables */
99
    /* We may do this more than once for a table, but it's not expensive */
100
266k
    pdtbl = (d_derived_tbl **)(entropy->dc_derived_tbls) + dctbl;
101
266k
    jpeg_make_d_derived_tbl(cinfo, TRUE, dctbl, pdtbl);
102
266k
    pdtbl = (d_derived_tbl **)(entropy->ac_derived_tbls) + actbl;
103
266k
    jpeg_make_d_derived_tbl(cinfo, FALSE, actbl, pdtbl);
104
    /* Initialize DC predictions to 0 */
105
266k
    entropy->saved.last_dc_val[ci] = 0;
106
266k
  }
107
108
  /* Precalculate decoding info for each block in an MCU of this scan */
109
628k
  for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
110
447k
    ci = cinfo->MCU_membership[blkn];
111
447k
    compptr = cinfo->cur_comp_info[ci];
112
    /* Precalculate which table to use for each block */
113
447k
    entropy->dc_cur_tbls[blkn] = entropy->dc_derived_tbls[compptr->dc_tbl_no];
114
447k
    entropy->ac_cur_tbls[blkn] = entropy->ac_derived_tbls[compptr->ac_tbl_no];
115
    /* Decide whether we really care about the coefficient values */
116
447k
    if (compptr->component_needed) {
117
439k
      entropy->dc_needed[blkn] = TRUE;
118
      /* we don't need the ACs if producing a 1/8th-size image */
119
439k
      entropy->ac_needed[blkn] = (compptr->_DCT_scaled_size > 1);
120
439k
    } else {
121
7.36k
      entropy->dc_needed[blkn] = entropy->ac_needed[blkn] = FALSE;
122
7.36k
    }
123
447k
  }
124
125
  /* Initialize bitread state variables */
126
181k
  entropy->bitstate.bits_left = 0;
127
181k
  entropy->bitstate.get_buffer = 0; /* unnecessary, but keeps Purify quiet */
128
181k
  entropy->pub.insufficient_data = FALSE;
129
130
  /* Initialize restart counter */
131
181k
  entropy->restarts_to_go = cinfo->restart_interval;
132
181k
}
133
134
135
/*
136
 * Compute the derived values for a Huffman table.
137
 * This routine also performs some validation checks on the table.
138
 *
139
 * Note this is also used by jdphuff.c and jdlhuff.c.
140
 */
141
142
GLOBAL(void)
143
jpeg_make_d_derived_tbl(j_decompress_ptr cinfo, boolean isDC, int tblno,
144
                        d_derived_tbl **pdtbl)
145
942k
{
146
942k
  JHUFF_TBL *htbl;
147
942k
  d_derived_tbl *dtbl;
148
942k
  int p, i, l, si, numsymbols;
149
942k
  int lookbits, ctr;
150
942k
  char huffsize[257];
151
942k
  unsigned int huffcode[257];
152
942k
  unsigned int code;
153
154
  /* Note that huffsize[] and huffcode[] are filled in code-length order,
155
   * paralleling the order of the symbols themselves in htbl->huffval[].
156
   */
157
158
  /* Find the input Huffman table */
159
942k
  if (tblno < 0 || tblno >= NUM_HUFF_TBLS)
160
480
    ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno);
161
942k
  htbl =
162
942k
    isDC ? cinfo->dc_huff_tbl_ptrs[tblno] : cinfo->ac_huff_tbl_ptrs[tblno];
163
942k
  if (htbl == NULL)
164
115
    ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno);
165
166
  /* Allocate a workspace if we haven't already done so. */
167
942k
  if (*pdtbl == NULL)
168
188k
    *pdtbl = (d_derived_tbl *)
169
188k
      (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
170
188k
                                  sizeof(d_derived_tbl));
171
942k
  dtbl = *pdtbl;
172
942k
  dtbl->pub = htbl;             /* fill in back link */
173
174
  /* Figure C.1: make table of Huffman code length for each symbol */
175
176
942k
  p = 0;
177
16.0M
  for (l = 1; l <= 16; l++) {
178
15.0M
    i = (int)htbl->bits[l];
179
15.0M
    if (i < 0 || p + i > 256)   /* protect against table overrun */
180
0
      ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
181
28.6M
    while (i--)
182
13.5M
      huffsize[p++] = (char)l;
183
15.0M
  }
184
942k
  huffsize[p] = 0;
185
942k
  numsymbols = p;
186
187
  /* Figure C.2: generate the codes themselves */
188
  /* We also validate that the counts represent a legal Huffman code tree. */
189
190
942k
  code = 0;
191
942k
  si = huffsize[0];
192
942k
  p = 0;
193
7.14M
  while (huffsize[p]) {
194
19.7M
    while (((int)huffsize[p]) == si) {
195
13.5M
      huffcode[p++] = code;
196
13.5M
      code++;
197
13.5M
    }
198
    /* code is now 1 more than the last code used for codelength si; but
199
     * it must still fit in si bits, since no code is allowed to be all ones.
200
     */
201
6.20M
    if (((JLONG)code) >= (((JLONG)1) << si))
202
51
      ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
203
6.20M
    code <<= 1;
204
6.20M
    si++;
205
6.20M
  }
206
207
  /* Figure F.15: generate decoding tables for bit-sequential decoding */
208
209
942k
  p = 0;
210
16.0M
  for (l = 1; l <= 16; l++) {
211
15.0M
    if (htbl->bits[l]) {
212
      /* valoffset[l] = huffval[] index of 1st symbol of code length l,
213
       * minus the minimum code of length l
214
       */
215
5.53M
      dtbl->valoffset[l] = (JLONG)p - (JLONG)huffcode[p];
216
5.53M
      p += htbl->bits[l];
217
5.53M
      dtbl->maxcode[l] = huffcode[p - 1]; /* maximum code of length l */
218
9.53M
    } else {
219
9.53M
      dtbl->maxcode[l] = -1;    /* -1 if no codes of this length */
220
9.53M
    }
221
15.0M
  }
222
942k
  dtbl->valoffset[17] = 0;
223
942k
  dtbl->maxcode[17] = 0xFFFFFL; /* ensures jpeg_huff_decode terminates */
224
225
  /* Compute lookahead tables to speed up decoding.
226
   * First we set all the table entries to 0, indicating "too long";
227
   * then we iterate through the Huffman codes that are short enough and
228
   * fill in all the entries that correspond to bit sequences starting
229
   * with that code.
230
   */
231
232
242M
  for (i = 0; i < (1 << HUFF_LOOKAHEAD); i++)
233
241M
    dtbl->lookup[i] = (HUFF_LOOKAHEAD + 1) << HUFF_LOOKAHEAD;
234
235
942k
  p = 0;
236
8.47M
  for (l = 1; l <= HUFF_LOOKAHEAD; l++) {
237
16.9M
    for (i = 1; i <= (int)htbl->bits[l]; i++, p++) {
238
      /* l = current code's length, p = its index in huffcode[] & huffval[]. */
239
      /* Generate left-justified code followed by all possible bit sequences */
240
9.39M
      lookbits = huffcode[p] << (HUFF_LOOKAHEAD - l);
241
237M
      for (ctr = 1 << (HUFF_LOOKAHEAD - l); ctr > 0; ctr--) {
242
228M
        dtbl->lookup[lookbits] = (l << HUFF_LOOKAHEAD) | htbl->huffval[p];
243
228M
        lookbits++;
244
228M
      }
245
9.39M
    }
246
7.53M
  }
247
248
  /* Validate symbols as being reasonable.
249
   * For AC tables, we make no check, but accept all byte values 0..255.
250
   * For DC tables, we require the symbols to be in range 0..15 in lossy mode
251
   * and 0..16 in lossless mode.  (Tighter bounds could be applied depending on
252
   * the data depth and mode, but this is sufficient to ensure safe decoding.)
253
   */
254
942k
  if (isDC) {
255
4.20M
    for (i = 0; i < numsymbols; i++) {
256
3.66M
      int sym = htbl->huffval[i];
257
3.66M
      if (sym < 0 || sym > (cinfo->master->lossless ? 16 : 15))
258
561
        ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
259
3.66M
    }
260
540k
  }
261
942k
}
262
263
264
/*
265
 * Out-of-line code for bit fetching (shared with jdphuff.c and jdlhuff.c).
266
 * See jdhuff.h for info about usage.
267
 * Note: current values of get_buffer and bits_left are passed as parameters,
268
 * but are returned in the corresponding fields of the state struct.
269
 *
270
 * On most machines MIN_GET_BITS should be 25 to allow the full 32-bit width
271
 * of get_buffer to be used.  (On machines with wider words, an even larger
272
 * buffer could be used.)  However, on some machines 32-bit shifts are
273
 * quite slow and take time proportional to the number of places shifted.
274
 * (This is true with most PC compilers, for instance.)  In this case it may
275
 * be a win to set MIN_GET_BITS to the minimum value of 15.  This reduces the
276
 * average shift distance at the cost of more calls to jpeg_fill_bit_buffer.
277
 */
278
279
#ifdef SLOW_SHIFT_32
280
#define MIN_GET_BITS  15        /* minimum allowable value */
281
#else
282
411M
#define MIN_GET_BITS  (BIT_BUF_SIZE - 7)
283
#endif
284
285
286
GLOBAL(boolean)
287
jpeg_fill_bit_buffer(bitread_working_state *state,
288
                     register bit_buf_type get_buffer, register int bits_left,
289
                     int nbits)
290
/* Load up the bit buffer to a depth of at least nbits */
291
111M
{
292
  /* Copy heavily used state fields into locals (hopefully registers) */
293
111M
  register const JOCTET *next_input_byte = state->next_input_byte;
294
111M
  register size_t bytes_in_buffer = state->bytes_in_buffer;
295
111M
  j_decompress_ptr cinfo = state->cinfo;
296
297
  /* Attempt to load at least MIN_GET_BITS bits into get_buffer. */
298
  /* (It is assumed that no request will be for more than that many bits.) */
299
  /* We fail to do so only if we hit a marker or are forced to suspend. */
300
301
111M
  if (cinfo->unread_marker == 0) {      /* cannot advance past a marker */
302
326M
    while (bits_left < MIN_GET_BITS) {
303
286M
      register int c;
304
305
      /* Attempt to read a byte */
306
286M
      if (bytes_in_buffer == 0) {
307
5.85k
        if (!(*cinfo->src->fill_input_buffer) (cinfo))
308
0
          return FALSE;
309
5.85k
        next_input_byte = cinfo->src->next_input_byte;
310
5.85k
        bytes_in_buffer = cinfo->src->bytes_in_buffer;
311
5.85k
      }
312
286M
      bytes_in_buffer--;
313
286M
      c = *next_input_byte++;
314
315
      /* If it's 0xFF, check and discard stuffed zero byte */
316
286M
      if (c == 0xFF) {
317
        /* Loop here to discard any padding FF's on terminating marker,
318
         * so that we can save a valid unread_marker value.  NOTE: we will
319
         * accept multiple FF's followed by a 0 as meaning a single FF data
320
         * byte.  This data pattern is not valid according to the standard.
321
         */
322
1.49M
        do {
323
1.49M
          if (bytes_in_buffer == 0) {
324
484
            if (!(*cinfo->src->fill_input_buffer) (cinfo))
325
0
              return FALSE;
326
484
            next_input_byte = cinfo->src->next_input_byte;
327
484
            bytes_in_buffer = cinfo->src->bytes_in_buffer;
328
484
          }
329
1.49M
          bytes_in_buffer--;
330
1.49M
          c = *next_input_byte++;
331
1.49M
        } while (c == 0xFF);
332
333
1.41M
        if (c == 0) {
334
          /* Found FF/00, which represents an FF data byte */
335
959k
          c = 0xFF;
336
959k
        } else {
337
          /* Oops, it's actually a marker indicating end of compressed data.
338
           * Save the marker code for later use.
339
           * Fine point: it might appear that we should save the marker into
340
           * bitread working state, not straight into permanent state.  But
341
           * once we have hit a marker, we cannot need to suspend within the
342
           * current MCU, because we will read no more bytes from the data
343
           * source.  So it is OK to update permanent state right away.
344
           */
345
451k
          cinfo->unread_marker = c;
346
          /* See if we need to insert some fake zero bits. */
347
451k
          goto no_more_bytes;
348
451k
        }
349
1.41M
      }
350
351
      /* OK, load c into get_buffer */
352
285M
      get_buffer = (get_buffer << 8) | c;
353
285M
      bits_left += 8;
354
285M
    } /* end while */
355
70.6M
  } else {
356
71.0M
no_more_bytes:
357
    /* We get here if we've read the marker that terminates the compressed
358
     * data segment.  There should be enough bits in the buffer register
359
     * to satisfy the request; if so, no problem.
360
     */
361
71.0M
    if (nbits > bits_left) {
362
      /* Uh-oh.  Report corrupted data to user and stuff zeroes into
363
       * the data stream, so that we can produce some kind of image.
364
       * We use a nonvolatile flag to ensure that only one warning message
365
       * appears per data segment.
366
       */
367
42.2M
      if (!cinfo->entropy->insufficient_data) {
368
458k
        WARNMS(cinfo, JWRN_HIT_MARKER);
369
458k
        cinfo->entropy->insufficient_data = TRUE;
370
458k
      }
371
      /* Fill the buffer with zero bits */
372
42.2M
      get_buffer <<= MIN_GET_BITS - bits_left;
373
42.2M
      bits_left = MIN_GET_BITS;
374
42.2M
    }
375
71.0M
  }
376
377
  /* Unload the local registers */
378
111M
  state->next_input_byte = next_input_byte;
379
111M
  state->bytes_in_buffer = bytes_in_buffer;
380
111M
  state->get_buffer = get_buffer;
381
111M
  state->bits_left = bits_left;
382
383
111M
  return TRUE;
384
111M
}
385
386
387
/* Macro version of the above, which performs much better but does not
388
   handle markers.  We have to hand off any blocks with markers to the
389
   slower routines. */
390
391
135M
#define GET_BYTE { \
392
135M
  register int c0, c1; \
393
135M
  c0 = *buffer++; \
394
135M
  c1 = *buffer; \
395
135M
  /* Pre-execute most common case */ \
396
135M
  get_buffer = (get_buffer << 8) | c0; \
397
135M
  bits_left += 8; \
398
135M
  if (c0 == 0xFF) { \
399
2.68M
    /* Pre-execute case of FF/00, which represents an FF data byte */ \
400
2.68M
    buffer++; \
401
2.68M
    if (c1 != 0) { \
402
2.22M
      /* Oops, it's actually a marker indicating end of compressed data. */ \
403
2.22M
      cinfo->unread_marker = c1; \
404
2.22M
      /* Back out pre-execution and fill the buffer with zero bits */ \
405
2.22M
      buffer -= 2; \
406
2.22M
      get_buffer &= ~0xFF; \
407
2.22M
    } \
408
2.68M
  } \
409
135M
}
410
411
#if SIZEOF_SIZE_T == 8 || defined(_WIN64) || (defined(__x86_64__) && defined(__ILP32__))
412
413
/* Pre-fetch 48 bytes, because the holding register is 64-bit */
414
#define FILL_BIT_BUFFER_FAST \
415
284M
  if (bits_left <= 16) { \
416
22.6M
    GET_BYTE GET_BYTE GET_BYTE GET_BYTE GET_BYTE GET_BYTE \
417
22.6M
  }
418
419
#else
420
421
/* Pre-fetch 16 bytes, because the holding register is 32-bit */
422
#define FILL_BIT_BUFFER_FAST \
423
  if (bits_left <= 16) { \
424
    GET_BYTE GET_BYTE \
425
  }
426
427
#endif
428
429
430
/*
431
 * Out-of-line code for Huffman code decoding.
432
 * See jdhuff.h for info about usage.
433
 */
434
435
GLOBAL(int)
436
jpeg_huff_decode(bitread_working_state *state,
437
                 register bit_buf_type get_buffer, register int bits_left,
438
                 d_derived_tbl *htbl, int min_bits)
439
30.1M
{
440
30.1M
  register int l = min_bits;
441
30.1M
  register JLONG code;
442
443
  /* HUFF_DECODE has determined that the code is at least min_bits */
444
  /* bits long, so fetch that many bits in one swoop. */
445
446
30.1M
  CHECK_BIT_BUFFER(*state, l, return -1);
447
30.1M
  code = GET_BITS(l);
448
449
  /* Collect the rest of the Huffman code one bit at a time. */
450
  /* This is per Figure F.16. */
451
452
52.7M
  while (code > htbl->maxcode[l]) {
453
22.5M
    code <<= 1;
454
22.5M
    CHECK_BIT_BUFFER(*state, 1, return -1);
455
22.5M
    code |= GET_BITS(1);
456
22.5M
    l++;
457
22.5M
  }
458
459
  /* Unload the local registers */
460
30.1M
  state->get_buffer = get_buffer;
461
30.1M
  state->bits_left = bits_left;
462
463
  /* With garbage input we may reach the sentinel value l = 17. */
464
465
30.1M
  if (l > 16) {
466
901k
    WARNMS(state->cinfo, JWRN_HUFF_BAD_CODE);
467
901k
    return 0;                   /* fake a zero as the safest result */
468
901k
  }
469
470
29.2M
  return htbl->pub->huffval[(int)(code + htbl->valoffset[l])];
471
30.1M
}
472
473
474
/*
475
 * Figure F.12: extend sign bit.
476
 * On some machines, a shift and add will be faster than a table lookup.
477
 */
478
479
#define AVOID_TABLES
480
#ifdef AVOID_TABLES
481
482
183M
#define NEG_1  ((unsigned int)-1)
483
#define HUFF_EXTEND(x, s) \
484
183M
  ((x) + ((((x) - (1 << ((s) - 1))) >> 31) & (((NEG_1) << (s)) + 1)))
485
486
#else
487
488
#define HUFF_EXTEND(x, s) \
489
  ((x) < extend_test[s] ? (x) + extend_offset[s] : (x))
490
491
static const int extend_test[16] = {   /* entry n is 2**(n-1) */
492
  0, 0x0001, 0x0002, 0x0004, 0x0008, 0x0010, 0x0020, 0x0040, 0x0080,
493
  0x0100, 0x0200, 0x0400, 0x0800, 0x1000, 0x2000, 0x4000
494
};
495
496
static const int extend_offset[16] = { /* entry n is (-1 << n) + 1 */
497
  0, ((-1) << 1) + 1, ((-1) << 2) + 1, ((-1) << 3) + 1, ((-1) << 4) + 1,
498
  ((-1) << 5) + 1, ((-1) << 6) + 1, ((-1) << 7) + 1, ((-1) << 8) + 1,
499
  ((-1) << 9) + 1, ((-1) << 10) + 1, ((-1) << 11) + 1, ((-1) << 12) + 1,
500
  ((-1) << 13) + 1, ((-1) << 14) + 1, ((-1) << 15) + 1
501
};
502
503
#endif /* AVOID_TABLES */
504
505
506
/*
507
 * Check for a restart marker & resynchronize decoder.
508
 * Returns FALSE if must suspend.
509
 */
510
511
LOCAL(boolean)
512
process_restart(j_decompress_ptr cinfo)
513
12.0M
{
514
12.0M
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
515
12.0M
  int ci;
516
517
  /* Throw away any unused bits remaining in bit buffer; */
518
  /* include any full bytes in next_marker's count of discarded bytes */
519
12.0M
  cinfo->marker->discarded_bytes += entropy->bitstate.bits_left / 8;
520
12.0M
  entropy->bitstate.bits_left = 0;
521
522
  /* Advance past the RSTn marker */
523
12.0M
  if (!(*cinfo->marker->read_restart_marker) (cinfo))
524
0
    return FALSE;
525
526
  /* Re-initialize DC predictions to 0 */
527
24.6M
  for (ci = 0; ci < cinfo->comps_in_scan; ci++)
528
12.5M
    entropy->saved.last_dc_val[ci] = 0;
529
530
  /* Reset restart counter */
531
12.0M
  entropy->restarts_to_go = cinfo->restart_interval;
532
533
  /* Reset out-of-data flag, unless read_restart_marker left us smack up
534
   * against a marker.  In that case we will end up treating the next data
535
   * segment as empty, and we can avoid producing bogus output pixels by
536
   * leaving the flag set.
537
   */
538
12.0M
  if (cinfo->unread_marker == 0)
539
41.0k
    entropy->pub.insufficient_data = FALSE;
540
541
12.0M
  return TRUE;
542
12.0M
}
543
544
545
#if defined(__has_feature)
546
#if __has_feature(undefined_behavior_sanitizer)
547
__attribute__((no_sanitize("signed-integer-overflow"),
548
               no_sanitize("unsigned-integer-overflow")))
549
#endif
550
#endif
551
LOCAL(boolean)
552
decode_mcu_slow(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
553
732k
{
554
732k
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
555
732k
  BITREAD_STATE_VARS;
556
732k
  int blkn;
557
732k
  savable_state state;
558
  /* Outer loop handles each block in the MCU */
559
560
  /* Load up working state */
561
732k
  BITREAD_LOAD_STATE(cinfo, entropy->bitstate);
562
732k
  state = entropy->saved;
563
564
3.01M
  for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
565
2.28M
    JBLOCKROW block = MCU_data ? MCU_data[blkn] : NULL;
566
2.28M
    d_derived_tbl *dctbl = entropy->dc_cur_tbls[blkn];
567
2.28M
    d_derived_tbl *actbl = entropy->ac_cur_tbls[blkn];
568
2.28M
    register int s, k, r;
569
570
    /* Decode a single block's worth of coefficients */
571
572
    /* Section F.2.2.1: decode the DC coefficient difference */
573
2.28M
    HUFF_DECODE(s, br_state, dctbl, return FALSE, label1);
574
2.28M
    if (s) {
575
1.70M
      CHECK_BIT_BUFFER(br_state, s, return FALSE);
576
1.70M
      r = GET_BITS(s);
577
1.70M
      s = HUFF_EXTEND(r, s);
578
1.70M
    }
579
580
2.28M
    if (entropy->dc_needed[blkn]) {
581
      /* Convert DC difference to actual value, update last_dc_val */
582
2.21M
      int ci = cinfo->MCU_membership[blkn];
583
      /* Certain malformed JPEG images produce repeated DC coefficient
584
       * differences of 2047 or -2047, which causes state.last_dc_val[ci] to
585
       * grow until it overflows or underflows a 32-bit signed integer.  This
586
       * behavior is, to the best of our understanding, innocuous, and it is
587
       * unclear how to work around it without potentially affecting
588
       * performance.  Thus, we (hopefully temporarily) suppress UBSan integer
589
       * overflow errors for this function and decode_mcu_fast().
590
       */
591
2.21M
      s += state.last_dc_val[ci];
592
2.21M
      state.last_dc_val[ci] = s;
593
2.21M
      if (block) {
594
        /* Output the DC coefficient (assumes jpeg_natural_order[0] = 0) */
595
2.21M
        (*block)[0] = (JCOEF)s;
596
2.21M
      }
597
2.21M
    }
598
599
2.28M
    if (entropy->ac_needed[blkn] && block) {
600
601
      /* Section F.2.2.2: decode the AC coefficients */
602
      /* Since zeroes are skipped, output area must be cleared beforehand */
603
55.0M
      for (k = 1; k < DCTSIZE2; k++) {
604
54.1M
        HUFF_DECODE(s, br_state, actbl, return FALSE, label2);
605
606
54.1M
        r = s >> 4;
607
54.1M
        s &= 15;
608
609
54.1M
        if (s) {
610
52.6M
          k += r;
611
52.6M
          CHECK_BIT_BUFFER(br_state, s, return FALSE);
612
52.6M
          r = GET_BITS(s);
613
52.6M
          s = HUFF_EXTEND(r, s);
614
          /* Output coefficient in natural (dezigzagged) order.
615
           * Note: the extra entries in jpeg_natural_order[] will save us
616
           * if k >= DCTSIZE2, which could happen if the data is corrupted.
617
           */
618
52.6M
          (*block)[jpeg_natural_order[k]] = (JCOEF)s;
619
52.6M
        } else {
620
1.49M
          if (r != 15)
621
1.33M
            break;
622
157k
          k += 15;
623
157k
        }
624
54.1M
      }
625
626
2.21M
    } else {
627
628
      /* Section F.2.2.2: decode the AC coefficients */
629
      /* In this path we just discard the values */
630
2.65M
      for (k = 1; k < DCTSIZE2; k++) {
631
2.61M
        HUFF_DECODE(s, br_state, actbl, return FALSE, label3);
632
633
2.61M
        r = s >> 4;
634
2.61M
        s &= 15;
635
636
2.61M
        if (s) {
637
2.58M
          k += r;
638
2.58M
          CHECK_BIT_BUFFER(br_state, s, return FALSE);
639
2.58M
          DROP_BITS(s);
640
2.58M
        } else {
641
33.7k
          if (r != 15)
642
32.1k
            break;
643
1.61k
          k += 15;
644
1.61k
        }
645
2.61M
      }
646
74.7k
    }
647
2.28M
  }
648
649
  /* Completed MCU, so update state */
650
732k
  BITREAD_SAVE_STATE(cinfo, entropy->bitstate);
651
732k
  entropy->saved = state;
652
732k
  return TRUE;
653
732k
}
654
655
656
#if defined(__has_feature)
657
#if __has_feature(undefined_behavior_sanitizer)
658
__attribute__((no_sanitize("signed-integer-overflow"),
659
               no_sanitize("unsigned-integer-overflow")))
660
#endif
661
#endif
662
LOCAL(boolean)
663
decode_mcu_fast(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
664
4.54M
{
665
4.54M
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
666
4.54M
  BITREAD_STATE_VARS;
667
4.54M
  JOCTET *buffer;
668
4.54M
  int blkn;
669
4.54M
  savable_state state;
670
  /* Outer loop handles each block in the MCU */
671
672
  /* Load up working state */
673
4.54M
  BITREAD_LOAD_STATE(cinfo, entropy->bitstate);
674
4.54M
  buffer = (JOCTET *)br_state.next_input_byte;
675
4.54M
  state = entropy->saved;
676
677
18.8M
  for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
678
14.2M
    JBLOCKROW block = MCU_data ? MCU_data[blkn] : NULL;
679
14.2M
    d_derived_tbl *dctbl = entropy->dc_cur_tbls[blkn];
680
14.2M
    d_derived_tbl *actbl = entropy->ac_cur_tbls[blkn];
681
14.2M
    register int s, k, r, l;
682
683
14.2M
    HUFF_DECODE_FAST(s, l, dctbl);
684
14.2M
    if (s) {
685
10.2M
      FILL_BIT_BUFFER_FAST
686
10.2M
      r = GET_BITS(s);
687
10.2M
      s = HUFF_EXTEND(r, s);
688
10.2M
    }
689
690
14.2M
    if (entropy->dc_needed[blkn]) {
691
13.9M
      int ci = cinfo->MCU_membership[blkn];
692
      /* Refer to the comment in decode_mcu_slow() regarding the supression of
693
       * a UBSan integer overflow error in this line of code.
694
       */
695
13.9M
      s += state.last_dc_val[ci];
696
13.9M
      state.last_dc_val[ci] = s;
697
13.9M
      if (block)
698
13.9M
        (*block)[0] = (JCOEF)s;
699
13.9M
    }
700
701
14.2M
    if (entropy->ac_needed[blkn] && block) {
702
703
132M
      for (k = 1; k < DCTSIZE2; k++) {
704
131M
        HUFF_DECODE_FAST(s, l, actbl);
705
131M
        r = s >> 4;
706
131M
        s &= 15;
707
708
131M
        if (s) {
709
118M
          k += r;
710
118M
          FILL_BIT_BUFFER_FAST
711
118M
          r = GET_BITS(s);
712
118M
          s = HUFF_EXTEND(r, s);
713
118M
          (*block)[jpeg_natural_order[k]] = (JCOEF)s;
714
118M
        } else {
715
12.4M
          if (r != 15) break;
716
307k
          k += 15;
717
307k
        }
718
131M
      }
719
720
13.9M
    } else {
721
722
5.40M
      for (k = 1; k < DCTSIZE2; k++) {
723
5.31M
        HUFF_DECODE_FAST(s, l, actbl);
724
5.31M
        r = s >> 4;
725
5.31M
        s &= 15;
726
727
5.31M
        if (s) {
728
5.09M
          k += r;
729
5.09M
          FILL_BIT_BUFFER_FAST
730
5.09M
          DROP_BITS(s);
731
5.09M
        } else {
732
221k
          if (r != 15) break;
733
906
          k += 15;
734
906
        }
735
5.31M
      }
736
314k
    }
737
14.2M
  }
738
739
4.54M
  if (cinfo->unread_marker != 0) {
740
113k
    cinfo->unread_marker = 0;
741
113k
    return FALSE;
742
113k
  }
743
744
4.43M
  br_state.bytes_in_buffer -= (buffer - br_state.next_input_byte);
745
4.43M
  br_state.next_input_byte = buffer;
746
4.43M
  BITREAD_SAVE_STATE(cinfo, entropy->bitstate);
747
4.43M
  entropy->saved = state;
748
4.43M
  return TRUE;
749
4.54M
}
750
751
752
/*
753
 * Decode and return one MCU's worth of Huffman-compressed coefficients.
754
 * The coefficients are reordered from zigzag order into natural array order,
755
 * but are not dequantized.
756
 *
757
 * The i'th block of the MCU is stored into the block pointed to by
758
 * MCU_data[i].  WE ASSUME THIS AREA HAS BEEN ZEROED BY THE CALLER.
759
 * (Wholesale zeroing is usually a little faster than retail...)
760
 *
761
 * Returns FALSE if data source requested suspension.  In that case no
762
 * changes have been made to permanent state.  (Exception: some output
763
 * coefficients may already have been assigned.  This is harmless for
764
 * this module, since we'll just re-assign them on the next call.)
765
 */
766
767
88.3M
#define BUFSIZE  (DCTSIZE2 * 8)
768
769
METHODDEF(boolean)
770
decode_mcu(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
771
88.3M
{
772
88.3M
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
773
88.3M
  int usefast = 1;
774
775
  /* Process restart marker if needed; may have to suspend */
776
88.3M
  if (cinfo->restart_interval) {
777
54.0M
    if (entropy->restarts_to_go == 0)
778
12.0M
      if (!process_restart(cinfo))
779
0
        return FALSE;
780
54.0M
    usefast = 0;
781
54.0M
  }
782
783
88.3M
  if (cinfo->src->bytes_in_buffer < BUFSIZE * (size_t)cinfo->blocks_in_MCU ||
784
88.3M
      cinfo->unread_marker != 0)
785
83.5M
    usefast = 0;
786
787
  /* If we've run out of data, just leave the MCU set to zeroes.
788
   * This way, we return uniform gray for the remainder of the segment.
789
   */
790
88.3M
  if (!entropy->pub.insufficient_data) {
791
792
5.16M
    if (usefast) {
793
4.54M
      if (!decode_mcu_fast(cinfo, MCU_data)) goto use_slow;
794
4.54M
    } else {
795
732k
use_slow:
796
732k
      if (!decode_mcu_slow(cinfo, MCU_data)) return FALSE;
797
732k
    }
798
799
5.16M
  }
800
801
  /* Account for restart interval (no-op if not using restarts) */
802
88.3M
  if (cinfo->restart_interval)
803
54.0M
    entropy->restarts_to_go--;
804
805
88.3M
  return TRUE;
806
88.3M
}
807
808
809
/*
810
 * Module initialization routine for Huffman entropy decoding.
811
 */
812
813
GLOBAL(void)
814
jinit_huff_decoder(j_decompress_ptr cinfo)
815
36.0k
{
816
36.0k
  huff_entropy_ptr entropy;
817
36.0k
  int i;
818
819
  /* Motion JPEG frames typically do not include the Huffman tables if they
820
     are the default tables.  Thus, if the tables are not set by the time
821
     the Huffman decoder is initialized (usually within the body of
822
     jpeg_start_decompress()), we set them to default values. */
823
36.0k
  std_huff_tables((j_common_ptr)cinfo);
824
825
36.0k
  entropy = (huff_entropy_ptr)
826
36.0k
    (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
827
36.0k
                                sizeof(huff_entropy_decoder));
828
36.0k
  cinfo->entropy = (struct jpeg_entropy_decoder *)entropy;
829
36.0k
  entropy->pub.start_pass = start_pass_huff_decoder;
830
36.0k
  entropy->pub.decode_mcu = decode_mcu;
831
832
  /* Mark tables unallocated */
833
180k
  for (i = 0; i < NUM_HUFF_TBLS; i++) {
834
144k
    entropy->dc_derived_tbls[i] = entropy->ac_derived_tbls[i] = NULL;
835
144k
  }
836
36.0k
}