Coverage Report

Created: 2026-05-23 07:06

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/ffmpeg/libavutil/lzo.c
Line
Count
Source
1
/*
2
 * LZO 1x decompression
3
 * Copyright (c) 2006 Reimar Doeffinger
4
 *
5
 * This file is part of FFmpeg.
6
 *
7
 * FFmpeg is free software; you can redistribute it and/or
8
 * modify it under the terms of the GNU Lesser General Public
9
 * License as published by the Free Software Foundation; either
10
 * version 2.1 of the License, or (at your option) any later version.
11
 *
12
 * FFmpeg is distributed in the hope that it will be useful,
13
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15
 * Lesser General Public License for more details.
16
 *
17
 * You should have received a copy of the GNU Lesser General Public
18
 * License along with FFmpeg; if not, write to the Free Software
19
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20
 */
21
22
#include <limits.h>
23
#include <stdint.h>
24
#include <string.h>
25
26
#include "avassert.h"
27
#include "intreadwrite.h"
28
#include "lzo.h"
29
#include "macros.h"
30
#include "mem.h"
31
32
/// Define if we may write up to 12 bytes beyond the output buffer.
33
#define OUTBUF_PADDED 1
34
/// Define if we may read up to 8 bytes beyond the input buffer.
35
#define INBUF_PADDED 1
36
37
typedef struct LZOContext {
38
    const uint8_t *in, *in_end;
39
    uint8_t *out_start, *out, *out_end;
40
    int error;
41
} LZOContext;
42
43
/**
44
 * @brief Reads one byte from the input buffer, avoiding an overrun.
45
 * @return byte read
46
 */
47
static inline int get_byte(LZOContext *c)
48
7.20M
{
49
7.20M
    if (c->in < c->in_end)
50
7.20M
        return *c->in++;
51
4.20k
    c->error |= AV_LZO_INPUT_DEPLETED;
52
4.20k
    return 1;
53
7.20M
}
54
55
#ifdef INBUF_PADDED
56
2.97M
#define GETB(c) (*(c).in++)
57
#else
58
#define GETB(c) get_byte(&(c))
59
#endif
60
61
/**
62
 * @brief Decodes a length value in the coding used by lzo.
63
 * @param x previous byte value
64
 * @param mask bits used from x
65
 * @return decoded length value
66
 */
67
static inline int get_len(LZOContext *c, int x, int mask)
68
521k
{
69
521k
    int cnt = x & mask;
70
521k
    if (!cnt) {
71
7.20M
        while (!(x = get_byte(c))) {
72
7.09M
            if (cnt >= INT_MAX - 1000) {
73
0
                c->error |= AV_LZO_ERROR;
74
0
                break;
75
0
            }
76
7.09M
            cnt += 255;
77
7.09M
        }
78
118k
        cnt += mask + x;
79
118k
    }
80
521k
    return cnt;
81
521k
}
82
83
/**
84
 * @brief Copies bytes from input to output buffer with checking.
85
 * @param cnt number of bytes to copy, must be >= 0
86
 */
87
static inline void copy(LZOContext *c, int cnt)
88
1.20M
{
89
1.20M
    register const uint8_t *src = c->in;
90
1.20M
    register uint8_t *dst       = c->out;
91
1.20M
    av_assert0(cnt >= 0);
92
1.20M
    if (cnt > c->in_end - src) {
93
29.7k
        cnt       = FFMAX(c->in_end - src, 0);
94
29.7k
        c->error |= AV_LZO_INPUT_DEPLETED;
95
29.7k
    }
96
1.20M
    if (cnt > c->out_end - dst) {
97
11.1k
        cnt       = FFMAX(c->out_end - dst, 0);
98
11.1k
        c->error |= AV_LZO_OUTPUT_FULL;
99
11.1k
    }
100
1.20M
#if defined(INBUF_PADDED) && defined(OUTBUF_PADDED)
101
1.20M
    AV_COPY32U(dst, src);
102
1.20M
    src += 4;
103
1.20M
    dst += 4;
104
1.20M
    cnt -= 4;
105
1.20M
    if (cnt > 0)
106
86.7k
#endif
107
86.7k
    memcpy(dst, src, cnt);
108
1.20M
    c->in  = src + cnt;
109
1.20M
    c->out = dst + cnt;
110
1.20M
}
111
112
/**
113
 * @brief Copies previously decoded bytes to current position.
114
 * @param back how many bytes back we start, must be > 0
115
 * @param cnt number of bytes to copy, must be > 0
116
 *
117
 * cnt > back is valid, this will copy the bytes we just copied,
118
 * thus creating a repeating pattern with a period length of back.
119
 */
120
static inline void copy_backptr(LZOContext *c, int back, int cnt)
121
1.07M
{
122
1.07M
    register uint8_t *dst       = c->out;
123
1.07M
    av_assert0(cnt > 0);
124
1.07M
    if (dst - c->out_start < back) {
125
16.6k
        c->error |= AV_LZO_INVALID_BACKPTR;
126
16.6k
        return;
127
16.6k
    }
128
1.05M
    if (cnt > c->out_end - dst) {
129
16.7k
        cnt       = FFMAX(c->out_end - dst, 0);
130
16.7k
        c->error |= AV_LZO_OUTPUT_FULL;
131
16.7k
    }
132
1.05M
    av_memcpy_backptr(dst, back, cnt);
133
1.05M
    c->out = dst + cnt;
134
1.05M
}
135
136
int av_lzo1x_decode(void *out, int *outlen, const void *in, int *inlen)
137
167k
{
138
167k
    int state = 0;
139
167k
    int x;
140
167k
    LZOContext c;
141
167k
    if (*outlen <= 0 || *inlen <= 0) {
142
3.22k
        int res = 0;
143
3.22k
        if (*outlen <= 0)
144
1.51k
            res |= AV_LZO_OUTPUT_FULL;
145
3.22k
        if (*inlen <= 0)
146
2.84k
            res |= AV_LZO_INPUT_DEPLETED;
147
3.22k
        return res;
148
3.22k
    }
149
163k
    c.in      = in;
150
163k
    c.in_end  = (const uint8_t *)in + *inlen;
151
163k
    c.out     = c.out_start = out;
152
163k
    c.out_end = (uint8_t *)out + *outlen;
153
163k
    c.error   = 0;
154
163k
    x         = GETB(c);
155
163k
    if (x > 17) {
156
24.3k
        copy(&c, x - 17);
157
24.3k
        x = GETB(c);
158
24.3k
        if (x < 16)
159
6.63k
            c.error |= AV_LZO_ERROR;
160
24.3k
    }
161
163k
    if (c.in > c.in_end)
162
7.93k
        c.error |= AV_LZO_INPUT_DEPLETED;
163
1.30M
    while (!c.error) {
164
1.25M
        int cnt, back;
165
1.25M
        if (x > 15) {
166
1.06M
            if (x > 63) {
167
649k
                cnt  = (x >> 5) - 1;
168
649k
                back = (GETB(c) << 3) + ((x >> 2) & 7) + 1;
169
649k
            } else if (x > 31) {
170
270k
                cnt  = get_len(&c, x, 31);
171
270k
                x    = GETB(c);
172
270k
                back = (GETB(c) << 6) + (x >> 2) + 1;
173
270k
            } else {
174
144k
                cnt   = get_len(&c, x, 7);
175
144k
                back  = (1 << 14) + ((x & 8) << 11);
176
144k
                x     = GETB(c);
177
144k
                back += (GETB(c) << 6) + (x >> 2);
178
144k
                if (back == (1 << 14)) {
179
114k
                    if (cnt != 1)
180
1.21k
                        c.error |= AV_LZO_ERROR;
181
114k
                    break;
182
114k
                }
183
144k
            }
184
1.06M
        } else if (!state) {
185
107k
            cnt = get_len(&c, x, 15);
186
107k
            copy(&c, cnt + 3);
187
107k
            x = GETB(c);
188
107k
            if (x > 15)
189
63.5k
                continue;
190
43.7k
            cnt  = 1;
191
43.7k
            back = (1 << 11) + (GETB(c) << 2) + (x >> 2) + 1;
192
81.7k
        } else {
193
81.7k
            cnt  = 0;
194
81.7k
            back = (GETB(c) << 2) + (x >> 2) + 1;
195
81.7k
        }
196
1.07M
        copy_backptr(&c, back, cnt + 2);
197
1.07M
        state =
198
1.07M
        cnt   = x & 3;
199
1.07M
        copy(&c, cnt);
200
1.07M
        x = GETB(c);
201
1.07M
    }
202
163k
    *inlen = c.in_end - c.in;
203
163k
    if (c.in > c.in_end)
204
88.4k
        *inlen = 0;
205
163k
    *outlen = c.out_end - c.out;
206
163k
    return c.error;
207
167k
}