Coverage Report

Created: 2025-06-16 07:00

/src/libwebp/src/dec/buffer_dec.c
Line
Count
Source (jump to first uncovered line)
1
// Copyright 2011 Google Inc. All Rights Reserved.
2
//
3
// Use of this source code is governed by a BSD-style license
4
// that can be found in the COPYING file in the root of the source
5
// tree. An additional intellectual property rights grant can be found
6
// in the file PATENTS. All contributing project authors may
7
// be found in the AUTHORS file in the root of the source tree.
8
// -----------------------------------------------------------------------------
9
//
10
// Everything about WebPDecBuffer
11
//
12
// Author: Skal (pascal.massimino@gmail.com)
13
14
#include <assert.h>
15
#include <stdlib.h>
16
#include <string.h>
17
18
#include "src/dec/vp8i_dec.h"
19
#include "src/dec/webpi_dec.h"
20
#include "src/utils/rescaler_utils.h"
21
#include "src/utils/utils.h"
22
#include "src/webp/decode.h"
23
#include "src/webp/types.h"
24
25
//------------------------------------------------------------------------------
26
// WebPDecBuffer
27
28
// Number of bytes per pixel for the different color-spaces.
29
static const uint8_t kModeBpp[MODE_LAST] = {
30
  3, 4, 3, 4, 4, 2, 2,
31
  4, 4, 4, 2,    // pre-multiplied modes
32
  1, 1 };
33
34
// Convert to an integer to handle both the unsigned/signed enum cases
35
// without the need for casting to remove type limit warnings.
36
11.7k
int IsValidColorspace(int webp_csp_mode) {
37
11.7k
  return (webp_csp_mode >= MODE_RGB && webp_csp_mode < MODE_LAST);
38
11.7k
}
39
40
// strictly speaking, the very last (or first, if flipped) row
41
// doesn't require padding.
42
#define MIN_BUFFER_SIZE(WIDTH, HEIGHT, STRIDE)       \
43
5.87k
    ((uint64_t)(STRIDE) * ((HEIGHT) - 1) + (WIDTH))
44
45
5.87k
static VP8StatusCode CheckDecBuffer(const WebPDecBuffer* const buffer) {
46
5.87k
  int ok = 1;
47
5.87k
  const WEBP_CSP_MODE mode = buffer->colorspace;
48
5.87k
  const int width = buffer->width;
49
5.87k
  const int height = buffer->height;
50
5.87k
  if (!IsValidColorspace(mode)) {
51
0
    ok = 0;
52
5.87k
  } else if (!WebPIsRGBMode(mode)) {   // YUV checks
53
0
    const WebPYUVABuffer* const buf = &buffer->u.YUVA;
54
0
    const int uv_width  = (width  + 1) / 2;
55
0
    const int uv_height = (height + 1) / 2;
56
0
    const int y_stride = abs(buf->y_stride);
57
0
    const int u_stride = abs(buf->u_stride);
58
0
    const int v_stride = abs(buf->v_stride);
59
0
    const int a_stride = abs(buf->a_stride);
60
0
    const uint64_t y_size = MIN_BUFFER_SIZE(width, height, y_stride);
61
0
    const uint64_t u_size = MIN_BUFFER_SIZE(uv_width, uv_height, u_stride);
62
0
    const uint64_t v_size = MIN_BUFFER_SIZE(uv_width, uv_height, v_stride);
63
0
    const uint64_t a_size = MIN_BUFFER_SIZE(width, height, a_stride);
64
0
    ok &= (y_size <= buf->y_size);
65
0
    ok &= (u_size <= buf->u_size);
66
0
    ok &= (v_size <= buf->v_size);
67
0
    ok &= (y_stride >= width);
68
0
    ok &= (u_stride >= uv_width);
69
0
    ok &= (v_stride >= uv_width);
70
0
    ok &= (buf->y != NULL);
71
0
    ok &= (buf->u != NULL);
72
0
    ok &= (buf->v != NULL);
73
0
    if (mode == MODE_YUVA) {
74
0
      ok &= (a_stride >= width);
75
0
      ok &= (a_size <= buf->a_size);
76
0
      ok &= (buf->a != NULL);
77
0
    }
78
5.87k
  } else {    // RGB checks
79
5.87k
    const WebPRGBABuffer* const buf = &buffer->u.RGBA;
80
5.87k
    const int stride = abs(buf->stride);
81
5.87k
    const uint64_t size =
82
5.87k
        MIN_BUFFER_SIZE((uint64_t)width * kModeBpp[mode], height, stride);
83
5.87k
    ok &= (size <= buf->size);
84
5.87k
    ok &= (stride >= width * kModeBpp[mode]);
85
5.87k
    ok &= (buf->rgba != NULL);
86
5.87k
  }
87
5.87k
  return ok ? VP8_STATUS_OK : VP8_STATUS_INVALID_PARAM;
88
5.87k
}
89
#undef MIN_BUFFER_SIZE
90
91
5.87k
static VP8StatusCode AllocateBuffer(WebPDecBuffer* const buffer) {
92
5.87k
  const int w = buffer->width;
93
5.87k
  const int h = buffer->height;
94
5.87k
  const WEBP_CSP_MODE mode = buffer->colorspace;
95
96
5.87k
  if (w <= 0 || h <= 0 || !IsValidColorspace(mode)) {
97
0
    return VP8_STATUS_INVALID_PARAM;
98
0
  }
99
100
5.87k
  if (buffer->is_external_memory <= 0 && buffer->private_memory == NULL) {
101
5.87k
    uint8_t* output;
102
5.87k
    int uv_stride = 0, a_stride = 0;
103
5.87k
    uint64_t uv_size = 0, a_size = 0, total_size;
104
    // We need memory and it hasn't been allocated yet.
105
    // => initialize output buffer, now that dimensions are known.
106
5.87k
    int stride;
107
5.87k
    uint64_t size;
108
109
5.87k
    if ((uint64_t)w * kModeBpp[mode] >= (1ull << 31)) {
110
0
      return VP8_STATUS_INVALID_PARAM;
111
0
    }
112
5.87k
    stride = w * kModeBpp[mode];
113
5.87k
    size = (uint64_t)stride * h;
114
5.87k
    if (!WebPIsRGBMode(mode)) {
115
0
      uv_stride = (w + 1) / 2;
116
0
      uv_size = (uint64_t)uv_stride * ((h + 1) / 2);
117
0
      if (mode == MODE_YUVA) {
118
0
        a_stride = w;
119
0
        a_size = (uint64_t)a_stride * h;
120
0
      }
121
0
    }
122
5.87k
    total_size = size + 2 * uv_size + a_size;
123
124
5.87k
    output = (uint8_t*)WebPSafeMalloc(total_size, sizeof(*output));
125
5.87k
    if (output == NULL) {
126
0
      return VP8_STATUS_OUT_OF_MEMORY;
127
0
    }
128
5.87k
    buffer->private_memory = output;
129
130
5.87k
    if (!WebPIsRGBMode(mode)) {   // YUVA initialization
131
0
      WebPYUVABuffer* const buf = &buffer->u.YUVA;
132
0
      buf->y = output;
133
0
      buf->y_stride = stride;
134
0
      buf->y_size = (size_t)size;
135
0
      buf->u = output + size;
136
0
      buf->u_stride = uv_stride;
137
0
      buf->u_size = (size_t)uv_size;
138
0
      buf->v = output + size + uv_size;
139
0
      buf->v_stride = uv_stride;
140
0
      buf->v_size = (size_t)uv_size;
141
0
      if (mode == MODE_YUVA) {
142
0
        buf->a = output + size + 2 * uv_size;
143
0
      }
144
0
      buf->a_size = (size_t)a_size;
145
0
      buf->a_stride = a_stride;
146
5.87k
    } else {  // RGBA initialization
147
5.87k
      WebPRGBABuffer* const buf = &buffer->u.RGBA;
148
5.87k
      buf->rgba = output;
149
5.87k
      buf->stride = stride;
150
5.87k
      buf->size = (size_t)size;
151
5.87k
    }
152
5.87k
  }
153
5.87k
  return CheckDecBuffer(buffer);
154
5.87k
}
155
156
0
VP8StatusCode WebPFlipBuffer(WebPDecBuffer* const buffer) {
157
0
  if (buffer == NULL) {
158
0
    return VP8_STATUS_INVALID_PARAM;
159
0
  }
160
0
  if (WebPIsRGBMode(buffer->colorspace)) {
161
0
    WebPRGBABuffer* const buf = &buffer->u.RGBA;
162
0
    buf->rgba += (int64_t)(buffer->height - 1) * buf->stride;
163
0
    buf->stride = -buf->stride;
164
0
  } else {
165
0
    WebPYUVABuffer* const buf = &buffer->u.YUVA;
166
0
    const int64_t H = buffer->height;
167
0
    buf->y += (H - 1) * buf->y_stride;
168
0
    buf->y_stride = -buf->y_stride;
169
0
    buf->u += ((H - 1) >> 1) * buf->u_stride;
170
0
    buf->u_stride = -buf->u_stride;
171
0
    buf->v += ((H - 1) >> 1) * buf->v_stride;
172
0
    buf->v_stride = -buf->v_stride;
173
0
    if (buf->a != NULL) {
174
0
      buf->a += (H - 1) * buf->a_stride;
175
0
      buf->a_stride = -buf->a_stride;
176
0
    }
177
0
  }
178
0
  return VP8_STATUS_OK;
179
0
}
180
181
VP8StatusCode WebPAllocateDecBuffer(int width, int height,
182
                                    const WebPDecoderOptions* const options,
183
5.87k
                                    WebPDecBuffer* const buffer) {
184
5.87k
  VP8StatusCode status;
185
5.87k
  if (buffer == NULL || width <= 0 || height <= 0) {
186
0
    return VP8_STATUS_INVALID_PARAM;
187
0
  }
188
5.87k
  if (options != NULL) {    // First, apply options if there is any.
189
5.87k
    if (options->use_cropping) {
190
0
      const int cw = options->crop_width;
191
0
      const int ch = options->crop_height;
192
0
      const int x = options->crop_left & ~1;
193
0
      const int y = options->crop_top & ~1;
194
0
      if (!WebPCheckCropDimensions(width, height, x, y, cw, ch)) {
195
0
        return VP8_STATUS_INVALID_PARAM;   // out of frame boundary.
196
0
      }
197
0
      width = cw;
198
0
      height = ch;
199
0
    }
200
201
5.87k
    if (options->use_scaling) {
202
0
#if !defined(WEBP_REDUCE_SIZE)
203
0
      int scaled_width = options->scaled_width;
204
0
      int scaled_height = options->scaled_height;
205
0
      if (!WebPRescalerGetScaledDimensions(
206
0
              width, height, &scaled_width, &scaled_height)) {
207
0
        return VP8_STATUS_INVALID_PARAM;
208
0
      }
209
0
      width = scaled_width;
210
0
      height = scaled_height;
211
#else
212
      return VP8_STATUS_INVALID_PARAM;   // rescaling not supported
213
#endif
214
0
    }
215
5.87k
  }
216
5.87k
  buffer->width = width;
217
5.87k
  buffer->height = height;
218
219
  // Then, allocate buffer for real.
220
5.87k
  status = AllocateBuffer(buffer);
221
5.87k
  if (status != VP8_STATUS_OK) return status;
222
223
  // Use the stride trick if vertical flip is needed.
224
5.87k
  if (options != NULL && options->flip) {
225
0
    status = WebPFlipBuffer(buffer);
226
0
  }
227
5.87k
  return status;
228
5.87k
}
229
230
//------------------------------------------------------------------------------
231
// constructors / destructors
232
233
6.61k
int WebPInitDecBufferInternal(WebPDecBuffer* buffer, int version) {
234
6.61k
  if (WEBP_ABI_IS_INCOMPATIBLE(version, WEBP_DECODER_ABI_VERSION)) {
235
0
    return 0;  // version mismatch
236
0
  }
237
6.61k
  if (buffer == NULL) return 0;
238
6.61k
  memset(buffer, 0, sizeof(*buffer));
239
6.61k
  return 1;
240
6.61k
}
241
242
9.21k
void WebPFreeDecBuffer(WebPDecBuffer* buffer) {
243
9.21k
  if (buffer != NULL) {
244
9.21k
    if (buffer->is_external_memory <= 0) {
245
9.21k
      WebPSafeFree(buffer->private_memory);
246
9.21k
    }
247
9.21k
    buffer->private_memory = NULL;
248
9.21k
  }
249
9.21k
}
250
251
void WebPCopyDecBuffer(const WebPDecBuffer* const src,
252
0
                       WebPDecBuffer* const dst) {
253
0
  if (src != NULL && dst != NULL) {
254
0
    *dst = *src;
255
0
    if (src->private_memory != NULL) {
256
0
      dst->is_external_memory = 1;   // dst buffer doesn't own the memory.
257
0
      dst->private_memory = NULL;
258
0
    }
259
0
  }
260
0
}
261
262
// Copy and transfer ownership from src to dst (beware of parameter order!)
263
0
void WebPGrabDecBuffer(WebPDecBuffer* const src, WebPDecBuffer* const dst) {
264
0
  if (src != NULL && dst != NULL) {
265
0
    *dst = *src;
266
0
    if (src->private_memory != NULL) {
267
0
      src->is_external_memory = 1;   // src relinquishes ownership
268
0
      src->private_memory = NULL;
269
0
    }
270
0
  }
271
0
}
272
273
VP8StatusCode WebPCopyDecBufferPixels(const WebPDecBuffer* const src_buf,
274
0
                                      WebPDecBuffer* const dst_buf) {
275
0
  assert(src_buf != NULL && dst_buf != NULL);
276
0
  assert(src_buf->colorspace == dst_buf->colorspace);
277
278
0
  dst_buf->width = src_buf->width;
279
0
  dst_buf->height = src_buf->height;
280
0
  if (CheckDecBuffer(dst_buf) != VP8_STATUS_OK) {
281
0
    return VP8_STATUS_INVALID_PARAM;
282
0
  }
283
0
  if (WebPIsRGBMode(src_buf->colorspace)) {
284
0
    const WebPRGBABuffer* const src = &src_buf->u.RGBA;
285
0
    const WebPRGBABuffer* const dst = &dst_buf->u.RGBA;
286
0
    WebPCopyPlane(src->rgba, src->stride, dst->rgba, dst->stride,
287
0
                  src_buf->width * kModeBpp[src_buf->colorspace],
288
0
                  src_buf->height);
289
0
  } else {
290
0
    const WebPYUVABuffer* const src = &src_buf->u.YUVA;
291
0
    const WebPYUVABuffer* const dst = &dst_buf->u.YUVA;
292
0
    WebPCopyPlane(src->y, src->y_stride, dst->y, dst->y_stride,
293
0
                  src_buf->width, src_buf->height);
294
0
    WebPCopyPlane(src->u, src->u_stride, dst->u, dst->u_stride,
295
0
                  (src_buf->width + 1) / 2, (src_buf->height + 1) / 2);
296
0
    WebPCopyPlane(src->v, src->v_stride, dst->v, dst->v_stride,
297
0
                  (src_buf->width + 1) / 2, (src_buf->height + 1) / 2);
298
0
    if (WebPIsAlphaMode(src_buf->colorspace)) {
299
0
      WebPCopyPlane(src->a, src->a_stride, dst->a, dst->a_stride,
300
0
                    src_buf->width, src_buf->height);
301
0
    }
302
0
  }
303
0
  return VP8_STATUS_OK;
304
0
}
305
306
int WebPAvoidSlowMemory(const WebPDecBuffer* const output,
307
6.52k
                        const WebPBitstreamFeatures* const features) {
308
6.52k
  assert(output != NULL);
309
6.52k
  return (output->is_external_memory >= 2) &&
310
6.52k
         WebPIsPremultipliedMode(output->colorspace) &&
311
6.52k
         (features != NULL && features->has_alpha);
312
6.52k
}
313
314
//------------------------------------------------------------------------------