Coverage Report

Created: 2026-11-12 07:19

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/dcmtk/dcmjpeg/libijg8/jdhuff.c
Line
Count
Source
1
/*
2
 * jdhuff.c
3
 *
4
 * Copyright (C) 1991-1998, Thomas G. Lane.
5
 * This file is part of the Independent JPEG Group's software.
6
 * For conditions of distribution and use, see the accompanying README file.
7
 *
8
 * This file contains Huffman entropy decoding routines which are shared
9
 * by the sequential, progressive and lossless decoders.
10
 */
11
12
#define JPEG_INTERNALS
13
#include "jinclude8.h"
14
#include "jpeglib8.h"
15
#include "jlossy8.h"        /* Private declarations for lossy codec */
16
#include "jlossls8.h"       /* Private declarations for lossless codec */
17
#include "jdhuff8.h"        /* Declarations shared with jd*huff.c */
18
19
20
/*
21
 * Compute the derived values for a Huffman table.
22
 * This routine also performs some validation checks on the table.
23
 */
24
25
GLOBAL(void)
26
jpeg_make_d_derived_tbl (j_decompress_ptr cinfo, boolean isDC, int tblno,
27
             d_derived_tbl ** pdtbl)
28
0
{
29
0
  JHUFF_TBL *htbl;
30
0
  d_derived_tbl *dtbl;
31
0
  int p, i, l, si, numsymbols;
32
0
  int lookbits, ctr;
33
0
  char huffsize[257];
34
0
  unsigned int huffcode[257];
35
0
  unsigned int code;
36
37
  /* Note that huffsize[] and huffcode[] are filled in code-length order,
38
   * paralleling the order of the symbols themselves in htbl->huffval[].
39
   */
40
41
  /* Find the input Huffman table */
42
0
  if (tblno < 0 || tblno >= NUM_HUFF_TBLS)
43
0
    ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno);
44
0
  htbl =
45
0
    isDC ? cinfo->dc_huff_tbl_ptrs[tblno] : cinfo->ac_huff_tbl_ptrs[tblno];
46
0
  if (htbl == NULL)
47
0
    ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno);
48
49
  /* Allocate a workspace if we haven't already done so. */
50
0
  if (*pdtbl == NULL)
51
0
    *pdtbl = (d_derived_tbl *)
52
0
      (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE,
53
0
                  SIZEOF(d_derived_tbl));
54
0
  dtbl = *pdtbl;
55
0
  dtbl->pub = htbl;     /* fill in back link */
56
57
  /* Figure C.1: make table of Huffman code length for each symbol */
58
59
0
  p = 0;
60
0
  for (l = 1; l <= 16; l++) {
61
0
    i = (int) htbl->bits[l];
62
0
    if (i < 0 || p + i > 256)   /* protect against table overrun */
63
0
      ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
64
0
    while (i--)
65
0
      huffsize[p++] = (char) l;
66
0
  }
67
0
  huffsize[p] = 0;
68
0
  numsymbols = p;
69
70
  /* Figure C.2: generate the codes themselves */
71
  /* We also validate that the counts represent a legal Huffman code tree. */
72
73
0
  code = 0;
74
0
  si = huffsize[0];
75
0
  p = 0;
76
0
  while (huffsize[p]) {
77
0
    while (((int) huffsize[p]) == si) {
78
0
      huffcode[p++] = code;
79
0
      code++;
80
0
    }
81
    /* code is now 1 more than the last code used for codelength si; but
82
     * it must still fit in si bits, since no code is allowed to be all ones.
83
     * BUG FIX: Comparison must be >, not >=
84
     */
85
0
    if (((IJG_INT32) code) > (((IJG_INT32) 1) << si))
86
0
      ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
87
0
    code <<= 1;
88
0
    si++;
89
0
  }
90
91
  /* Figure F.15: generate decoding tables for bit-sequential decoding */
92
93
0
  p = 0;
94
0
  for (l = 1; l <= 16; l++) {
95
0
    if (htbl->bits[l]) {
96
      /* valoffset[l] = huffval[] index of 1st symbol of code length l,
97
       * minus the minimum code of length l
98
       */
99
0
      dtbl->valoffset[l] = (IJG_INT32) p - (IJG_INT32) huffcode[p];
100
0
      p += htbl->bits[l];
101
0
      dtbl->maxcode[l] = (IJG_INT32)huffcode[p-1]; /* maximum code of length l */
102
0
    } else {
103
0
      dtbl->maxcode[l] = -1;    /* -1 if no codes of this length */
104
0
    }
105
0
  }
106
0
  dtbl->maxcode[17] = 0xFFFFFL; /* ensures jpeg_huff_decode terminates */
107
108
  /* Compute lookahead tables to speed up decoding.
109
   * First we set all the table entries to 0, indicating "too long";
110
   * then we iterate through the Huffman codes that are short enough and
111
   * fill in all the entries that correspond to bit sequences starting
112
   * with that code.
113
   */
114
115
0
  MEMZERO(dtbl->look_nbits, SIZEOF(dtbl->look_nbits));
116
117
0
  p = 0;
118
0
  for (l = 1; l <= HUFF_LOOKAHEAD; l++) {
119
0
    for (i = 1; i <= (int) htbl->bits[l]; i++, p++) {
120
      /* l = current code's length, p = its index in huffcode[] & huffval[]. */
121
      /* Generate left-justified code followed by all possible bit sequences */
122
0
      lookbits = (int)huffcode[p] << (HUFF_LOOKAHEAD-l);
123
0
      for (ctr = 1 << (HUFF_LOOKAHEAD-l); ctr > 0; ctr--) {
124
0
    dtbl->look_nbits[lookbits] = l;
125
0
    dtbl->look_sym[lookbits] = htbl->huffval[p];
126
0
    lookbits++;
127
0
      }
128
0
    }
129
0
  }
130
131
  /* Validate symbols as being reasonable.
132
   * For AC tables, we make no check, but accept all byte values 0..255.
133
   * For DC tables, we require the symbols to be in range 0..16.
134
   * (Tighter bounds could be applied depending on the data depth and mode,
135
   * but this is sufficient to ensure safe decoding.)
136
   */
137
0
  if (isDC) {
138
0
    for (i = 0; i < numsymbols; i++) {
139
0
      int sym = htbl->huffval[i];
140
0
      if (sym < 0 || sym > 16)
141
#ifdef DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK
142
    ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
143
#else
144
0
    TRACEMS1(cinfo, 1, JTRC_UNOPT_HUFF_TABLE, sym);
145
0
#endif
146
0
    }
147
0
  }
148
0
}
149
150
151
/*
152
 * Out-of-line code for bit fetching.
153
 * See jdhuff.h for info about usage.
154
 * Note: current values of get_buffer and bits_left are passed as parameters,
155
 * but are returned in the corresponding fields of the state struct.
156
 *
157
 * On most machines MIN_GET_BITS should be 25 to allow the full 32-bit width
158
 * of get_buffer to be used.  (On machines with wider words, an even larger
159
 * buffer could be used.)  However, on some machines 32-bit shifts are
160
 * quite slow and take time proportional to the number of places shifted.
161
 * (This is true with most PC compilers, for instance.)  In this case it may
162
 * be a win to set MIN_GET_BITS to the minimum value of 15.  This reduces the
163
 * average shift distance at the cost of more calls to jpeg_fill_bit_buffer.
164
 */
165
166
#ifdef SLOW_SHIFT_32
167
#define MIN_GET_BITS  15    /* minimum allowable value */
168
#else
169
0
#define MIN_GET_BITS  (BIT_BUF_SIZE-7)
170
#endif
171
172
173
GLOBAL(boolean)
174
jpeg_fill_bit_buffer (bitread_working_state * state,
175
              register bit_buf_type get_buffer, register int bits_left,
176
              int nbits)
177
/* Load up the bit buffer to a depth of at least nbits */
178
0
{
179
  /* Copy heavily used state fields into locals (hopefully registers) */
180
0
  register const JOCTET * next_input_byte = state->next_input_byte;
181
0
  register size_t bytes_in_buffer = state->bytes_in_buffer;
182
0
  j_decompress_ptr cinfo = state->cinfo;
183
184
  /* Attempt to load at least MIN_GET_BITS bits into get_buffer. */
185
  /* (It is assumed that no request will be for more than that many bits.) */
186
  /* We fail to do so only if we hit a marker or are forced to suspend. */
187
188
0
  if (cinfo->unread_marker == 0) {  /* cannot advance past a marker */
189
0
    while (bits_left < MIN_GET_BITS) {
190
0
      register int c;
191
192
      /* Attempt to read a byte */
193
0
      if (bytes_in_buffer == 0) {
194
0
    if (! (*cinfo->src->fill_input_buffer) (cinfo))
195
0
      return FALSE;
196
0
    next_input_byte = cinfo->src->next_input_byte;
197
0
    bytes_in_buffer = cinfo->src->bytes_in_buffer;
198
0
      }
199
0
      bytes_in_buffer--;
200
0
      c = GETJOCTET(*next_input_byte++);
201
202
      /* If it's 0xFF, check and discard stuffed zero byte */
203
0
      if (c == 0xFF) {
204
    /* Loop here to discard any padding FF's on terminating marker,
205
     * so that we can save a valid unread_marker value.  NOTE: we will
206
     * accept multiple FF's followed by a 0 as meaning a single FF data
207
     * byte.  This data pattern is not valid according to the standard.
208
     */
209
0
    do {
210
0
      if (bytes_in_buffer == 0) {
211
0
        if (! (*cinfo->src->fill_input_buffer) (cinfo))
212
0
          return FALSE;
213
0
        next_input_byte = cinfo->src->next_input_byte;
214
0
        bytes_in_buffer = cinfo->src->bytes_in_buffer;
215
0
      }
216
0
      bytes_in_buffer--;
217
0
      c = GETJOCTET(*next_input_byte++);
218
0
    } while (c == 0xFF);
219
220
0
    if (c == 0) {
221
      /* Found FF/00, which represents an FF data byte */
222
0
      c = 0xFF;
223
0
    } else {
224
      /* Oops, it's actually a marker indicating end of compressed data.
225
       * Save the marker code for later use.
226
       * Fine point: it might appear that we should save the marker into
227
       * bitread working state, not straight into permanent state.  But
228
       * once we have hit a marker, we cannot need to suspend within the
229
       * current MCU, because we will read no more bytes from the data
230
       * source.  So it is OK to update permanent state right away.
231
       */
232
0
      cinfo->unread_marker = c;
233
      /* See if we need to insert some fake zero bits. */
234
0
      goto no_more_bytes;
235
0
    }
236
0
      }
237
238
      /* OK, load c into get_buffer */
239
0
      get_buffer = (get_buffer << 8) | c;
240
0
      bits_left += 8;
241
0
    } /* end while */
242
0
  } else {
243
0
  no_more_bytes:
244
    /* We get here if we've read the marker that terminates the compressed
245
     * data segment.  There should be enough bits in the buffer register
246
     * to satisfy the request; if so, no problem.
247
     */
248
0
    if (nbits > bits_left) {
249
      /* Uh-oh.  Report corrupted data to user and stuff zeroes into
250
       * the data stream, so that we can produce some kind of image.
251
       * We use a nonvolatile flag to ensure that only one warning message
252
       * appears per data segment.
253
       */
254
0
      huffd_common_ptr huffd;
255
0
      if (cinfo->process == JPROC_LOSSLESS)
256
0
    huffd = (huffd_common_ptr) ((j_lossless_d_ptr) cinfo->codec)->entropy_private;
257
0
      else
258
0
    huffd = (huffd_common_ptr) ((j_lossy_d_ptr) cinfo->codec)->entropy_private;
259
0
      if (! huffd->insufficient_data) {
260
0
    WARNMS(cinfo, JWRN_HIT_MARKER);
261
0
    huffd->insufficient_data = TRUE;
262
0
      }
263
      /* Fill the buffer with zero bits */
264
0
      get_buffer <<= MIN_GET_BITS - bits_left;
265
0
      bits_left = MIN_GET_BITS;
266
0
    }
267
0
  }
268
269
  /* Unload the local registers */
270
0
  state->next_input_byte = next_input_byte;
271
0
  state->bytes_in_buffer = bytes_in_buffer;
272
0
  state->get_buffer = get_buffer;
273
0
  state->bits_left = bits_left;
274
275
0
  return TRUE;
276
0
}
277
278
279
/*
280
 * Out-of-line code for Huffman code decoding.
281
 * See jdhuff.h for info about usage.
282
 */
283
284
GLOBAL(int)
285
jpeg_huff_decode (bitread_working_state * state,
286
          register bit_buf_type get_buffer, register int bits_left,
287
          d_derived_tbl * htbl, int min_bits)
288
0
{
289
0
  register int l = min_bits;
290
0
  register IJG_INT32 code;
291
292
  /* HUFF_DECODE has determined that the code is at least min_bits */
293
  /* bits long, so fetch that many bits in one swoop. */
294
295
0
  CHECK_BIT_BUFFER(*state, l, return -1);
296
0
  code = GET_BITS(l);
297
298
  /* Collect the rest of the Huffman code one bit at a time. */
299
  /* This is per Figure F.16 in the JPEG spec. */
300
301
0
  while (code > htbl->maxcode[l]) {
302
0
    code <<= 1;
303
0
    CHECK_BIT_BUFFER(*state, 1, return -1);
304
0
    code |= GET_BITS(1);
305
0
    l++;
306
0
  }
307
308
  /* Unload the local registers */
309
0
  state->get_buffer = get_buffer;
310
0
  state->bits_left = bits_left;
311
312
  /* With garbage input we may reach the sentinel value l = 17. */
313
314
0
  if (l > 16) {
315
0
    WARNMS(state->cinfo, JWRN_HUFF_BAD_CODE);
316
0
    return 0;           /* fake a zero as the safest result */
317
0
  }
318
319
0
  return htbl->pub->huffval[ (int) (code + htbl->valoffset[l]) ];
320
0
}