Coverage Report

Created: 2025-06-16 07:00

/src/libjxl/lib/jxl/enc_icc_codec.cc
Line
Count
Source (jump to first uncovered line)
1
// Copyright (c) the JPEG XL Project Authors. All rights reserved.
2
//
3
// Use of this source code is governed by a BSD-style
4
// license that can be found in the LICENSE file.
5
6
#include "lib/jxl/enc_icc_codec.h"
7
8
#include <jxl/memory_manager.h>
9
10
#include <cstddef>
11
#include <cstdint>
12
#include <limits>
13
#include <map>
14
#include <vector>
15
16
#include "lib/jxl/base/compiler_specific.h"
17
#include "lib/jxl/base/span.h"
18
#include "lib/jxl/base/status.h"
19
#include "lib/jxl/enc_ans.h"
20
#include "lib/jxl/enc_ans_params.h"
21
#include "lib/jxl/enc_aux_out.h"
22
#include "lib/jxl/fields.h"
23
#include "lib/jxl/icc_codec_common.h"
24
#include "lib/jxl/padded_bytes.h"
25
26
namespace jxl {
27
namespace {
28
29
// Unshuffles or de-interleaves bytes, for example with width 2, turns
30
// "AaBbCcDc" into "ABCDabcd", this for example de-interleaves UTF-16 bytes into
31
// first all the high order bytes, then all the low order bytes.
32
// Transposes a matrix of width columns and ceil(size / width) rows. There are
33
// size elements, size may be < width * height, if so the
34
// last elements of the bottom row are missing, the missing spots are
35
// transposed along with the filled spots, and the result has the missing
36
// elements at the bottom of the rightmost column. The input is the input matrix
37
// in scanline order, the output is the result matrix in scanline order, with
38
// missing elements skipped over (this may occur at multiple positions).
39
Status Unshuffle(JxlMemoryManager* memory_manager, uint8_t* data, size_t size,
40
0
                 size_t width) {
41
0
  size_t height = (size + width - 1) / width;  // amount of rows of input
42
0
  PaddedBytes result(memory_manager);
43
0
  JXL_ASSIGN_OR_RETURN(result,
44
0
                       PaddedBytes::WithInitialSpace(memory_manager, size));
45
46
  // i = input index, j output index
47
0
  size_t s = 0;
48
0
  size_t j = 0;
49
0
  for (size_t i = 0; i < size; i++) {
50
0
    result[j] = data[i];
51
0
    j += height;
52
0
    if (j >= size) j = ++s;
53
0
  }
54
55
0
  for (size_t i = 0; i < size; i++) {
56
0
    data[i] = result[i];
57
0
  }
58
0
  return true;
59
0
}
60
61
// This is performed by the encoder, the encoder must be able to encode any
62
// random byte stream (not just byte streams that are a valid ICC profile), so
63
// an error returned by this function is an implementation error.
64
Status PredictAndShuffle(size_t stride, size_t width, int order, size_t num,
65
                         const uint8_t* data, size_t size, size_t* pos,
66
0
                         PaddedBytes* result) {
67
0
  JXL_RETURN_IF_ERROR(CheckOutOfBounds(*pos, num, size));
68
0
  JxlMemoryManager* memory_manager = result->memory_manager();
69
  // Required by the specification, see decoder. stride * 4 must be < *pos.
70
0
  if (!*pos || ((*pos - 1u) >> 2u) < stride) {
71
0
    return JXL_FAILURE("Invalid stride");
72
0
  }
73
0
  if (*pos < stride * 4) return JXL_FAILURE("Too large stride");
74
0
  size_t start = result->size();
75
0
  for (size_t i = 0; i < num; i++) {
76
0
    uint8_t predicted =
77
0
        LinearPredictICCValue(data, *pos, i, stride, width, order);
78
0
    JXL_RETURN_IF_ERROR(result->push_back(data[*pos + i] - predicted));
79
0
  }
80
0
  *pos += num;
81
0
  if (width > 1) {
82
0
    JXL_RETURN_IF_ERROR(
83
0
        Unshuffle(memory_manager, result->data() + start, num, width));
84
0
  }
85
0
  return true;
86
0
}
87
88
0
inline Status EncodeVarInt(uint64_t value, PaddedBytes* data) {
89
0
  size_t pos = data->size();
90
0
  JXL_RETURN_IF_ERROR(data->resize(data->size() + 9));
91
0
  size_t output_size = data->size();
92
0
  uint8_t* output = data->data();
93
94
  // While more than 7 bits of data are left,
95
  // store 7 bits and set the next byte flag
96
0
  while (value > 127) {
97
    // TODO(eustas): should it be `<` ?
98
0
    JXL_ENSURE(pos <= output_size);
99
    // |128: Set the next byte flag
100
0
    output[pos++] = (static_cast<uint8_t>(value & 127)) | 128;
101
    // Remove the seven bits we just wrote
102
0
    value >>= 7;
103
0
  }
104
  // TODO(eustas): should it be `<` ?
105
0
  JXL_ENSURE(pos <= output_size);
106
0
  output[pos++] = static_cast<uint8_t>(value & 127);
107
108
0
  return data->resize(pos);
109
0
}
110
111
constexpr size_t kSizeLimit = std::numeric_limits<uint32_t>::max() >> 2;
112
113
}  // namespace
114
115
// Outputs a transformed form of the given icc profile. The result itself is
116
// not particularly smaller than the input data in bytes, but it will be in a
117
// form that is easier to compress (more zeroes, ...) and will compress better
118
// with brotli.
119
0
Status PredictICC(const uint8_t* icc, size_t size, PaddedBytes* result) {
120
0
  JxlMemoryManager* memory_manager = result->memory_manager();
121
0
  PaddedBytes commands{memory_manager};
122
0
  PaddedBytes data{memory_manager};
123
124
0
  static_assert(sizeof(size_t) >= 4, "size_t is too short");
125
  // Fuzzer expects that PredictICC can accept any input,
126
  // but 1GB should be enough for any purpose.
127
0
  if (size > kSizeLimit) {
128
0
    return JXL_FAILURE("ICC profile is too large");
129
0
  }
130
131
0
  JXL_RETURN_IF_ERROR(EncodeVarInt(size, result));
132
133
  // Header
134
0
  PaddedBytes header{memory_manager};
135
0
  JXL_RETURN_IF_ERROR(header.append(ICCInitialHeaderPrediction(size)));
136
0
  for (size_t i = 0; i < kICCHeaderSize && i < size; i++) {
137
0
    ICCPredictHeader(icc, size, header.data(), i);
138
0
    JXL_RETURN_IF_ERROR(data.push_back(icc[i] - header[i]));
139
0
  }
140
0
  if (size <= kICCHeaderSize) {
141
0
    JXL_RETURN_IF_ERROR(EncodeVarInt(0, result));  // 0 commands
142
0
    for (uint8_t b : data) {
143
0
      JXL_RETURN_IF_ERROR(result->push_back(b));
144
0
    }
145
0
    return true;
146
0
  }
147
148
0
  std::vector<Tag> tags;
149
0
  std::vector<size_t> tagstarts;
150
0
  std::vector<size_t> tagsizes;
151
0
  std::map<size_t, size_t> tagmap;
152
153
  // Tag list
154
0
  size_t pos = kICCHeaderSize;
155
0
  if (pos + 4 <= size) {
156
0
    uint64_t numtags = DecodeUint32(icc, size, pos);
157
0
    pos += 4;
158
0
    JXL_RETURN_IF_ERROR(EncodeVarInt(numtags + 1, &commands));
159
0
    uint64_t prevtagstart = kICCHeaderSize + numtags * 12;
160
0
    uint32_t prevtagsize = 0;
161
0
    for (size_t i = 0; i < numtags; i++) {
162
0
      if (pos + 12 > size) break;
163
164
0
      Tag tag = DecodeKeyword(icc, size, pos + 0);
165
0
      uint32_t tagstart = DecodeUint32(icc, size, pos + 4);
166
0
      uint32_t tagsize = DecodeUint32(icc, size, pos + 8);
167
0
      pos += 12;
168
169
0
      tags.push_back(tag);
170
0
      tagstarts.push_back(tagstart);
171
0
      tagsizes.push_back(tagsize);
172
0
      tagmap[tagstart] = tags.size() - 1;
173
174
0
      uint8_t tagcode = kCommandTagUnknown;
175
0
      for (size_t j = 0; j < kNumTagStrings; j++) {
176
0
        if (tag == *kTagStrings[j]) {
177
0
          tagcode = j + kCommandTagStringFirst;
178
0
          break;
179
0
        }
180
0
      }
181
182
0
      if (tag == kRtrcTag && pos + 24 < size) {
183
0
        bool ok = true;
184
0
        ok &= DecodeKeyword(icc, size, pos + 0) == kGtrcTag;
185
0
        ok &= DecodeKeyword(icc, size, pos + 12) == kBtrcTag;
186
0
        if (ok) {
187
0
          for (size_t kk = 0; kk < 8; kk++) {
188
0
            if (icc[pos - 8 + kk] != icc[pos + 4 + kk]) ok = false;
189
0
            if (icc[pos - 8 + kk] != icc[pos + 16 + kk]) ok = false;
190
0
          }
191
0
        }
192
0
        if (ok) {
193
0
          tagcode = kCommandTagTRC;
194
0
          pos += 24;
195
0
          i += 2;
196
0
        }
197
0
      }
198
199
0
      if (tag == kRxyzTag && pos + 24 < size) {
200
0
        bool ok = true;
201
0
        ok &= DecodeKeyword(icc, size, pos + 0) == kGxyzTag;
202
0
        ok &= DecodeKeyword(icc, size, pos + 12) == kBxyzTag;
203
0
        uint32_t offsetr = tagstart;
204
0
        uint32_t offsetg = DecodeUint32(icc, size, pos + 4);
205
0
        uint32_t offsetb = DecodeUint32(icc, size, pos + 16);
206
0
        uint32_t sizer = tagsize;
207
0
        uint32_t sizeg = DecodeUint32(icc, size, pos + 8);
208
0
        uint32_t sizeb = DecodeUint32(icc, size, pos + 20);
209
0
        ok &= sizer == 20;
210
0
        ok &= sizeg == 20;
211
0
        ok &= sizeb == 20;
212
0
        ok &= (offsetg == offsetr + 20);
213
0
        ok &= (offsetb == offsetr + 40);
214
0
        if (ok) {
215
0
          tagcode = kCommandTagXYZ;
216
0
          pos += 24;
217
0
          i += 2;
218
0
        }
219
0
      }
220
221
0
      uint8_t command = tagcode;
222
0
      uint64_t predicted_tagstart = prevtagstart + prevtagsize;
223
0
      if (predicted_tagstart != tagstart) command |= kFlagBitOffset;
224
0
      size_t predicted_tagsize = prevtagsize;
225
0
      if (tag == kRxyzTag || tag == kGxyzTag || tag == kBxyzTag ||
226
0
          tag == kKxyzTag || tag == kWtptTag || tag == kBkptTag ||
227
0
          tag == kLumiTag) {
228
0
        predicted_tagsize = 20;
229
0
      }
230
0
      if (predicted_tagsize != tagsize) command |= kFlagBitSize;
231
0
      JXL_RETURN_IF_ERROR(commands.push_back(command));
232
0
      if (tagcode == 1) {
233
0
        JXL_RETURN_IF_ERROR(AppendKeyword(tag, &data));
234
0
      }
235
0
      if (command & kFlagBitOffset)
236
0
        JXL_RETURN_IF_ERROR(EncodeVarInt(tagstart, &commands));
237
0
      if (command & kFlagBitSize)
238
0
        JXL_RETURN_IF_ERROR(EncodeVarInt(tagsize, &commands));
239
240
0
      prevtagstart = tagstart;
241
0
      prevtagsize = tagsize;
242
0
    }
243
0
  }
244
  // Indicate end of tag list or varint indicating there's none
245
0
  JXL_RETURN_IF_ERROR(commands.push_back(0));
246
247
  // Main content
248
  // The main content in a valid ICC profile contains tagged elements, with the
249
  // tag types (4 letter names) given by the tag list above, and the tag list
250
  // pointing to the start and indicating the size of each tagged element. It is
251
  // allowed for tagged elements to overlap, e.g. the curve for R, G and B could
252
  // all point to the same one.
253
0
  Tag tag;
254
0
  size_t tagstart = 0;
255
0
  size_t tagsize = 0;
256
0
  size_t clutstart = 0;
257
258
  // Should always check tag_sane before doing math with tagsize.
259
0
  const auto tag_sane = [&tagsize]() {
260
0
    return (tagsize > 8) && (tagsize < kSizeLimit);
261
0
  };
262
263
0
  size_t last0 = pos;
264
  // This loop appends commands to the output, processing some sub-section of a
265
  // current tagged element each time. We need to keep track of the tagtype of
266
  // the current element, and update it when we encounter the boundary of a
267
  // next one.
268
  // It is not required that the input data is a valid ICC profile, if the
269
  // encoder does not recognize the data it will still be able to output bytes
270
  // but will not predict as well.
271
0
  while (pos <= size) {
272
0
    size_t last1 = pos;
273
0
    PaddedBytes commands_add{memory_manager};
274
0
    PaddedBytes data_add{memory_manager};
275
276
    // This means the loop brought the position beyond the tag end.
277
    // If tagsize is nonsensical, any pos looks "ok-ish".
278
0
    if ((pos > tagstart + tagsize) && (tagsize < kSizeLimit)) {
279
0
      tag = {{0, 0, 0, 0}};  // nonsensical value
280
0
    }
281
282
0
    if (commands_add.empty() && data_add.empty() && tagmap.count(pos) &&
283
0
        pos + 4 <= size) {
284
0
      size_t index = tagmap[pos];
285
0
      tag = DecodeKeyword(icc, size, pos);
286
0
      tagstart = tagstarts[index];
287
0
      tagsize = tagsizes[index];
288
289
0
      if (tag == kMlucTag && tag_sane() && pos + tagsize <= size &&
290
0
          icc[pos + 4] == 0 && icc[pos + 5] == 0 && icc[pos + 6] == 0 &&
291
0
          icc[pos + 7] == 0) {
292
0
        size_t num = tagsize - 8;
293
0
        JXL_RETURN_IF_ERROR(commands_add.push_back(kCommandTypeStartFirst + 3));
294
0
        pos += 8;
295
0
        JXL_RETURN_IF_ERROR(commands_add.push_back(kCommandShuffle2));
296
0
        JXL_RETURN_IF_ERROR(EncodeVarInt(num, &commands_add));
297
0
        size_t start = data_add.size();
298
0
        for (size_t i = 0; i < num; i++) {
299
0
          JXL_RETURN_IF_ERROR(data_add.push_back(icc[pos]));
300
0
          pos++;
301
0
        }
302
0
        JXL_RETURN_IF_ERROR(
303
0
            Unshuffle(memory_manager, data_add.data() + start, num, 2));
304
0
      }
305
306
0
      if (tag == kCurvTag && tag_sane() && pos + tagsize <= size &&
307
0
          icc[pos + 4] == 0 && icc[pos + 5] == 0 && icc[pos + 6] == 0 &&
308
0
          icc[pos + 7] == 0) {
309
0
        size_t num = tagsize - 8;
310
0
        if (num > 16 && num < (1 << 28) && pos + num <= size && pos > 0) {
311
0
          JXL_RETURN_IF_ERROR(
312
0
              commands_add.push_back(kCommandTypeStartFirst + 5));
313
0
          pos += 8;
314
0
          JXL_RETURN_IF_ERROR(commands_add.push_back(kCommandPredict));
315
0
          int order = 1;
316
0
          int width = 2;
317
0
          int stride = width;
318
0
          JXL_RETURN_IF_ERROR(
319
0
              commands_add.push_back((order << 2) | (width - 1)));
320
0
          JXL_RETURN_IF_ERROR(EncodeVarInt(num, &commands_add));
321
0
          JXL_RETURN_IF_ERROR(PredictAndShuffle(stride, width, order, num, icc,
322
0
                                                size, &pos, &data_add));
323
0
        }
324
0
      }
325
0
    }
326
327
0
    if (tag == kMab_Tag || tag == kMba_Tag) {
328
0
      Tag subTag = DecodeKeyword(icc, size, pos);
329
0
      if (pos + 12 < size && (subTag == kCurvTag || subTag == kVcgtTag) &&
330
0
          DecodeUint32(icc, size, pos + 4) == 0) {
331
0
        uint32_t num = DecodeUint32(icc, size, pos + 8) * 2;
332
0
        if (num > 16 && num < (1 << 28) && pos + 12 + num <= size) {
333
0
          pos += 12;
334
0
          last1 = pos;
335
0
          JXL_RETURN_IF_ERROR(commands_add.push_back(kCommandPredict));
336
0
          int order = 1;
337
0
          int width = 2;
338
0
          int stride = width;
339
0
          JXL_RETURN_IF_ERROR(
340
0
              commands_add.push_back((order << 2) | (width - 1)));
341
0
          JXL_RETURN_IF_ERROR(EncodeVarInt(num, &commands_add));
342
0
          JXL_RETURN_IF_ERROR(PredictAndShuffle(stride, width, order, num, icc,
343
0
                                                size, &pos, &data_add));
344
0
        }
345
0
      }
346
347
0
      if (pos == tagstart + 24 && pos + 4 < size) {
348
        // Note that this value can be remembered for next iterations of the
349
        // loop, so the "pos == clutstart" if below can trigger during a later
350
        // iteration.
351
0
        clutstart = tagstart + DecodeUint32(icc, size, pos);
352
0
      }
353
354
0
      if (pos == clutstart && clutstart + 16 < size) {
355
0
        size_t numi = icc[tagstart + 8];
356
0
        size_t numo = icc[tagstart + 9];
357
0
        size_t width = icc[clutstart + 16];
358
0
        size_t stride = width * numo;
359
0
        size_t num = width * numo;
360
0
        for (size_t i = 0; i < numi && clutstart + i < size; i++) {
361
0
          num *= icc[clutstart + i];
362
0
        }
363
0
        if ((width == 1 || width == 2) && num > 64 && num < (1 << 28) &&
364
0
            pos + num <= size && pos > stride * 4) {
365
0
          JXL_RETURN_IF_ERROR(commands_add.push_back(kCommandPredict));
366
0
          int order = 1;
367
0
          uint8_t flags =
368
0
              (order << 2) | (width - 1) | (stride == width ? 0 : 16);
369
0
          JXL_RETURN_IF_ERROR(commands_add.push_back(flags));
370
0
          if (flags & 16) {
371
0
            JXL_RETURN_IF_ERROR(EncodeVarInt(stride, &commands_add));
372
0
          }
373
0
          JXL_RETURN_IF_ERROR(EncodeVarInt(num, &commands_add));
374
0
          JXL_RETURN_IF_ERROR(PredictAndShuffle(stride, width, order, num, icc,
375
0
                                                size, &pos, &data_add));
376
0
        }
377
0
      }
378
0
    }
379
380
0
    if (commands_add.empty() && data_add.empty() && tag == kGbd_Tag &&
381
0
        tag_sane() && pos == tagstart + 8 && pos + tagsize - 8 <= size &&
382
0
        pos > 16) {
383
0
      size_t width = 4;
384
0
      size_t order = 0;
385
0
      size_t stride = width;
386
0
      size_t num = tagsize - 8;
387
0
      uint8_t flags = (order << 2) | (width - 1) | (stride == width ? 0 : 16);
388
0
      JXL_RETURN_IF_ERROR(commands_add.push_back(kCommandPredict));
389
0
      JXL_RETURN_IF_ERROR(commands_add.push_back(flags));
390
0
      if (flags & 16) {
391
0
        JXL_RETURN_IF_ERROR(EncodeVarInt(stride, &commands_add));
392
0
      }
393
0
      JXL_RETURN_IF_ERROR(EncodeVarInt(num, &commands_add));
394
0
      JXL_RETURN_IF_ERROR(PredictAndShuffle(stride, width, order, num, icc,
395
0
                                            size, &pos, &data_add));
396
0
    }
397
398
0
    if (commands_add.empty() && data_add.empty() && pos + 20 <= size) {
399
0
      Tag subTag = DecodeKeyword(icc, size, pos);
400
0
      if (subTag == kXyz_Tag && DecodeUint32(icc, size, pos + 4) == 0) {
401
0
        JXL_RETURN_IF_ERROR(commands_add.push_back(kCommandXYZ));
402
0
        pos += 8;
403
0
        for (size_t j = 0; j < 12; j++) {
404
0
          JXL_RETURN_IF_ERROR(data_add.push_back(icc[pos++]));
405
0
        }
406
0
      }
407
0
    }
408
409
0
    if (commands_add.empty() && data_add.empty() && pos + 8 <= size) {
410
0
      if (DecodeUint32(icc, size, pos + 4) == 0) {
411
0
        Tag subTag = DecodeKeyword(icc, size, pos);
412
0
        for (size_t i = 0; i < kNumTypeStrings; i++) {
413
0
          if (subTag == *kTypeStrings[i]) {
414
0
            JXL_RETURN_IF_ERROR(
415
0
                commands_add.push_back(kCommandTypeStartFirst + i));
416
0
            pos += 8;
417
0
            break;
418
0
          }
419
0
        }
420
0
      }
421
0
    }
422
423
0
    if (!(commands_add.empty() && data_add.empty()) || pos == size) {
424
0
      if (last0 < last1) {
425
0
        JXL_RETURN_IF_ERROR(commands.push_back(kCommandInsert));
426
0
        JXL_RETURN_IF_ERROR(EncodeVarInt(last1 - last0, &commands));
427
0
        while (last0 < last1) {
428
0
          JXL_RETURN_IF_ERROR(data.push_back(icc[last0++]));
429
0
        }
430
0
      }
431
0
      for (uint8_t b : commands_add) {
432
0
        JXL_RETURN_IF_ERROR(commands.push_back(b));
433
0
      }
434
0
      for (uint8_t b : data_add) {
435
0
        JXL_RETURN_IF_ERROR(data.push_back(b));
436
0
      }
437
0
      last0 = pos;
438
0
    }
439
0
    if (commands_add.empty() && data_add.empty()) {
440
0
      pos++;
441
0
    }
442
0
  }
443
444
0
  JXL_RETURN_IF_ERROR(EncodeVarInt(commands.size(), result));
445
0
  for (uint8_t b : commands) {
446
0
    JXL_RETURN_IF_ERROR(result->push_back(b));
447
0
  }
448
0
  for (uint8_t b : data) {
449
0
    JXL_RETURN_IF_ERROR(result->push_back(b));
450
0
  }
451
452
0
  return true;
453
0
}
454
455
Status WriteICC(const Span<const uint8_t> icc, BitWriter* JXL_RESTRICT writer,
456
0
                LayerType layer, AuxOut* JXL_RESTRICT aux_out) {
457
0
  if (icc.empty()) return JXL_FAILURE("ICC must be non-empty");
458
0
  JxlMemoryManager* memory_manager = writer->memory_manager();
459
0
  PaddedBytes enc{memory_manager};
460
0
  JXL_RETURN_IF_ERROR(PredictICC(icc.data(), icc.size(), &enc));
461
0
  std::vector<std::vector<Token>> tokens(1);
462
0
  JXL_RETURN_IF_ERROR(writer->WithMaxBits(128, layer, aux_out, [&] {
463
0
    return U64Coder::Write(enc.size(), writer);
464
0
  }));
465
466
0
  for (size_t i = 0; i < enc.size(); i++) {
467
0
    tokens[0].emplace_back(
468
0
        ICCANSContext(i, i > 0 ? enc[i - 1] : 0, i > 1 ? enc[i - 2] : 0),
469
0
        enc[i]);
470
0
  }
471
0
  HistogramParams params;
472
0
  params.lz77_method = enc.size() < 16384 ? HistogramParams::LZ77Method::kOptimal
473
0
                                         : HistogramParams::LZ77Method::kLZ77;
474
0
  EntropyEncodingData code;
475
0
  params.force_huffman = true;
476
0
  JXL_ASSIGN_OR_RETURN(size_t cost, BuildAndEncodeHistograms(
477
0
                                        memory_manager, params, kNumICCContexts,
478
0
                                        tokens, &code, writer, layer, aux_out));
479
0
  (void)cost;
480
0
  JXL_RETURN_IF_ERROR(WriteTokens(tokens[0], code, 0, writer, layer, aux_out));
481
0
  return true;
482
0
}
483
484
}  // namespace jxl