Coverage Report

Created: 2025-08-12 07:37

/src/libwebp/src/dec/buffer_dec.c
Line
Count
Source (jump to first uncovered line)
1
// Copyright 2011 Google Inc. All Rights Reserved.
2
//
3
// Use of this source code is governed by a BSD-style license
4
// that can be found in the COPYING file in the root of the source
5
// tree. An additional intellectual property rights grant can be found
6
// in the file PATENTS. All contributing project authors may
7
// be found in the AUTHORS file in the root of the source tree.
8
// -----------------------------------------------------------------------------
9
//
10
// Everything about WebPDecBuffer
11
//
12
// Author: Skal (pascal.massimino@gmail.com)
13
14
#include <assert.h>
15
#include <stdlib.h>
16
#include <string.h>
17
18
#include "src/dec/vp8i_dec.h"
19
#include "src/dec/webpi_dec.h"
20
#include "src/utils/rescaler_utils.h"
21
#include "src/utils/utils.h"
22
#include "src/webp/decode.h"
23
#include "src/webp/types.h"
24
25
//------------------------------------------------------------------------------
26
// WebPDecBuffer
27
28
// Number of bytes per pixel for the different color-spaces.
29
static const uint8_t kModeBpp[MODE_LAST] = {3, 4, 3, 4, 4, 2, 2,  //
30
                                            4, 4, 4, 2,  // pre-multiplied modes
31
                                            1, 1};
32
33
// Convert to an integer to handle both the unsigned/signed enum cases
34
// without the need for casting to remove type limit warnings.
35
2.63k
int IsValidColorspace(int webp_csp_mode) {
36
2.63k
  return (webp_csp_mode >= MODE_RGB && webp_csp_mode < MODE_LAST);
37
2.63k
}
38
39
// strictly speaking, the very last (or first, if flipped) row
40
// doesn't require padding.
41
#define MIN_BUFFER_SIZE(WIDTH, HEIGHT, STRIDE) \
42
1.31k
  ((uint64_t)(STRIDE) * ((HEIGHT) - 1) + (WIDTH))
43
44
1.31k
static VP8StatusCode CheckDecBuffer(const WebPDecBuffer* const buffer) {
45
1.31k
  int ok = 1;
46
1.31k
  const WEBP_CSP_MODE mode = buffer->colorspace;
47
1.31k
  const int width = buffer->width;
48
1.31k
  const int height = buffer->height;
49
1.31k
  if (!IsValidColorspace(mode)) {
50
0
    ok = 0;
51
1.31k
  } else if (!WebPIsRGBMode(mode)) {  // YUV checks
52
0
    const WebPYUVABuffer* const buf = &buffer->u.YUVA;
53
0
    const int uv_width = (width + 1) / 2;
54
0
    const int uv_height = (height + 1) / 2;
55
0
    const int y_stride = abs(buf->y_stride);
56
0
    const int u_stride = abs(buf->u_stride);
57
0
    const int v_stride = abs(buf->v_stride);
58
0
    const int a_stride = abs(buf->a_stride);
59
0
    const uint64_t y_size = MIN_BUFFER_SIZE(width, height, y_stride);
60
0
    const uint64_t u_size = MIN_BUFFER_SIZE(uv_width, uv_height, u_stride);
61
0
    const uint64_t v_size = MIN_BUFFER_SIZE(uv_width, uv_height, v_stride);
62
0
    const uint64_t a_size = MIN_BUFFER_SIZE(width, height, a_stride);
63
0
    ok &= (y_size <= buf->y_size);
64
0
    ok &= (u_size <= buf->u_size);
65
0
    ok &= (v_size <= buf->v_size);
66
0
    ok &= (y_stride >= width);
67
0
    ok &= (u_stride >= uv_width);
68
0
    ok &= (v_stride >= uv_width);
69
0
    ok &= (buf->y != NULL);
70
0
    ok &= (buf->u != NULL);
71
0
    ok &= (buf->v != NULL);
72
0
    if (mode == MODE_YUVA) {
73
0
      ok &= (a_stride >= width);
74
0
      ok &= (a_size <= buf->a_size);
75
0
      ok &= (buf->a != NULL);
76
0
    }
77
1.31k
  } else {  // RGB checks
78
1.31k
    const WebPRGBABuffer* const buf = &buffer->u.RGBA;
79
1.31k
    const int stride = abs(buf->stride);
80
1.31k
    const uint64_t size =
81
1.31k
        MIN_BUFFER_SIZE((uint64_t)width * kModeBpp[mode], height, stride);
82
1.31k
    ok &= (size <= buf->size);
83
1.31k
    ok &= (stride >= width * kModeBpp[mode]);
84
1.31k
    ok &= (buf->rgba != NULL);
85
1.31k
  }
86
1.31k
  return ok ? VP8_STATUS_OK : VP8_STATUS_INVALID_PARAM;
87
1.31k
}
88
#undef MIN_BUFFER_SIZE
89
90
1.31k
static VP8StatusCode AllocateBuffer(WebPDecBuffer* const buffer) {
91
1.31k
  const int w = buffer->width;
92
1.31k
  const int h = buffer->height;
93
1.31k
  const WEBP_CSP_MODE mode = buffer->colorspace;
94
95
1.31k
  if (w <= 0 || h <= 0 || !IsValidColorspace(mode)) {
96
0
    return VP8_STATUS_INVALID_PARAM;
97
0
  }
98
99
1.31k
  if (buffer->is_external_memory <= 0 && buffer->private_memory == NULL) {
100
1.31k
    uint8_t* output;
101
1.31k
    int uv_stride = 0, a_stride = 0;
102
1.31k
    uint64_t uv_size = 0, a_size = 0, total_size;
103
    // We need memory and it hasn't been allocated yet.
104
    // => initialize output buffer, now that dimensions are known.
105
1.31k
    int stride;
106
1.31k
    uint64_t size;
107
108
1.31k
    if ((uint64_t)w * kModeBpp[mode] >= (1ull << 31)) {
109
0
      return VP8_STATUS_INVALID_PARAM;
110
0
    }
111
1.31k
    stride = w * kModeBpp[mode];
112
1.31k
    size = (uint64_t)stride * h;
113
1.31k
    if (!WebPIsRGBMode(mode)) {
114
0
      uv_stride = (w + 1) / 2;
115
0
      uv_size = (uint64_t)uv_stride * ((h + 1) / 2);
116
0
      if (mode == MODE_YUVA) {
117
0
        a_stride = w;
118
0
        a_size = (uint64_t)a_stride * h;
119
0
      }
120
0
    }
121
1.31k
    total_size = size + 2 * uv_size + a_size;
122
123
1.31k
    output = (uint8_t*)WebPSafeMalloc(total_size, sizeof(*output));
124
1.31k
    if (output == NULL) {
125
0
      return VP8_STATUS_OUT_OF_MEMORY;
126
0
    }
127
1.31k
    buffer->private_memory = output;
128
129
1.31k
    if (!WebPIsRGBMode(mode)) {  // YUVA initialization
130
0
      WebPYUVABuffer* const buf = &buffer->u.YUVA;
131
0
      buf->y = output;
132
0
      buf->y_stride = stride;
133
0
      buf->y_size = (size_t)size;
134
0
      buf->u = output + size;
135
0
      buf->u_stride = uv_stride;
136
0
      buf->u_size = (size_t)uv_size;
137
0
      buf->v = output + size + uv_size;
138
0
      buf->v_stride = uv_stride;
139
0
      buf->v_size = (size_t)uv_size;
140
0
      if (mode == MODE_YUVA) {
141
0
        buf->a = output + size + 2 * uv_size;
142
0
      }
143
0
      buf->a_size = (size_t)a_size;
144
0
      buf->a_stride = a_stride;
145
1.31k
    } else {  // RGBA initialization
146
1.31k
      WebPRGBABuffer* const buf = &buffer->u.RGBA;
147
1.31k
      buf->rgba = output;
148
1.31k
      buf->stride = stride;
149
1.31k
      buf->size = (size_t)size;
150
1.31k
    }
151
1.31k
  }
152
1.31k
  return CheckDecBuffer(buffer);
153
1.31k
}
154
155
0
VP8StatusCode WebPFlipBuffer(WebPDecBuffer* const buffer) {
156
0
  if (buffer == NULL) {
157
0
    return VP8_STATUS_INVALID_PARAM;
158
0
  }
159
0
  if (WebPIsRGBMode(buffer->colorspace)) {
160
0
    WebPRGBABuffer* const buf = &buffer->u.RGBA;
161
0
    buf->rgba += (int64_t)(buffer->height - 1) * buf->stride;
162
0
    buf->stride = -buf->stride;
163
0
  } else {
164
0
    WebPYUVABuffer* const buf = &buffer->u.YUVA;
165
0
    const int64_t H = buffer->height;
166
0
    buf->y += (H - 1) * buf->y_stride;
167
0
    buf->y_stride = -buf->y_stride;
168
0
    buf->u += ((H - 1) >> 1) * buf->u_stride;
169
0
    buf->u_stride = -buf->u_stride;
170
0
    buf->v += ((H - 1) >> 1) * buf->v_stride;
171
0
    buf->v_stride = -buf->v_stride;
172
0
    if (buf->a != NULL) {
173
0
      buf->a += (H - 1) * buf->a_stride;
174
0
      buf->a_stride = -buf->a_stride;
175
0
    }
176
0
  }
177
0
  return VP8_STATUS_OK;
178
0
}
179
180
VP8StatusCode WebPAllocateDecBuffer(int width, int height,
181
                                    const WebPDecoderOptions* const options,
182
1.31k
                                    WebPDecBuffer* const buffer) {
183
1.31k
  VP8StatusCode status;
184
1.31k
  if (buffer == NULL || width <= 0 || height <= 0) {
185
0
    return VP8_STATUS_INVALID_PARAM;
186
0
  }
187
1.31k
  if (options != NULL) {  // First, apply options if there is any.
188
1.31k
    if (options->use_cropping) {
189
0
      const int cw = options->crop_width;
190
0
      const int ch = options->crop_height;
191
0
      const int x = options->crop_left & ~1;
192
0
      const int y = options->crop_top & ~1;
193
0
      if (!WebPCheckCropDimensions(width, height, x, y, cw, ch)) {
194
0
        return VP8_STATUS_INVALID_PARAM;  // out of frame boundary.
195
0
      }
196
0
      width = cw;
197
0
      height = ch;
198
0
    }
199
200
1.31k
    if (options->use_scaling) {
201
0
#if !defined(WEBP_REDUCE_SIZE)
202
0
      int scaled_width = options->scaled_width;
203
0
      int scaled_height = options->scaled_height;
204
0
      if (!WebPRescalerGetScaledDimensions(width, height, &scaled_width,
205
0
                                           &scaled_height)) {
206
0
        return VP8_STATUS_INVALID_PARAM;
207
0
      }
208
0
      width = scaled_width;
209
0
      height = scaled_height;
210
#else
211
      return VP8_STATUS_INVALID_PARAM;  // rescaling not supported
212
#endif
213
0
    }
214
1.31k
  }
215
1.31k
  buffer->width = width;
216
1.31k
  buffer->height = height;
217
218
  // Then, allocate buffer for real.
219
1.31k
  status = AllocateBuffer(buffer);
220
1.31k
  if (status != VP8_STATUS_OK) return status;
221
222
  // Use the stride trick if vertical flip is needed.
223
1.31k
  if (options != NULL && options->flip) {
224
0
    status = WebPFlipBuffer(buffer);
225
0
  }
226
1.31k
  return status;
227
1.31k
}
228
229
//------------------------------------------------------------------------------
230
// constructors / destructors
231
232
689
int WebPInitDecBufferInternal(WebPDecBuffer* buffer, int version) {
233
689
  if (WEBP_ABI_IS_INCOMPATIBLE(version, WEBP_DECODER_ABI_VERSION)) {
234
0
    return 0;  // version mismatch
235
0
  }
236
689
  if (buffer == NULL) return 0;
237
689
  memset(buffer, 0, sizeof(*buffer));
238
689
  return 1;
239
689
}
240
241
1.76k
void WebPFreeDecBuffer(WebPDecBuffer* buffer) {
242
1.76k
  if (buffer != NULL) {
243
1.76k
    if (buffer->is_external_memory <= 0) {
244
1.76k
      WebPSafeFree(buffer->private_memory);
245
1.76k
    }
246
1.76k
    buffer->private_memory = NULL;
247
1.76k
  }
248
1.76k
}
249
250
void WebPCopyDecBuffer(const WebPDecBuffer* const src,
251
0
                       WebPDecBuffer* const dst) {
252
0
  if (src != NULL && dst != NULL) {
253
0
    *dst = *src;
254
0
    if (src->private_memory != NULL) {
255
0
      dst->is_external_memory = 1;  // dst buffer doesn't own the memory.
256
0
      dst->private_memory = NULL;
257
0
    }
258
0
  }
259
0
}
260
261
// Copy and transfer ownership from src to dst (beware of parameter order!)
262
0
void WebPGrabDecBuffer(WebPDecBuffer* const src, WebPDecBuffer* const dst) {
263
0
  if (src != NULL && dst != NULL) {
264
0
    *dst = *src;
265
0
    if (src->private_memory != NULL) {
266
0
      src->is_external_memory = 1;  // src relinquishes ownership
267
0
      src->private_memory = NULL;
268
0
    }
269
0
  }
270
0
}
271
272
VP8StatusCode WebPCopyDecBufferPixels(const WebPDecBuffer* const src_buf,
273
0
                                      WebPDecBuffer* const dst_buf) {
274
0
  assert(src_buf != NULL && dst_buf != NULL);
275
0
  assert(src_buf->colorspace == dst_buf->colorspace);
276
277
0
  dst_buf->width = src_buf->width;
278
0
  dst_buf->height = src_buf->height;
279
0
  if (CheckDecBuffer(dst_buf) != VP8_STATUS_OK) {
280
0
    return VP8_STATUS_INVALID_PARAM;
281
0
  }
282
0
  if (WebPIsRGBMode(src_buf->colorspace)) {
283
0
    const WebPRGBABuffer* const src = &src_buf->u.RGBA;
284
0
    const WebPRGBABuffer* const dst = &dst_buf->u.RGBA;
285
0
    WebPCopyPlane(src->rgba, src->stride, dst->rgba, dst->stride,
286
0
                  src_buf->width * kModeBpp[src_buf->colorspace],
287
0
                  src_buf->height);
288
0
  } else {
289
0
    const WebPYUVABuffer* const src = &src_buf->u.YUVA;
290
0
    const WebPYUVABuffer* const dst = &dst_buf->u.YUVA;
291
0
    WebPCopyPlane(src->y, src->y_stride, dst->y, dst->y_stride, src_buf->width,
292
0
                  src_buf->height);
293
0
    WebPCopyPlane(src->u, src->u_stride, dst->u, dst->u_stride,
294
0
                  (src_buf->width + 1) / 2, (src_buf->height + 1) / 2);
295
0
    WebPCopyPlane(src->v, src->v_stride, dst->v, dst->v_stride,
296
0
                  (src_buf->width + 1) / 2, (src_buf->height + 1) / 2);
297
0
    if (WebPIsAlphaMode(src_buf->colorspace)) {
298
0
      WebPCopyPlane(src->a, src->a_stride, dst->a, dst->a_stride,
299
0
                    src_buf->width, src_buf->height);
300
0
    }
301
0
  }
302
0
  return VP8_STATUS_OK;
303
0
}
304
305
int WebPAvoidSlowMemory(const WebPDecBuffer* const output,
306
1.35k
                        const WebPBitstreamFeatures* const features) {
307
1.35k
  assert(output != NULL);
308
1.35k
  return (output->is_external_memory >= 2) &&
309
1.35k
         WebPIsPremultipliedMode(output->colorspace) &&
310
1.35k
         (features != NULL && features->has_alpha);
311
1.35k
}
312
313
//------------------------------------------------------------------------------