Coverage Report

Created: 2026-05-16 07:22

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libjxl/lib/jxl/box_content_decoder.cc
Line
Count
Source
1
// Copyright (c) the JPEG XL Project Authors. All rights reserved.
2
//
3
// Use of this source code is governed by a BSD-style
4
// license that can be found in the LICENSE file.
5
6
#include "lib/jxl/box_content_decoder.h"
7
8
#include <brotli/decode.h>
9
#include <jxl/decode.h>
10
11
#include <algorithm>
12
#include <cstddef>
13
#include <cstdint>
14
#include <cstring>
15
16
#include "lib/jxl/base/sanitizers.h"
17
18
namespace jxl {
19
20
37.8k
JxlBoxContentDecoder::JxlBoxContentDecoder() = default;
21
22
37.8k
JxlBoxContentDecoder::~JxlBoxContentDecoder() {
23
37.8k
  if (brotli_dec) {
24
0
    BrotliDecoderDestroyInstance(brotli_dec);
25
0
  }
26
37.8k
}
27
28
void JxlBoxContentDecoder::StartBox(bool brob_decode, bool box_until_eof,
29
1.34k
                                    size_t contents_size) {
30
1.34k
  if (brotli_dec) {
31
0
    BrotliDecoderDestroyInstance(brotli_dec);
32
0
    brotli_dec = nullptr;
33
0
  }
34
1.34k
  header_done_ = false;
35
1.34k
  brob_decode_ = brob_decode;
36
1.34k
  box_until_eof_ = box_until_eof;
37
1.34k
  remaining_ = box_until_eof ? 0 : contents_size;
38
1.34k
  pos_ = 0;
39
1.34k
}
40
41
JxlDecoderStatus JxlBoxContentDecoder::Process(const uint8_t* next_in,
42
                                               size_t avail_in, size_t box_pos,
43
                                               uint8_t** next_out,
44
127
                                               size_t* avail_out) {
45
  // The caller provides `box_pos` as the current position (in bytes) within
46
  // the box contents corresponding to `next_in`. Our internal `pos_` tracks
47
  // how many bytes of box contents have been consumed/processed so far.
48
  // If `box_pos` ever exceeds `pos_`, adjusting by `pos_ - box_pos` would
49
  // underflow and cause out-of-bounds reads.
50
127
  if (box_pos > pos_) return JXL_DEC_ERROR;
51
127
  const size_t offset = pos_ - box_pos;
52
127
  if (offset > avail_in) return JXL_DEC_ERROR;
53
127
  next_in += offset;
54
127
  avail_in -= offset;
55
56
127
  if (brob_decode_) {
57
0
    if (!header_done_) {
58
0
      if (avail_in < 4) return JXL_DEC_NEED_MORE_INPUT;
59
0
      if (!box_until_eof_) {
60
0
        if (remaining_ < 4) return JXL_DEC_ERROR;
61
0
        remaining_ -= 4;
62
0
      }
63
0
      next_in += 4;
64
0
      avail_in -= 4;
65
0
      pos_ += 4;
66
0
      header_done_ = true;
67
0
    }
68
69
0
    if (!brotli_dec) {
70
0
      brotli_dec = BrotliDecoderCreateInstance(nullptr, nullptr, nullptr);
71
0
    }
72
73
0
    size_t avail_in_brotli = avail_in;
74
0
    if (!box_until_eof_) avail_in_brotli = std::min<size_t>(avail_in_brotli, remaining_);
75
0
    const uint8_t* next_in_before = next_in;
76
0
    uint8_t* next_out_before = *next_out;
77
0
    msan::MemoryIsInitialized(next_in, avail_in_brotli);
78
0
    BrotliDecoderResult res = BrotliDecoderDecompressStream(
79
0
        brotli_dec, &avail_in_brotli, &next_in, avail_out, next_out, nullptr);
80
0
    size_t consumed = next_in - next_in_before;
81
0
    size_t produced = *next_out - next_out_before;
82
0
    if (res == BROTLI_DECODER_RESULT_ERROR) {
83
0
      return JXL_DEC_ERROR;
84
0
    }
85
0
    msan::UnpoisonMemory(next_out_before, produced);
86
0
    pos_ += consumed;
87
0
    if (!box_until_eof_) {
88
0
      remaining_ -= consumed;
89
0
      if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT && remaining_ == 0) {
90
0
        return JXL_DEC_ERROR;
91
0
      }
92
0
    }
93
0
    if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT) {
94
0
      return JXL_DEC_NEED_MORE_INPUT;
95
0
    }
96
0
    if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT) {
97
0
      return JXL_DEC_BOX_NEED_MORE_OUTPUT;
98
0
    }
99
0
    if (res == BROTLI_DECODER_RESULT_SUCCESS) {
100
0
      if (!box_until_eof_ && remaining_ != 0) return JXL_DEC_ERROR;
101
0
      return JXL_DEC_BOX_COMPLETE;
102
0
    }
103
    // unknown Brotli result
104
0
    return JXL_DEC_ERROR;
105
127
  } else {
106
    // remaining box bytes as seen from dec->file_pos
107
127
    size_t can_read = avail_in;
108
127
    if (!box_until_eof_) can_read = std::min<size_t>(can_read, remaining_);
109
127
    size_t to_write = std::min<size_t>(can_read, *avail_out);
110
127
    memcpy(*next_out, next_in, to_write);
111
112
127
    *next_out += to_write;
113
127
    *avail_out -= to_write;
114
127
    if (!box_until_eof_) remaining_ -= to_write;
115
127
    pos_ += to_write;
116
117
127
    if (to_write < can_read) return JXL_DEC_BOX_NEED_MORE_OUTPUT;
118
119
127
    if (!box_until_eof_ && remaining_ > 0) return JXL_DEC_NEED_MORE_INPUT;
120
121
91
    return JXL_DEC_BOX_COMPLETE;
122
127
  }
123
127
}
124
}  // namespace jxl