Coverage Report

Created: 2025-06-10 06:59

/src/ghostpdl/base/sdctd.c
Line
Count
Source (jump to first uncovered line)
1
/* Copyright (C) 2001-2023 Artifex Software, Inc.
2
   All Rights Reserved.
3
4
   This software is provided AS-IS with no warranty, either express or
5
   implied.
6
7
   This software is distributed under license and may not be copied,
8
   modified or distributed except as expressly authorized under the terms
9
   of the license contained in the file LICENSE in this distribution.
10
11
   Refer to licensing information at http://www.artifex.com or contact
12
   Artifex Software, Inc.,  39 Mesa Street, Suite 108A, San Francisco,
13
   CA 94129, USA, for further information.
14
*/
15
16
17
/* DCT decoding filter stream */
18
#include "memory_.h"
19
#include "stdio_.h"
20
#include "jpeglib_.h"
21
#include "jerror_.h"
22
#include "gdebug.h"
23
#include "gsmemory.h"
24
#include "strimpl.h"
25
#include "sdct.h"
26
#include "sjpeg.h"
27
28
/* ------ DCTDecode ------ */
29
30
/* JPEG source manager procedures */
31
static void
32
dctd_init_source(j_decompress_ptr dinfo)
33
614
{
34
614
}
35
static const JOCTET fake_eoi[2] =
36
{0xFF, JPEG_EOI};
37
static boolean
38
dctd_fill_input_buffer(j_decompress_ptr dinfo)
39
6.26k
{
40
6.26k
    jpeg_decompress_data *jddp =
41
6.26k
    (jpeg_decompress_data *) ((char *)dinfo -
42
6.26k
                              offset_of(jpeg_decompress_data, dinfo));
43
44
6.26k
    if (!jddp->input_eod)
45
6.22k
        return FALSE;    /* normal case: suspend processing */
46
    /* Reached end of source data without finding EOI */
47
45
    WARNMS(dinfo, JWRN_JPEG_EOF);
48
    /* Insert a fake EOI marker */
49
45
    dinfo->src->next_input_byte = fake_eoi;
50
45
    dinfo->src->bytes_in_buffer = 2;
51
45
    jddp->faked_eoi = true; /* so process routine doesn't use next_input_byte */
52
45
    return TRUE;
53
6.26k
}
54
static void
55
dctd_skip_input_data(j_decompress_ptr dinfo, long num_bytes)
56
311
{
57
311
    struct jpeg_source_mgr *src = dinfo->src;
58
311
    jpeg_decompress_data *jddp =
59
311
    (jpeg_decompress_data *) ((char *)dinfo -
60
311
                              offset_of(jpeg_decompress_data, dinfo));
61
62
311
    if (num_bytes > 0) {
63
311
        if (num_bytes > src->bytes_in_buffer) {
64
221
            jddp->skip += num_bytes - src->bytes_in_buffer;
65
221
            src->next_input_byte += src->bytes_in_buffer;
66
221
            src->bytes_in_buffer = 0;
67
221
            return;
68
221
        }
69
90
        src->next_input_byte += num_bytes;
70
90
        src->bytes_in_buffer -= num_bytes;
71
90
    }
72
311
}
73
74
static void
75
dctd_term_source(j_decompress_ptr dinfo)
76
324
{
77
324
    jpeg_decompress_data *jddp =
78
324
    (jpeg_decompress_data *) ((char *)dinfo -
79
324
                              offset_of(jpeg_decompress_data, dinfo));
80
81
324
    stream_dct_end_passthrough(jddp);
82
324
    return;
83
324
}
84
85
/* Set the defaults for the DCTDecode filter. */
86
static void
87
s_DCTD_set_defaults(stream_state * st)
88
618
{
89
618
    s_DCT_set_defaults(st);
90
618
}
91
92
/* Initialize DCTDecode filter */
93
static int
94
s_DCTD_init(stream_state * st)
95
618
{
96
618
    stream_DCT_state *const ss = (stream_DCT_state *) st;
97
618
    struct jpeg_source_mgr *src = &ss->data.decompress->source;
98
99
618
    src->init_source = dctd_init_source;
100
618
    src->fill_input_buffer = dctd_fill_input_buffer;
101
618
    src->skip_input_data = dctd_skip_input_data;
102
618
    src->term_source = dctd_term_source;
103
618
    src->resync_to_restart = jpeg_resync_to_restart;  /* use default method */
104
618
    ss->data.common->memory = ss->jpeg_memory;
105
618
    ss->data.decompress->dinfo.src = src;
106
618
    ss->data.decompress->skip = 0;
107
618
    ss->data.decompress->input_eod = false;
108
618
    ss->data.decompress->faked_eoi = false;
109
618
    ss->phase = 0;
110
618
    return 0;
111
618
}
112
113
static int
114
compact_jpeg_buffer(stream_cursor_read *pr)
115
0
{
116
0
    byte *o, *i;
117
118
    /* Search backwards from the end for 2 consecutive 0xFFs */
119
0
    o = (byte *)pr->limit;
120
0
    while (o - pr->ptr >= 2) {
121
0
        if (*o-- == 0xFF) {
122
0
            if (*o == 0xFF)
123
0
                goto compact;
124
0
            o--;
125
0
        }
126
0
    }
127
0
    return 0;
128
0
compact:
129
0
    i = o-1;
130
0
    do {
131
        /* Skip i backwards over 0xFFs */
132
0
        while ((i != pr->ptr) && (*i == 0xFF))
133
0
            i--;
134
        /* Repeatedly copy from i to o */
135
0
        while (i != pr->ptr) {
136
0
            byte c = *i--;
137
0
            *o-- = c;
138
0
            if (c == 0xFF)
139
0
                break;
140
0
        }
141
0
    } while (i != pr->ptr);
142
143
0
    pr->ptr = o;
144
0
    return o - i;
145
0
}
146
147
static void
148
update_jpeg_header_height(JOCTET *d, size_t len, int height)
149
1.35k
{
150
1.35k
    int marker_len;
151
152
4.63k
    for (d += 2; len > 9 && d[0] == 0xFF; d += marker_len)
153
3.48k
    {
154
3.48k
        int declared_height;
155
156
3.48k
        marker_len = 2 + (d[2] << 8) + d[3];
157
3.48k
        if (marker_len > len)
158
204
            break;
159
3.28k
        len -= marker_len;
160
161
        /* We can only safely rewrite non-differential SOF markers */
162
3.28k
        if (d[1] < 0xC0 || (0xC3 < d[1] && d[1] < 0xC9) || 0xCB < d[1])
163
2.88k
            continue;
164
165
395
        declared_height = (d[5]<<8) | d[6];
166
395
        if (declared_height == 0 || declared_height > height)
167
7
        {
168
7
            d[5] = height>>8;
169
7
            d[6] = height;
170
7
        }
171
395
    }
172
1.35k
}
173
174
/* Process a buffer */
175
static int
176
s_DCTD_process(stream_state * st, stream_cursor_read * pr,
177
               stream_cursor_write * pw, bool last)
178
144k
{
179
144k
    stream_DCT_state *const ss = (stream_DCT_state *) st;
180
144k
    jpeg_decompress_data *jddp = ss->data.decompress;
181
144k
    struct jpeg_source_mgr *src = jddp->dinfo.src;
182
144k
    int code;
183
144k
    byte *Buf;
184
185
144k
    if_debug3m('w', st->memory, "[wdd]process avail=%u, skip=%u, last=%d\n",
186
144k
               (uint) (pr->limit - pr->ptr), (uint) jddp->skip, last);
187
144k
    if (jddp->skip != 0) {
188
854
        long avail = pr->limit - pr->ptr;
189
190
854
        if (avail < jddp->skip) {
191
642
            if (jddp->PassThrough && jddp->PassThroughfn)
192
0
                (jddp->PassThroughfn)(jddp->device, (byte *)pr->ptr + 1, (byte *)pr->limit - (byte *)pr->ptr);
193
194
642
            jddp->skip -= avail;
195
642
            pr->ptr = pr->limit;
196
642
            if (!last)
197
638
                return 0;  /* need more data */
198
4
            jddp->skip = 0; /* don't skip past input EOD */
199
4
        }
200
216
        Buf = (byte *)pr->ptr + 1;
201
216
        pr->ptr += jddp->skip;
202
216
        if (jddp->PassThrough && jddp->PassThroughfn)
203
0
            (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
204
205
216
        jddp->skip = 0;
206
216
    }
207
143k
    src->next_input_byte = pr->ptr + 1;
208
143k
    src->bytes_in_buffer = pr->limit - pr->ptr;
209
143k
    Buf = (byte *)pr->ptr + 1;
210
143k
    jddp->input_eod = last;
211
143k
    switch (ss->phase) {
212
1.23k
        case 0:   /* not initialized yet */
213
            /*
214
             * Adobe implementations seem to ignore leading garbage bytes,
215
             * even though neither the standard nor Adobe's own
216
             * documentation mention this.
217
             */
218
1.23k
            if (jddp->PassThrough && jddp->PassThroughfn && !jddp->StartedPassThrough) {
219
0
                jddp->StartedPassThrough = 1;
220
0
                (jddp->PassThroughfn)(jddp->device, NULL, 1);
221
0
            }
222
1.23k
            while (pr->ptr < pr->limit && pr->ptr[1] != 0xff)
223
0
                pr->ptr++;
224
1.23k
            if (pr->ptr == pr->limit) {
225
618
                if (jddp->PassThrough && jddp->PassThroughfn)
226
0
                    (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
227
618
                return 0;
228
618
            }
229
614
            src->next_input_byte = pr->ptr + 1;
230
614
            src->bytes_in_buffer = pr->limit - pr->ptr;
231
614
            ss->phase = 1;
232
            /* falls through */
233
1.35k
        case 1:   /* reading header markers */
234
1.35k
            if (ss->data.common->Height != 0)
235
1.35k
            {
236
               /* Deliberate and naughty. We cast away a const pointer
237
                * here and write to a supposedly read-only stream. */
238
1.35k
                union { const byte *c; byte *u; } u;
239
1.35k
                u.c = pr->ptr+1;
240
1.35k
                update_jpeg_header_height(u.u, src->bytes_in_buffer, ss->data.common->Height);
241
1.35k
            }
242
1.35k
            if ((code = gs_jpeg_read_header(ss, TRUE)) < 0) {
243
222
                code = ERRC;
244
222
                goto error_out;
245
222
            }
246
1.13k
            pr->ptr =
247
1.13k
                (jddp->faked_eoi ? pr->limit : src->next_input_byte - 1);
248
1.13k
            switch (code) {
249
742
                case JPEG_SUSPENDED:
250
742
                    if (jddp->PassThrough && jddp->PassThroughfn)
251
0
                        (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
252
742
                    return 0;
253
                    /*case JPEG_HEADER_OK: */
254
1.13k
            }
255
256
            /*
257
             * Default the color transform if not set and check for
258
             * the Adobe marker and use Adobe's transform if the
259
             * marker is set.
260
             */
261
390
            if (ss->ColorTransform == -1) {
262
390
                if (jddp->dinfo.num_components == 3)
263
332
                    ss->ColorTransform = 1;
264
58
                else
265
58
                    ss->ColorTransform = 0;
266
390
            }
267
268
390
            if (jddp->dinfo.saw_Adobe_marker)
269
170
                ss->ColorTransform = jddp->dinfo.Adobe_transform;
270
271
390
            switch (jddp->dinfo.num_components) {
272
332
            case 3:
273
332
                jddp->dinfo.jpeg_color_space =
274
332
                    (ss->ColorTransform ? JCS_YCbCr : JCS_RGB);
275
                        /* out_color_space will default to JCS_RGB */
276
332
                        break;
277
32
            case 4:
278
32
                jddp->dinfo.jpeg_color_space =
279
32
                    (ss->ColorTransform ? JCS_YCCK : JCS_CMYK);
280
                /* out_color_space will default to JCS_CMYK */
281
32
                break;
282
390
            }
283
390
            ss->phase = 2;
284
            /* falls through */
285
475
        case 2:   /* start_decompress */
286
475
            if ((code = gs_jpeg_start_decompress(ss)) < 0) {
287
4
                code = ERRC;
288
4
                goto error_out;
289
4
            }
290
471
            pr->ptr =
291
471
                (jddp->faked_eoi ? pr->limit : src->next_input_byte - 1);
292
471
            if (code == 0) {
293
85
                if (jddp->PassThrough && jddp->PassThroughfn)
294
0
                    (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
295
85
                return 0;
296
85
            }
297
386
            ss->scan_line_size =
298
386
                jddp->dinfo.output_width * jddp->dinfo.output_components;
299
386
            if_debug4m('w', ss->memory, "[wdd]width=%u, components=%d, scan_line_size=%u, min_out_size=%u\n",
300
386
                       jddp->dinfo.output_width,
301
386
                       jddp->dinfo.output_components,
302
386
                       ss->scan_line_size, jddp->templat.min_out_size);
303
386
            if (ss->scan_line_size > (uint) jddp->templat.min_out_size) {
304
                /* Create a spare buffer for oversize scanline */
305
23
                jddp->scanline_buffer =
306
23
                    gs_alloc_bytes_immovable(gs_memory_stable(jddp->memory),
307
23
                                             ss->scan_line_size,
308
23
                                         "s_DCTD_process(scanline_buffer)");
309
23
                if (jddp->scanline_buffer == NULL) {
310
0
                    code = ERRC;
311
0
                    goto error_out;
312
0
                }
313
23
            }
314
386
            jddp->bytes_in_scanline = 0;
315
386
            ss->phase = 3;
316
            /* falls through */
317
141k
        case 3:   /* reading data */
318
182k
          dumpbuffer:
319
182k
            if (jddp->bytes_in_scanline != 0) {
320
108k
                uint avail = pw->limit - pw->ptr;
321
108k
                uint tomove = min(jddp->bytes_in_scanline,
322
108k
                                  avail);
323
324
108k
                if_debug2m('w', ss->memory, "[wdd]moving %u/%u\n",
325
108k
                           tomove, avail);
326
108k
                memcpy(pw->ptr + 1, jddp->scanline_buffer +
327
108k
                       (ss->scan_line_size - jddp->bytes_in_scanline),
328
108k
                       tomove);
329
108k
                pw->ptr += tomove;
330
108k
                jddp->bytes_in_scanline -= tomove;
331
                /* calculate room after the copy,
332
                 * PXL typically provides room 1 exactly 1 scan, so avail == 0
333
                 * PDF/PS provide enough room, so avail >= 0
334
                 * XPS provides room ro complete image, and expects complet image copied
335
                 * PCL,PXL,PDF,PS copy 1 scan at a time.
336
                 */
337
108k
                avail -= tomove;
338
108k
                if ((jddp->bytes_in_scanline != 0) || /* no room for complete scan */
339
108k
                    ((jddp->bytes_in_scanline == 0) && (tomove > 0) && /* 1 scancopy completed */
340
41.1k
                     (avail < tomove) && /* still room for 1 more scan */
341
41.1k
                     (jddp->dinfo.output_height > jddp->dinfo.output_scanline))) /* more scans to do */
342
84.9k
                {
343
84.9k
                     if (jddp->PassThrough && jddp->PassThroughfn) {
344
0
                        (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
345
0
                    }
346
84.9k
                    return 1; /* need more room */
347
84.9k
                }
348
108k
            }
349
            /* while not done with image, decode 1 scan, otherwise fall into phase 4 */
350
178k
            while (jddp->dinfo.output_height > jddp->dinfo.output_scanline) {
351
177k
                int read;
352
177k
                byte *samples;
353
354
177k
                if (jddp->scanline_buffer != NULL)
355
42.1k
                    samples = jddp->scanline_buffer;
356
135k
                else {
357
135k
                    if ((uint) (pw->limit - pw->ptr) < ss->scan_line_size) {
358
51.3k
                        if (jddp->PassThrough && jddp->PassThroughfn) {
359
0
                            (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
360
0
                        }
361
51.3k
                        return 1; /* need more room */
362
51.3k
                    }
363
84.3k
                    samples = pw->ptr + 1;
364
84.3k
                }
365
126k
                read = gs_jpeg_read_scanlines(ss, &samples, 1);
366
126k
                if (read < 0) {
367
0
                    code = ERRC;
368
0
                    goto error_out;
369
0
                }
370
126k
                if_debug3m('w', ss->memory, "[wdd]read returns %d, used=%u, faked_eoi=%d\n",
371
126k
                           read,
372
126k
                           (uint) (src->next_input_byte - 1 - pr->ptr),
373
126k
                           (int)jddp->faked_eoi);
374
126k
                pr->ptr =
375
126k
                    (jddp->faked_eoi ? pr->limit : src->next_input_byte - 1);
376
126k
                if (!read) {
377
                    /* We are suspending. If nothing was consumed, and the
378
                     * buffer was full, compact the data in the buffer. If
379
                     * this fails to save anything, then we'll never succeed;
380
                     * throw an error to avoid an infinite loop.
381
                     * The tricky part here is knowing "if the buffer is
382
                     * full"; we do that by comparing the number of bytes in
383
                     * the buffer with the min_in_size set for the stream.
384
                     */
385
                    /* TODO: If we ever find a file with valid data that trips
386
                     * this test, we should implement a scheme whereby we keep
387
                     * a local buffer and copy the data into it. The local
388
                     * buffer can be grown as required. */
389
5.15k
                    if ((src->next_input_byte-1 == pr->ptr) &&
390
5.15k
                        (pr->limit - pr->ptr >= ss->templat->min_in_size) &&
391
5.15k
                        (compact_jpeg_buffer(pr) == 0)) {
392
0
                        code = ERRC;
393
0
                        goto error_out;
394
0
                    }
395
5.15k
                    if (jddp->PassThrough && jddp->PassThroughfn) {
396
0
                        (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
397
0
                    }
398
5.15k
                    return 0; /* need more data */
399
5.15k
                }
400
121k
                if (jddp->scanline_buffer != NULL) {
401
41.1k
                    jddp->bytes_in_scanline = ss->scan_line_size;
402
41.1k
                    goto dumpbuffer;
403
41.1k
                }
404
80.2k
                pw->ptr += ss->scan_line_size;
405
80.2k
            }
406
381
            ss->phase = 4;
407
            /* falls through */
408
626
        case 4:   /* end of image; scan for EOI */
409
626
            if (jddp->PassThrough && jddp->PassThroughfn)
410
0
                (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
411
626
            if ((code = gs_jpeg_finish_decompress(ss)) < 0) {
412
57
                code = ERRC;
413
57
                goto error_out;
414
57
            }
415
569
            pr->ptr =
416
569
                (jddp->faked_eoi ? pr->limit : src->next_input_byte - 1);
417
569
            if (code == 0)
418
245
                return 0;
419
324
            ss->phase = 5;
420
            /* falls through */
421
324
        case 5:   /* we are DONE */
422
324
            return EOFC;
423
143k
    }
424
    /* Default case can't happen.... */
425
0
    return ERRC;
426
427
283
error_out:
428
283
    stream_dct_end_passthrough(jddp);
429
283
    return code;
430
143k
}
431
432
/* Stream template */
433
const stream_template s_DCTD_template =
434
{&st_DCT_state, s_DCTD_init, s_DCTD_process, 2000, 4000, NULL,
435
 s_DCTD_set_defaults
436
};