Coverage Report

Created: 2025-06-10 07:17

/src/ghostpdl/base/sdctd.c
Line
Count
Source (jump to first uncovered line)
1
/* Copyright (C) 2001-2023 Artifex Software, Inc.
2
   All Rights Reserved.
3
4
   This software is provided AS-IS with no warranty, either express or
5
   implied.
6
7
   This software is distributed under license and may not be copied,
8
   modified or distributed except as expressly authorized under the terms
9
   of the license contained in the file LICENSE in this distribution.
10
11
   Refer to licensing information at http://www.artifex.com or contact
12
   Artifex Software, Inc.,  39 Mesa Street, Suite 108A, San Francisco,
13
   CA 94129, USA, for further information.
14
*/
15
16
17
/* DCT decoding filter stream */
18
#include "memory_.h"
19
#include "stdio_.h"
20
#include "jpeglib_.h"
21
#include "jerror_.h"
22
#include "gdebug.h"
23
#include "gsmemory.h"
24
#include "strimpl.h"
25
#include "sdct.h"
26
#include "sjpeg.h"
27
28
/* ------ DCTDecode ------ */
29
30
/* JPEG source manager procedures */
31
static void
32
dctd_init_source(j_decompress_ptr dinfo)
33
544
{
34
544
}
35
static const JOCTET fake_eoi[2] =
36
{0xFF, JPEG_EOI};
37
static boolean
38
dctd_fill_input_buffer(j_decompress_ptr dinfo)
39
8.83k
{
40
8.83k
    jpeg_decompress_data *jddp =
41
8.83k
    (jpeg_decompress_data *) ((char *)dinfo -
42
8.83k
                              offset_of(jpeg_decompress_data, dinfo));
43
44
8.83k
    if (!jddp->input_eod)
45
8.75k
        return FALSE;    /* normal case: suspend processing */
46
    /* Reached end of source data without finding EOI */
47
78
    WARNMS(dinfo, JWRN_JPEG_EOF);
48
    /* Insert a fake EOI marker */
49
78
    dinfo->src->next_input_byte = fake_eoi;
50
78
    dinfo->src->bytes_in_buffer = 2;
51
78
    jddp->faked_eoi = true; /* so process routine doesn't use next_input_byte */
52
78
    return TRUE;
53
8.83k
}
54
static void
55
dctd_skip_input_data(j_decompress_ptr dinfo, long num_bytes)
56
197
{
57
197
    struct jpeg_source_mgr *src = dinfo->src;
58
197
    jpeg_decompress_data *jddp =
59
197
    (jpeg_decompress_data *) ((char *)dinfo -
60
197
                              offset_of(jpeg_decompress_data, dinfo));
61
62
197
    if (num_bytes > 0) {
63
197
        if (num_bytes > src->bytes_in_buffer) {
64
113
            jddp->skip += num_bytes - src->bytes_in_buffer;
65
113
            src->next_input_byte += src->bytes_in_buffer;
66
113
            src->bytes_in_buffer = 0;
67
113
            return;
68
113
        }
69
84
        src->next_input_byte += num_bytes;
70
84
        src->bytes_in_buffer -= num_bytes;
71
84
    }
72
197
}
73
74
static void
75
dctd_term_source(j_decompress_ptr dinfo)
76
450
{
77
450
    jpeg_decompress_data *jddp =
78
450
    (jpeg_decompress_data *) ((char *)dinfo -
79
450
                              offset_of(jpeg_decompress_data, dinfo));
80
81
450
    stream_dct_end_passthrough(jddp);
82
450
    return;
83
450
}
84
85
/* Set the defaults for the DCTDecode filter. */
86
static void
87
s_DCTD_set_defaults(stream_state * st)
88
554
{
89
554
    s_DCT_set_defaults(st);
90
554
}
91
92
/* Initialize DCTDecode filter */
93
static int
94
s_DCTD_init(stream_state * st)
95
554
{
96
554
    stream_DCT_state *const ss = (stream_DCT_state *) st;
97
554
    struct jpeg_source_mgr *src = &ss->data.decompress->source;
98
99
554
    src->init_source = dctd_init_source;
100
554
    src->fill_input_buffer = dctd_fill_input_buffer;
101
554
    src->skip_input_data = dctd_skip_input_data;
102
554
    src->term_source = dctd_term_source;
103
554
    src->resync_to_restart = jpeg_resync_to_restart;  /* use default method */
104
554
    ss->data.common->memory = ss->jpeg_memory;
105
554
    ss->data.decompress->dinfo.src = src;
106
554
    ss->data.decompress->skip = 0;
107
554
    ss->data.decompress->input_eod = false;
108
554
    ss->data.decompress->faked_eoi = false;
109
554
    ss->phase = 0;
110
554
    return 0;
111
554
}
112
113
static int
114
compact_jpeg_buffer(stream_cursor_read *pr)
115
0
{
116
0
    byte *o, *i;
117
118
    /* Search backwards from the end for 2 consecutive 0xFFs */
119
0
    o = (byte *)pr->limit;
120
0
    while (o - pr->ptr >= 2) {
121
0
        if (*o-- == 0xFF) {
122
0
            if (*o == 0xFF)
123
0
                goto compact;
124
0
            o--;
125
0
        }
126
0
    }
127
0
    return 0;
128
0
compact:
129
0
    i = o-1;
130
0
    do {
131
        /* Skip i backwards over 0xFFs */
132
0
        while ((i != pr->ptr) && (*i == 0xFF))
133
0
            i--;
134
        /* Repeatedly copy from i to o */
135
0
        while (i != pr->ptr) {
136
0
            byte c = *i--;
137
0
            *o-- = c;
138
0
            if (c == 0xFF)
139
0
                break;
140
0
        }
141
0
    } while (i != pr->ptr);
142
143
0
    pr->ptr = o;
144
0
    return o - i;
145
0
}
146
147
static void
148
update_jpeg_header_height(JOCTET *d, size_t len, int height)
149
796
{
150
796
    int marker_len;
151
152
4.26k
    for (d += 2; len > 9 && d[0] == 0xFF; d += marker_len)
153
3.53k
    {
154
3.53k
        int declared_height;
155
156
3.53k
        marker_len = 2 + (d[2] << 8) + d[3];
157
3.53k
        if (marker_len > len)
158
61
            break;
159
3.47k
        len -= marker_len;
160
161
        /* We can only safely rewrite non-differential SOF markers */
162
3.47k
        if (d[1] < 0xC0 || (0xC3 < d[1] && d[1] < 0xC9) || 0xCB < d[1])
163
3.01k
            continue;
164
165
459
        declared_height = (d[5]<<8) | d[6];
166
459
        if (declared_height == 0 || declared_height > height)
167
3
        {
168
3
            d[5] = height>>8;
169
3
            d[6] = height;
170
3
        }
171
459
    }
172
796
}
173
174
/* Process a buffer */
175
static int
176
s_DCTD_process(stream_state * st, stream_cursor_read * pr,
177
               stream_cursor_write * pw, bool last)
178
233k
{
179
233k
    stream_DCT_state *const ss = (stream_DCT_state *) st;
180
233k
    jpeg_decompress_data *jddp = ss->data.decompress;
181
233k
    struct jpeg_source_mgr *src = jddp->dinfo.src;
182
233k
    int code;
183
233k
    byte *Buf;
184
185
233k
    if_debug3m('w', st->memory, "[wdd]process avail=%u, skip=%u, last=%d\n",
186
233k
               (uint) (pr->limit - pr->ptr), (uint) jddp->skip, last);
187
233k
    if (jddp->skip != 0) {
188
556
        long avail = pr->limit - pr->ptr;
189
190
556
        if (avail < jddp->skip) {
191
455
            if (jddp->PassThrough && jddp->PassThroughfn)
192
0
                (jddp->PassThroughfn)(jddp->device, (byte *)pr->ptr + 1, (byte *)pr->limit - (byte *)pr->ptr);
193
194
455
            jddp->skip -= avail;
195
455
            pr->ptr = pr->limit;
196
455
            if (!last)
197
444
                return 0;  /* need more data */
198
11
            jddp->skip = 0; /* don't skip past input EOD */
199
11
        }
200
112
        Buf = (byte *)pr->ptr + 1;
201
112
        pr->ptr += jddp->skip;
202
112
        if (jddp->PassThrough && jddp->PassThroughfn)
203
0
            (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
204
205
112
        jddp->skip = 0;
206
112
    }
207
233k
    src->next_input_byte = pr->ptr + 1;
208
233k
    src->bytes_in_buffer = pr->limit - pr->ptr;
209
233k
    Buf = (byte *)pr->ptr + 1;
210
233k
    jddp->input_eod = last;
211
233k
    switch (ss->phase) {
212
1.09k
        case 0:   /* not initialized yet */
213
            /*
214
             * Adobe implementations seem to ignore leading garbage bytes,
215
             * even though neither the standard nor Adobe's own
216
             * documentation mention this.
217
             */
218
1.09k
            if (jddp->PassThrough && jddp->PassThroughfn && !jddp->StartedPassThrough) {
219
0
                jddp->StartedPassThrough = 1;
220
0
                (jddp->PassThroughfn)(jddp->device, NULL, 1);
221
0
            }
222
1.10k
            while (pr->ptr < pr->limit && pr->ptr[1] != 0xff)
223
12
                pr->ptr++;
224
1.09k
            if (pr->ptr == pr->limit) {
225
548
                if (jddp->PassThrough && jddp->PassThroughfn)
226
0
                    (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
227
548
                return 0;
228
548
            }
229
544
            src->next_input_byte = pr->ptr + 1;
230
544
            src->bytes_in_buffer = pr->limit - pr->ptr;
231
544
            ss->phase = 1;
232
            /* falls through */
233
814
        case 1:   /* reading header markers */
234
814
            if (ss->data.common->Height != 0)
235
796
            {
236
               /* Deliberate and naughty. We cast away a const pointer
237
                * here and write to a supposedly read-only stream. */
238
796
                union { const byte *c; byte *u; } u;
239
796
                u.c = pr->ptr+1;
240
796
                update_jpeg_header_height(u.u, src->bytes_in_buffer, ss->data.common->Height);
241
796
            }
242
814
            if ((code = gs_jpeg_read_header(ss, TRUE)) < 0) {
243
31
                code = ERRC;
244
31
                goto error_out;
245
31
            }
246
783
            pr->ptr =
247
783
                (jddp->faked_eoi ? pr->limit : src->next_input_byte - 1);
248
783
            switch (code) {
249
273
                case JPEG_SUSPENDED:
250
273
                    if (jddp->PassThrough && jddp->PassThroughfn)
251
0
                        (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
252
273
                    return 0;
253
                    /*case JPEG_HEADER_OK: */
254
783
            }
255
256
            /*
257
             * Default the color transform if not set and check for
258
             * the Adobe marker and use Adobe's transform if the
259
             * marker is set.
260
             */
261
510
            if (ss->ColorTransform == -1) {
262
510
                if (jddp->dinfo.num_components == 3)
263
409
                    ss->ColorTransform = 1;
264
101
                else
265
101
                    ss->ColorTransform = 0;
266
510
            }
267
268
510
            if (jddp->dinfo.saw_Adobe_marker)
269
225
                ss->ColorTransform = jddp->dinfo.Adobe_transform;
270
271
510
            switch (jddp->dinfo.num_components) {
272
409
            case 3:
273
409
                jddp->dinfo.jpeg_color_space =
274
409
                    (ss->ColorTransform ? JCS_YCbCr : JCS_RGB);
275
                        /* out_color_space will default to JCS_RGB */
276
409
                        break;
277
42
            case 4:
278
42
                jddp->dinfo.jpeg_color_space =
279
42
                    (ss->ColorTransform ? JCS_YCCK : JCS_CMYK);
280
                /* out_color_space will default to JCS_CMYK */
281
42
                break;
282
510
            }
283
510
            ss->phase = 2;
284
            /* falls through */
285
588
        case 2:   /* start_decompress */
286
588
            if ((code = gs_jpeg_start_decompress(ss)) < 0) {
287
0
                code = ERRC;
288
0
                goto error_out;
289
0
            }
290
588
            pr->ptr =
291
588
                (jddp->faked_eoi ? pr->limit : src->next_input_byte - 1);
292
588
            if (code == 0) {
293
78
                if (jddp->PassThrough && jddp->PassThroughfn)
294
0
                    (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
295
78
                return 0;
296
78
            }
297
510
            ss->scan_line_size =
298
510
                jddp->dinfo.output_width * jddp->dinfo.output_components;
299
510
            if_debug4m('w', ss->memory, "[wdd]width=%u, components=%d, scan_line_size=%u, min_out_size=%u\n",
300
510
                       jddp->dinfo.output_width,
301
510
                       jddp->dinfo.output_components,
302
510
                       ss->scan_line_size, jddp->templat.min_out_size);
303
510
            if (ss->scan_line_size > (uint) jddp->templat.min_out_size) {
304
                /* Create a spare buffer for oversize scanline */
305
34
                jddp->scanline_buffer =
306
34
                    gs_alloc_bytes_immovable(gs_memory_stable(jddp->memory),
307
34
                                             ss->scan_line_size,
308
34
                                         "s_DCTD_process(scanline_buffer)");
309
34
                if (jddp->scanline_buffer == NULL) {
310
0
                    code = ERRC;
311
0
                    goto error_out;
312
0
                }
313
34
            }
314
510
            jddp->bytes_in_scanline = 0;
315
510
            ss->phase = 3;
316
            /* falls through */
317
231k
        case 3:   /* reading data */
318
319k
          dumpbuffer:
319
319k
            if (jddp->bytes_in_scanline != 0) {
320
192k
                uint avail = pw->limit - pw->ptr;
321
192k
                uint tomove = min(jddp->bytes_in_scanline,
322
192k
                                  avail);
323
324
192k
                if_debug2m('w', ss->memory, "[wdd]moving %u/%u\n",
325
192k
                           tomove, avail);
326
192k
                memcpy(pw->ptr + 1, jddp->scanline_buffer +
327
192k
                       (ss->scan_line_size - jddp->bytes_in_scanline),
328
192k
                       tomove);
329
192k
                pw->ptr += tomove;
330
192k
                jddp->bytes_in_scanline -= tomove;
331
                /* calculate room after the copy,
332
                 * PXL typically provides room 1 exactly 1 scan, so avail == 0
333
                 * PDF/PS provide enough room, so avail >= 0
334
                 * XPS provides room ro complete image, and expects complet image copied
335
                 * PCL,PXL,PDF,PS copy 1 scan at a time.
336
                 */
337
192k
                avail -= tomove;
338
192k
                if ((jddp->bytes_in_scanline != 0) || /* no room for complete scan */
339
192k
                    ((jddp->bytes_in_scanline == 0) && (tomove > 0) && /* 1 scancopy completed */
340
87.7k
                     (avail < tomove) && /* still room for 1 more scan */
341
87.7k
                     (jddp->dinfo.output_height > jddp->dinfo.output_scanline))) /* more scans to do */
342
176k
                {
343
176k
                     if (jddp->PassThrough && jddp->PassThroughfn) {
344
0
                        (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
345
0
                    }
346
176k
                    return 1; /* need more room */
347
176k
                }
348
192k
            }
349
            /* while not done with image, decode 1 scan, otherwise fall into phase 4 */
350
238k
            while (jddp->dinfo.output_height > jddp->dinfo.output_scanline) {
351
238k
                int read;
352
238k
                byte *samples;
353
354
238k
                if (jddp->scanline_buffer != NULL)
355
90.2k
                    samples = jddp->scanline_buffer;
356
147k
                else {
357
147k
                    if ((uint) (pw->limit - pw->ptr) < ss->scan_line_size) {
358
46.7k
                        if (jddp->PassThrough && jddp->PassThroughfn) {
359
0
                            (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
360
0
                        }
361
46.7k
                        return 1; /* need more room */
362
46.7k
                    }
363
101k
                    samples = pw->ptr + 1;
364
101k
                }
365
191k
                read = gs_jpeg_read_scanlines(ss, &samples, 1);
366
191k
                if (read < 0) {
367
0
                    code = ERRC;
368
0
                    goto error_out;
369
0
                }
370
191k
                if_debug3m('w', ss->memory, "[wdd]read returns %d, used=%u, faked_eoi=%d\n",
371
191k
                           read,
372
191k
                           (uint) (src->next_input_byte - 1 - pr->ptr),
373
191k
                           (int)jddp->faked_eoi);
374
191k
                pr->ptr =
375
191k
                    (jddp->faked_eoi ? pr->limit : src->next_input_byte - 1);
376
191k
                if (!read) {
377
                    /* We are suspending. If nothing was consumed, and the
378
                     * buffer was full, compact the data in the buffer. If
379
                     * this fails to save anything, then we'll never succeed;
380
                     * throw an error to avoid an infinite loop.
381
                     * The tricky part here is knowing "if the buffer is
382
                     * full"; we do that by comparing the number of bytes in
383
                     * the buffer with the min_in_size set for the stream.
384
                     */
385
                    /* TODO: If we ever find a file with valid data that trips
386
                     * this test, we should implement a scheme whereby we keep
387
                     * a local buffer and copy the data into it. The local
388
                     * buffer can be grown as required. */
389
8.16k
                    if ((src->next_input_byte-1 == pr->ptr) &&
390
8.16k
                        (pr->limit - pr->ptr >= ss->templat->min_in_size) &&
391
8.16k
                        (compact_jpeg_buffer(pr) == 0)) {
392
0
                        code = ERRC;
393
0
                        goto error_out;
394
0
                    }
395
8.16k
                    if (jddp->PassThrough && jddp->PassThroughfn) {
396
0
                        (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
397
0
                    }
398
8.16k
                    return 0; /* need more data */
399
8.16k
                }
400
183k
                if (jddp->scanline_buffer != NULL) {
401
87.7k
                    jddp->bytes_in_scanline = ss->scan_line_size;
402
87.7k
                    goto dumpbuffer;
403
87.7k
                }
404
95.5k
                pw->ptr += ss->scan_line_size;
405
95.5k
            }
406
501
            ss->phase = 4;
407
            /* falls through */
408
745
        case 4:   /* end of image; scan for EOI */
409
745
            if (jddp->PassThrough && jddp->PassThroughfn)
410
0
                (jddp->PassThroughfn)(jddp->device, Buf, pr->ptr - (Buf - 1));
411
745
            if ((code = gs_jpeg_finish_decompress(ss)) < 0) {
412
51
                code = ERRC;
413
51
                goto error_out;
414
51
            }
415
694
            pr->ptr =
416
694
                (jddp->faked_eoi ? pr->limit : src->next_input_byte - 1);
417
694
            if (code == 0)
418
244
                return 0;
419
450
            ss->phase = 5;
420
            /* falls through */
421
450
        case 5:   /* we are DONE */
422
450
            return EOFC;
423
233k
    }
424
    /* Default case can't happen.... */
425
0
    return ERRC;
426
427
82
error_out:
428
82
    stream_dct_end_passthrough(jddp);
429
82
    return code;
430
233k
}
431
432
/* Stream template */
433
const stream_template s_DCTD_template =
434
{&st_DCT_state, s_DCTD_init, s_DCTD_process, 2000, 4000, NULL,
435
 s_DCTD_set_defaults
436
};