Coverage Report

Created: 2026-04-01 07:49

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libjpeg-turbo/src/jdatadst.c
Line
Count
Source
1
/*
2
 * jdatadst.c
3
 *
4
 * This file was part of the Independent JPEG Group's software:
5
 * Copyright (C) 1994-1996, Thomas G. Lane.
6
 * Modified 2009-2012 by Guido Vollbeding.
7
 * libjpeg-turbo Modifications:
8
 * Copyright (C) 2013, 2016, 2022, 2026, D. R. Commander.
9
 * For conditions of distribution and use, see the accompanying README.ijg
10
 * file.
11
 *
12
 * This file contains compression data destination routines for the case of
13
 * emitting JPEG data to memory or to a file (or any stdio stream).
14
 * While these routines are sufficient for most applications,
15
 * some will want to use a different destination manager.
16
 * IMPORTANT: we assume that fwrite() will correctly transcribe an array of
17
 * JOCTETs into 8-bit-wide elements on external storage.  If char is wider
18
 * than 8 bits on your machine, you may need to do some tweaking.
19
 */
20
21
/* this is not a core library module, so it doesn't define JPEG_INTERNALS */
22
#include "jinclude.h"
23
#include "jpeglib.h"
24
#include "jerror.h"
25
#if !defined(_MSC_VER) || _MSC_VER > 1600
26
#include <stdint.h>
27
#endif
28
29
30
/* Expanded data destination object for stdio output */
31
32
typedef struct {
33
  struct jpeg_destination_mgr pub; /* public fields */
34
35
  FILE *outfile;                /* target stream */
36
  JOCTET *buffer;               /* start of buffer */
37
} my_destination_mgr;
38
39
typedef my_destination_mgr *my_dest_ptr;
40
41
0
#define OUTPUT_BUF_SIZE  4096   /* choose an efficiently fwrite'able size */
42
43
44
/* Expanded data destination object for memory output */
45
46
typedef struct {
47
  struct jpeg_destination_mgr pub; /* public fields */
48
49
  unsigned char **outbuffer;    /* target buffer */
50
  unsigned long *outsize;
51
  unsigned char *newbuffer;     /* newly allocated buffer */
52
  JOCTET *buffer;               /* start of buffer */
53
  size_t bufsize;
54
} my_mem_destination_mgr;
55
56
typedef my_mem_destination_mgr *my_mem_dest_ptr;
57
58
59
/*
60
 * Initialize destination --- called by jpeg_start_compress
61
 * before any data is actually written.
62
 */
63
64
METHODDEF(void)
65
init_destination(j_compress_ptr cinfo)
66
0
{
67
0
  my_dest_ptr dest = (my_dest_ptr)cinfo->dest;
68
69
  /* Allocate the output buffer --- it will be released when done with image */
70
0
  dest->buffer = (JOCTET *)
71
0
    (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
72
0
                                OUTPUT_BUF_SIZE * sizeof(JOCTET));
73
74
0
  dest->pub.next_output_byte = dest->buffer;
75
0
  dest->pub.free_in_buffer = OUTPUT_BUF_SIZE;
76
0
}
77
78
METHODDEF(void)
79
init_mem_destination(j_compress_ptr cinfo)
80
0
{
81
  /* no work necessary here */
82
0
}
83
84
85
/*
86
 * Empty the output buffer --- called whenever buffer fills up.
87
 *
88
 * In typical applications, this should write the entire output buffer
89
 * (ignoring the current state of next_output_byte & free_in_buffer),
90
 * reset the pointer & count to the start of the buffer, and return TRUE
91
 * indicating that the buffer has been dumped.
92
 *
93
 * In applications that need to be able to suspend compression due to output
94
 * overrun, a FALSE return indicates that the buffer cannot be emptied now.
95
 * In this situation, the compressor will return to its caller (possibly with
96
 * an indication that it has not accepted all the supplied scanlines).  The
97
 * application should resume compression after it has made more room in the
98
 * output buffer.  Note that there are substantial restrictions on the use of
99
 * suspension --- see the documentation.
100
 *
101
 * When suspending, the compressor will back up to a convenient restart point
102
 * (typically the start of the current MCU). next_output_byte & free_in_buffer
103
 * indicate where the restart point will be if the current call returns FALSE.
104
 * Data beyond this point will be regenerated after resumption, so do not
105
 * write it out when emptying the buffer externally.
106
 */
107
108
METHODDEF(boolean)
109
empty_output_buffer(j_compress_ptr cinfo)
110
0
{
111
0
  my_dest_ptr dest = (my_dest_ptr)cinfo->dest;
112
113
0
  if (fwrite(dest->buffer, 1, OUTPUT_BUF_SIZE, dest->outfile) !=
114
0
      (size_t)OUTPUT_BUF_SIZE)
115
0
    ERREXIT(cinfo, JERR_FILE_WRITE);
116
117
0
  dest->pub.next_output_byte = dest->buffer;
118
0
  dest->pub.free_in_buffer = OUTPUT_BUF_SIZE;
119
120
0
  return TRUE;
121
0
}
122
123
METHODDEF(boolean)
124
empty_mem_output_buffer(j_compress_ptr cinfo)
125
0
{
126
0
  size_t nextsize;
127
0
  JOCTET *nextbuffer;
128
0
  my_mem_dest_ptr dest = (my_mem_dest_ptr)cinfo->dest;
129
130
  /* Try to allocate new buffer with double size
131
   *
132
   * NOTE: The following check isn't actually necessary.  On 64-bit systems,
133
   * the maximum theoretical JPEG size is
134
   * 65500 * 65500 * cinfo->num_components * sizeof(DCTELEM) bytes, which is of
135
   * course much less than 8 exabytes (SIZE_MAX / 2).  On 32-bit systems,
136
   * malloc() will never return a buffer >= 2 GB, so the malloc() call will
137
   * fail before 32-bit integer overflow/wraparound can occur.  The sole
138
   * purpose of this code is to shut up automated code analysis tools.
139
   */
140
0
  if (dest->bufsize > SIZE_MAX / 2)
141
0
    ERREXIT1(cinfo, JERR_OUT_OF_MEMORY, 13);
142
0
  nextsize = dest->bufsize * 2;
143
0
  nextbuffer = (JOCTET *)malloc(nextsize);
144
145
0
  if (nextbuffer == NULL)
146
0
    ERREXIT1(cinfo, JERR_OUT_OF_MEMORY, 12);
147
148
0
  memcpy(nextbuffer, dest->buffer, dest->bufsize);
149
150
0
  free(dest->newbuffer);
151
152
0
  dest->newbuffer = nextbuffer;
153
154
0
  dest->pub.next_output_byte = nextbuffer + dest->bufsize;
155
0
  dest->pub.free_in_buffer = dest->bufsize;
156
157
0
  dest->buffer = nextbuffer;
158
0
  dest->bufsize = nextsize;
159
160
0
  return TRUE;
161
0
}
162
163
164
/*
165
 * Terminate destination --- called by jpeg_finish_compress
166
 * after all data has been written.  Usually needs to flush buffer.
167
 *
168
 * NB: *not* called by jpeg_abort or jpeg_destroy; surrounding
169
 * application must deal with any cleanup that should happen even
170
 * for error exit.
171
 */
172
173
METHODDEF(void)
174
term_destination(j_compress_ptr cinfo)
175
0
{
176
0
  my_dest_ptr dest = (my_dest_ptr)cinfo->dest;
177
0
  size_t datacount = OUTPUT_BUF_SIZE - dest->pub.free_in_buffer;
178
179
  /* Write any data remaining in the buffer */
180
0
  if (datacount > 0) {
181
0
    if (fwrite(dest->buffer, 1, datacount, dest->outfile) != datacount)
182
0
      ERREXIT(cinfo, JERR_FILE_WRITE);
183
0
  }
184
0
  fflush(dest->outfile);
185
  /* Make sure we wrote the output file OK */
186
0
  if (ferror(dest->outfile))
187
0
    ERREXIT(cinfo, JERR_FILE_WRITE);
188
0
}
189
190
METHODDEF(void)
191
term_mem_destination(j_compress_ptr cinfo)
192
0
{
193
0
  my_mem_dest_ptr dest = (my_mem_dest_ptr)cinfo->dest;
194
195
0
  *dest->outbuffer = dest->buffer;
196
0
  *dest->outsize = (unsigned long)(dest->bufsize - dest->pub.free_in_buffer);
197
0
}
198
199
200
/*
201
 * Prepare for output to a stdio stream.
202
 * The caller must have already opened the stream, and is responsible
203
 * for closing it after finishing compression.
204
 */
205
206
GLOBAL(void)
207
jpeg_stdio_dest(j_compress_ptr cinfo, FILE *outfile)
208
0
{
209
0
  my_dest_ptr dest;
210
211
  /* The destination object is made permanent so that multiple JPEG images
212
   * can be written to the same file without re-executing jpeg_stdio_dest.
213
   */
214
0
  if (cinfo->dest == NULL) {    /* first time for this JPEG object? */
215
0
    cinfo->dest = (struct jpeg_destination_mgr *)
216
0
      (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_PERMANENT,
217
0
                                  sizeof(my_destination_mgr));
218
0
  } else if (cinfo->dest->init_destination != init_destination) {
219
    /* It is unsafe to reuse the existing destination manager unless it was
220
     * created by this function.  Otherwise, there is no guarantee that the
221
     * opaque structure is the right size.  Note that we could just create a
222
     * new structure, but the old structure would not be freed until
223
     * jpeg_destroy_compress() was called.
224
     */
225
0
    ERREXIT(cinfo, JERR_BUFFER_SIZE);
226
0
  }
227
228
0
  dest = (my_dest_ptr)cinfo->dest;
229
0
  dest->pub.init_destination = init_destination;
230
0
  dest->pub.empty_output_buffer = empty_output_buffer;
231
0
  dest->pub.term_destination = term_destination;
232
0
  dest->outfile = outfile;
233
0
}
234
235
236
/*
237
 * Prepare for output to a memory buffer.
238
 * The caller may supply an own initial buffer with appropriate size.
239
 * Otherwise, or when the actual data output exceeds the given size,
240
 * the library adapts the buffer size as necessary.
241
 * The standard library functions malloc/free are used for allocating
242
 * larger memory, so the buffer is available to the application after
243
 * finishing compression, and then the application is responsible for
244
 * freeing the requested memory.
245
 * Note:  An initial buffer supplied by the caller is expected to be
246
 * managed by the application.  The library does not free such buffer
247
 * when allocating a larger buffer.
248
 */
249
250
GLOBAL(void)
251
jpeg_mem_dest(j_compress_ptr cinfo, unsigned char **outbuffer,
252
              unsigned long *outsize)
253
0
{
254
0
  my_mem_dest_ptr dest;
255
256
0
  if (outbuffer == NULL || outsize == NULL)     /* sanity check */
257
0
    ERREXIT(cinfo, JERR_BUFFER_SIZE);
258
259
  /* The destination object is made permanent so that multiple JPEG images
260
   * can be written to the same buffer without re-executing jpeg_mem_dest.
261
   */
262
0
  if (cinfo->dest == NULL) {    /* first time for this JPEG object? */
263
0
    cinfo->dest = (struct jpeg_destination_mgr *)
264
0
      (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_PERMANENT,
265
0
                                  sizeof(my_mem_destination_mgr));
266
0
  } else if (cinfo->dest->init_destination != init_mem_destination) {
267
    /* It is unsafe to reuse the existing destination manager unless it was
268
     * created by this function.
269
     */
270
0
    ERREXIT(cinfo, JERR_BUFFER_SIZE);
271
0
  }
272
273
0
  dest = (my_mem_dest_ptr)cinfo->dest;
274
0
  dest->pub.init_destination = init_mem_destination;
275
0
  dest->pub.empty_output_buffer = empty_mem_output_buffer;
276
0
  dest->pub.term_destination = term_mem_destination;
277
0
  dest->outbuffer = outbuffer;
278
0
  dest->outsize = outsize;
279
0
  dest->newbuffer = NULL;
280
281
0
  if (*outbuffer == NULL || *outsize == 0) {
282
    /* Allocate initial buffer */
283
0
    dest->newbuffer = *outbuffer = (unsigned char *)malloc(OUTPUT_BUF_SIZE);
284
0
    if (dest->newbuffer == NULL)
285
0
      ERREXIT1(cinfo, JERR_OUT_OF_MEMORY, 10);
286
0
    *outsize = OUTPUT_BUF_SIZE;
287
0
  }
288
289
0
  dest->pub.next_output_byte = dest->buffer = *outbuffer;
290
0
  dest->pub.free_in_buffer = dest->bufsize = *outsize;
291
0
}