Coverage Report

Created: 2025-06-10 06:56

/src/ghostpdl/base/sdctd.c
Line
Count
Source (jump to first uncovered line)
1
/* Copyright (C) 2001-2023 Artifex Software, Inc.
2
   All Rights Reserved.
3
4
   This software is provided AS-IS with no warranty, either express or
5
   implied.
6
7
   This software is distributed under license and may not be copied,
8
   modified or distributed except as expressly authorized under the terms
9
   of the license contained in the file LICENSE in this distribution.
10
11
   Refer to licensing information at http://www.artifex.com or contact
12
   Artifex Software, Inc.,  39 Mesa Street, Suite 108A, San Francisco,
13
   CA 94129, USA, for further information.
14
*/
15
16
17
/* DCT decoding filter stream */
18
#include "memory_.h"
19
#include "stdio_.h"
20
#include "jpeglib_.h"
21
#include "jerror_.h"
22
#include "gdebug.h"
23
#include "gsmemory.h"
24
#include "strimpl.h"
25
#include "sdct.h"
26
#include "sjpeg.h"
27
28
/* ------ DCTDecode ------ */
29
30
/* JPEG source manager procedures */
31
static void
32
dctd_init_source(j_decompress_ptr dinfo)
33
626
{
34
626
}
35
static const JOCTET fake_eoi[2] =
36
{0xFF, JPEG_EOI};
37
static boolean
38
dctd_fill_input_buffer(j_decompress_ptr dinfo)
39
10.6k
{
40
10.6k
    jpeg_decompress_data *jddp =
41
10.6k
    (jpeg_decompress_data *) ((char *)dinfo -
42
10.6k
                              offset_of(jpeg_decompress_data, dinfo));
43
44
10.6k
    if (!jddp->input_eod)
45
10.6k
        return FALSE;    /* normal case: suspend processing */
46
    /* Reached end of source data without finding EOI */
47
15
    WARNMS(dinfo, JWRN_JPEG_EOF);
48
    /* Insert a fake EOI marker */
49
15
    dinfo->src->next_input_byte = fake_eoi;
50
15
    dinfo->src->bytes_in_buffer = 2;
51
15
    jddp->faked_eoi = true; /* so process routine doesn't use next_input_byte */
52
15
    return TRUE;
53
10.6k
}
54
static void
55
dctd_skip_input_data(j_decompress_ptr dinfo, long num_bytes)
56
1.13k
{
57
1.13k
    struct jpeg_source_mgr *src = dinfo->src;
58
1.13k
    jpeg_decompress_data *jddp =
59
1.13k
    (jpeg_decompress_data *) ((char *)dinfo -
60
1.13k
                              offset_of(jpeg_decompress_data, dinfo));
61
62
1.13k
    if (num_bytes > 0) {
63
1.13k
        if (num_bytes > src->bytes_in_buffer) {
64
1.02k
            jddp->skip += num_bytes - src->bytes_in_buffer;
65
1.02k
            src->next_input_byte += src->bytes_in_buffer;
66
1.02k
            src->bytes_in_buffer = 0;
67
1.02k
            return;
68
1.02k
        }
69
104
        src->next_input_byte += num_bytes;
70
104
        src->bytes_in_buffer -= num_bytes;
71
104
    }
72
1.13k
}
73
74
static void
75
dctd_term_source(j_decompress_ptr dinfo)
76
525
{
77
525
    jpeg_decompress_data *jddp =
78
525
    (jpeg_decompress_data *) ((char *)dinfo -
79
525
                              offset_of(jpeg_decompress_data, dinfo));
80
81
525
    stream_dct_end_passthrough(jddp);
82
525
    return;
83
525
}
84
85
/* Set the defaults for the DCTDecode filter. */
86
static void
87
s_DCTD_set_defaults(stream_state * st)
88
626
{
89
626
    s_DCT_set_defaults(st);
90
626
}
91
92
/* Initialize DCTDecode filter */
93
static int
94
s_DCTD_init(stream_state * st)
95
626
{
96
626
    stream_DCT_state *const ss = (stream_DCT_state *) st;
97
626
    struct jpeg_source_mgr *src = &ss->data.decompress->source;
98
99
626
    src->init_source = dctd_init_source;
100
626
    src->fill_input_buffer = dctd_fill_input_buffer;
101
626
    src->skip_input_data = dctd_skip_input_data;
102
626
    src->term_source = dctd_term_source;
103
626
    src->resync_to_restart = jpeg_resync_to_restart;  /* use default method */
104
626
    ss->data.common->memory = ss->jpeg_memory;
105
626
    ss->data.decompress->dinfo.src = src;
106
626
    ss->data.decompress->skip = 0;
107
626
    ss->data.decompress->input_eod = false;
108
626
    ss->data.decompress->faked_eoi = false;
109
626
    ss->phase = 0;
110
626
    return 0;
111
626
}
112
113
static int
114
compact_jpeg_buffer(stream_cursor_read *pr)
115
0
{
116
0
    byte *o, *i;
117
118
    /* Search backwards from the end for 2 consecutive 0xFFs */
119
0
    o = (byte *)pr->limit;
120
0
    while (o - pr->ptr >= 2) {
121
0
        if (*o-- == 0xFF) {
122
0
            if (*o == 0xFF)
123
0
                goto compact;
124
0
            o--;
125
0
        }
126
0
    }
127
0
    return 0;
128
0
compact:
129
0
    i = o-1;
130
0
    do {
131
        /* Skip i backwards over 0xFFs */
132
0
        while ((i != pr->ptr) && (*i == 0xFF))
133
0
            i--;
134
        /* Repeatedly copy from i to o */
135
0
        while (i != pr->ptr) {
136
0
            byte c = *i--;
137
0
            *o-- = c;
138
0
            if (c == 0xFF)
139
0
                break;
140
0
        }
141
0
    } while (i != pr->ptr);
142
143
0
    pr->ptr = o;
144
0
    return o - i;
145
0
}
146
147
static void
148
update_jpeg_header_height(JOCTET *d, size_t len, int height)
149
1.77k
{
150
1.77k
    int marker_len;
151
152
4.31k
    for (d += 2; len > 9 && d[0] == 0xFF; d += marker_len)
153
2.86k
    {
154
2.86k
        int declared_height;
155
156
2.86k
        marker_len = 2 + (d[2] << 8) + d[3];
157
2.86k
        if (marker_len > len)
158
328
            break;
159
2.53k
        len -= marker_len;
160
161
        /* We can only safely rewrite non-differential SOF markers */
162
2.53k
        if (d[1] < 0xC0 || (0xC3 < d[1] && d[1] < 0xC9) || 0xCB < d[1])
163
2.23k
            continue;
164
165
298
        declared_height = (d[5]<<8) | d[6];
166
298
        if (declared_height == 0 || declared_height > height)
167
0
        {
168
0
            d[5] = height>>8;
169
0
            d[6] = height;
170
0
        }
171
298
    }
172
1.77k
}
173
174
/* Process a buffer */
175
static int
176
s_DCTD_process(stream_state * st, stream_cursor_read * pr,
177
               stream_cursor_write * pw, bool last)
178
112k
{
179
112k
    stream_DCT_state *const ss = (stream_DCT_state *) st;
180
112k
    jpeg_decompress_data *jddp = ss->data.decompress;
181
112k
    struct jpeg_source_mgr *src = jddp->dinfo.src;
182
112k
    int code;
183
112k
    byte *Buf;
184
185
112k
    if_debug3m('w', st->memory, "[wdd]process avail=%u, skip=%u, last=%d\n",
186
112k
               (uint) (pr->limit - pr->ptr), (uint) jddp->skip, last);
187
112k
    if (jddp->skip != 0) {
188
4.28k
        long avail = pr->limit - pr->ptr;
189
190
4.28k
        if (avail < jddp->skip) {
191
3.26k
            if (jddp->PassThrough && jddp->PassThroughfn)
192
0
                (jddp->PassThroughfn)(jddp->device, (byte *)pr->ptr + 1, (byte *)pr->limit - (byte *)pr->ptr);
193
194
3.26k
            jddp->skip -= avail;
195
3.26k
            pr->ptr = pr->limit;
196
3.26k
            if (!last)
197
3.25k
                return 0;  /* need more data */
198
4
            jddp->skip = 0; /* don't skip past input EOD */
199
4
        }
200
1.02k
        Buf = (byte *)pr->ptr + 1;
201
1.02k
        pr->ptr += jddp->skip;
202
1.02k
        if (jddp->PassThrough && jddp->PassThroughfn)
203
0
            (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
204
205
1.02k
        jddp->skip = 0;
206
1.02k
    }
207
109k
    src->next_input_byte = pr->ptr + 1;
208
109k
    src->bytes_in_buffer = pr->limit - pr->ptr;
209
109k
    Buf = (byte *)pr->ptr + 1;
210
109k
    jddp->input_eod = last;
211
109k
    switch (ss->phase) {
212
1.25k
        case 0:   /* not initialized yet */
213
            /*
214
             * Adobe implementations seem to ignore leading garbage bytes,
215
             * even though neither the standard nor Adobe's own
216
             * documentation mention this.
217
             */
218
1.25k
            if (jddp->PassThrough && jddp->PassThroughfn && !jddp->StartedPassThrough) {
219
0
                jddp->StartedPassThrough = 1;
220
0
                (jddp->PassThroughfn)(jddp->device, NULL, 1);
221
0
            }
222
1.25k
            while (pr->ptr < pr->limit && pr->ptr[1] != 0xff)
223
0
                pr->ptr++;
224
1.25k
            if (pr->ptr == pr->limit) {
225
626
                if (jddp->PassThrough && jddp->PassThroughfn)
226
0
                    (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
227
626
                return 0;
228
626
            }
229
626
            src->next_input_byte = pr->ptr + 1;
230
626
            src->bytes_in_buffer = pr->limit - pr->ptr;
231
626
            ss->phase = 1;
232
            /* falls through */
233
1.77k
        case 1:   /* reading header markers */
234
1.77k
            if (ss->data.common->Height != 0)
235
1.77k
            {
236
               /* Deliberate and naughty. We cast away a const pointer
237
                * here and write to a supposedly read-only stream. */
238
1.77k
                union { const byte *c; byte *u; } u;
239
1.77k
                u.c = pr->ptr+1;
240
1.77k
                update_jpeg_header_height(u.u, src->bytes_in_buffer, ss->data.common->Height);
241
1.77k
            }
242
1.77k
            if ((code = gs_jpeg_read_header(ss, TRUE)) < 0) {
243
44
                code = ERRC;
244
44
                goto error_out;
245
44
            }
246
1.73k
            pr->ptr =
247
1.73k
                (jddp->faked_eoi ? pr->limit : src->next_input_byte - 1);
248
1.73k
            switch (code) {
249
1.14k
                case JPEG_SUSPENDED:
250
1.14k
                    if (jddp->PassThrough && jddp->PassThroughfn)
251
0
                        (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
252
1.14k
                    return 0;
253
                    /*case JPEG_HEADER_OK: */
254
1.73k
            }
255
256
            /*
257
             * Default the color transform if not set and check for
258
             * the Adobe marker and use Adobe's transform if the
259
             * marker is set.
260
             */
261
582
            if (ss->ColorTransform == -1) {
262
582
                if (jddp->dinfo.num_components == 3)
263
503
                    ss->ColorTransform = 1;
264
79
                else
265
79
                    ss->ColorTransform = 0;
266
582
            }
267
268
582
            if (jddp->dinfo.saw_Adobe_marker)
269
438
                ss->ColorTransform = jddp->dinfo.Adobe_transform;
270
271
582
            switch (jddp->dinfo.num_components) {
272
503
            case 3:
273
503
                jddp->dinfo.jpeg_color_space =
274
503
                    (ss->ColorTransform ? JCS_YCbCr : JCS_RGB);
275
                        /* out_color_space will default to JCS_RGB */
276
503
                        break;
277
28
            case 4:
278
28
                jddp->dinfo.jpeg_color_space =
279
28
                    (ss->ColorTransform ? JCS_YCCK : JCS_CMYK);
280
                /* out_color_space will default to JCS_CMYK */
281
28
                break;
282
582
            }
283
582
            ss->phase = 2;
284
            /* falls through */
285
1.89k
        case 2:   /* start_decompress */
286
1.89k
            if ((code = gs_jpeg_start_decompress(ss)) < 0) {
287
0
                code = ERRC;
288
0
                goto error_out;
289
0
            }
290
1.89k
            pr->ptr =
291
1.89k
                (jddp->faked_eoi ? pr->limit : src->next_input_byte - 1);
292
1.89k
            if (code == 0) {
293
1.31k
                if (jddp->PassThrough && jddp->PassThroughfn)
294
0
                    (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
295
1.31k
                return 0;
296
1.31k
            }
297
580
            ss->scan_line_size =
298
580
                jddp->dinfo.output_width * jddp->dinfo.output_components;
299
580
            if_debug4m('w', ss->memory, "[wdd]width=%u, components=%d, scan_line_size=%u, min_out_size=%u\n",
300
580
                       jddp->dinfo.output_width,
301
580
                       jddp->dinfo.output_components,
302
580
                       ss->scan_line_size, jddp->templat.min_out_size);
303
580
            if (ss->scan_line_size > (uint) jddp->templat.min_out_size) {
304
                /* Create a spare buffer for oversize scanline */
305
15
                jddp->scanline_buffer =
306
15
                    gs_alloc_bytes_immovable(gs_memory_stable(jddp->memory),
307
15
                                             ss->scan_line_size,
308
15
                                         "s_DCTD_process(scanline_buffer)");
309
15
                if (jddp->scanline_buffer == NULL) {
310
0
                    code = ERRC;
311
0
                    goto error_out;
312
0
                }
313
15
            }
314
580
            jddp->bytes_in_scanline = 0;
315
580
            ss->phase = 3;
316
            /* falls through */
317
105k
        case 3:   /* reading data */
318
131k
          dumpbuffer:
319
131k
            if (jddp->bytes_in_scanline != 0) {
320
58.9k
                uint avail = pw->limit - pw->ptr;
321
58.9k
                uint tomove = min(jddp->bytes_in_scanline,
322
58.9k
                                  avail);
323
324
58.9k
                if_debug2m('w', ss->memory, "[wdd]moving %u/%u\n",
325
58.9k
                           tomove, avail);
326
58.9k
                memcpy(pw->ptr + 1, jddp->scanline_buffer +
327
58.9k
                       (ss->scan_line_size - jddp->bytes_in_scanline),
328
58.9k
                       tomove);
329
58.9k
                pw->ptr += tomove;
330
58.9k
                jddp->bytes_in_scanline -= tomove;
331
                /* calculate room after the copy,
332
                 * PXL typically provides room 1 exactly 1 scan, so avail == 0
333
                 * PDF/PS provide enough room, so avail >= 0
334
                 * XPS provides room ro complete image, and expects complet image copied
335
                 * PCL,PXL,PDF,PS copy 1 scan at a time.
336
                 */
337
58.9k
                avail -= tomove;
338
58.9k
                if ((jddp->bytes_in_scanline != 0) || /* no room for complete scan */
339
58.9k
                    ((jddp->bytes_in_scanline == 0) && (tomove > 0) && /* 1 scancopy completed */
340
25.2k
                     (avail < tomove) && /* still room for 1 more scan */
341
25.2k
                     (jddp->dinfo.output_height > jddp->dinfo.output_scanline))) /* more scans to do */
342
45.7k
                {
343
45.7k
                     if (jddp->PassThrough && jddp->PassThroughfn) {
344
0
                        (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
345
0
                    }
346
45.7k
                    return 1; /* need more room */
347
45.7k
                }
348
58.9k
            }
349
            /* while not done with image, decode 1 scan, otherwise fall into phase 4 */
350
211k
            while (jddp->dinfo.output_height > jddp->dinfo.output_scanline) {
351
211k
                int read;
352
211k
                byte *samples;
353
354
211k
                if (jddp->scanline_buffer != NULL)
355
26.5k
                    samples = jddp->scanline_buffer;
356
184k
                else {
357
184k
                    if ((uint) (pw->limit - pw->ptr) < ss->scan_line_size) {
358
51.6k
                        if (jddp->PassThrough && jddp->PassThroughfn) {
359
0
                            (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
360
0
                        }
361
51.6k
                        return 1; /* need more room */
362
51.6k
                    }
363
132k
                    samples = pw->ptr + 1;
364
132k
                }
365
159k
                read = gs_jpeg_read_scanlines(ss, &samples, 1);
366
159k
                if (read < 0) {
367
0
                    code = ERRC;
368
0
                    goto error_out;
369
0
                }
370
159k
                if_debug3m('w', ss->memory, "[wdd]read returns %d, used=%u, faked_eoi=%d\n",
371
159k
                           read,
372
159k
                           (uint) (src->next_input_byte - 1 - pr->ptr),
373
159k
                           (int)jddp->faked_eoi);
374
159k
                pr->ptr =
375
159k
                    (jddp->faked_eoi ? pr->limit : src->next_input_byte - 1);
376
159k
                if (!read) {
377
                    /* We are suspending. If nothing was consumed, and the
378
                     * buffer was full, compact the data in the buffer. If
379
                     * this fails to save anything, then we'll never succeed;
380
                     * throw an error to avoid an infinite loop.
381
                     * The tricky part here is knowing "if the buffer is
382
                     * full"; we do that by comparing the number of bytes in
383
                     * the buffer with the min_in_size set for the stream.
384
                     */
385
                    /* TODO: If we ever find a file with valid data that trips
386
                     * this test, we should implement a scheme whereby we keep
387
                     * a local buffer and copy the data into it. The local
388
                     * buffer can be grown as required. */
389
7.88k
                    if ((src->next_input_byte-1 == pr->ptr) &&
390
7.88k
                        (pr->limit - pr->ptr >= ss->templat->min_in_size) &&
391
7.88k
                        (compact_jpeg_buffer(pr) == 0)) {
392
0
                        code = ERRC;
393
0
                        goto error_out;
394
0
                    }
395
7.88k
                    if (jddp->PassThrough && jddp->PassThroughfn) {
396
0
                        (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
397
0
                    }
398
7.88k
                    return 0; /* need more data */
399
7.88k
                }
400
151k
                if (jddp->scanline_buffer != NULL) {
401
25.2k
                    jddp->bytes_in_scanline = ss->scan_line_size;
402
25.2k
                    goto dumpbuffer;
403
25.2k
                }
404
126k
                pw->ptr += ss->scan_line_size;
405
126k
            }
406
580
            ss->phase = 4;
407
            /* falls through */
408
824
        case 4:   /* end of image; scan for EOI */
409
824
            if (jddp->PassThrough && jddp->PassThroughfn)
410
0
                (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
411
824
            if ((code = gs_jpeg_finish_decompress(ss)) < 0) {
412
55
                code = ERRC;
413
55
                goto error_out;
414
55
            }
415
769
            pr->ptr =
416
769
                (jddp->faked_eoi ? pr->limit : src->next_input_byte - 1);
417
769
            if (code == 0)
418
244
                return 0;
419
525
            ss->phase = 5;
420
            /* falls through */
421
525
        case 5:   /* we are DONE */
422
525
            return EOFC;
423
109k
    }
424
    /* Default case can't happen.... */
425
0
    return ERRC;
426
427
99
error_out:
428
99
    stream_dct_end_passthrough(jddp);
429
99
    return code;
430
109k
}
431
432
/* Stream template */
433
const stream_template s_DCTD_template =
434
{&st_DCT_state, s_DCTD_init, s_DCTD_process, 2000, 4000, NULL,
435
 s_DCTD_set_defaults
436
};