Coverage Report

Created: 2026-07-25 07:03

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libjxl/lib/jxl/box_content_decoder.cc
Line
Count
Source
1
// Copyright (c) the JPEG XL Project Authors. All rights reserved.
2
//
3
// Use of this source code is governed by a BSD-style
4
// license that can be found in the LICENSE file.
5
6
#include "lib/jxl/box_content_decoder.h"
7
8
#include <brotli/decode.h>
9
#include <jxl/decode.h>
10
11
#include <algorithm>
12
#include <cstddef>
13
#include <cstdint>
14
#include <cstring>
15
16
#include "lib/jxl/base/sanitizers.h"
17
18
namespace jxl {
19
20
2.90k
JxlBoxContentDecoder::JxlBoxContentDecoder() = default;
21
22
2.90k
JxlBoxContentDecoder::~JxlBoxContentDecoder() {
23
2.90k
  if (brotli_dec) {
24
179
    BrotliDecoderDestroyInstance(brotli_dec);
25
179
  }
26
2.90k
}
27
28
void JxlBoxContentDecoder::StartBox(bool brob_decode, bool box_until_eof,
29
5.83k
                                    size_t contents_size) {
30
5.83k
  if (brotli_dec) {
31
16
    BrotliDecoderDestroyInstance(brotli_dec);
32
16
    brotli_dec = nullptr;
33
16
  }
34
5.83k
  header_done_ = false;
35
5.83k
  brob_decode_ = brob_decode;
36
5.83k
  box_until_eof_ = box_until_eof;
37
5.83k
  remaining_ = box_until_eof ? 0 : contents_size;
38
5.83k
  pos_ = 0;
39
5.83k
}
40
41
JxlDecoderStatus JxlBoxContentDecoder::Process(const uint8_t* next_in,
42
                                               size_t avail_in, size_t box_pos,
43
                                               uint8_t** next_out,
44
22.2k
                                               size_t* avail_out) {
45
  // The caller provides `box_pos` as the current position (in bytes) within
46
  // the box contents corresponding to `next_in`. Our internal `pos_` tracks
47
  // how many bytes of box contents have been consumed/processed so far.
48
  // If `box_pos` ever exceeds `pos_`, adjusting by `pos_ - box_pos` would
49
  // underflow and cause out-of-bounds reads.
50
22.2k
  if (box_pos > pos_) return JXL_DEC_ERROR;
51
22.2k
  const size_t offset = pos_ - box_pos;
52
22.2k
  if (offset > avail_in) return JXL_DEC_ERROR;
53
22.2k
  next_in += offset;
54
22.2k
  avail_in -= offset;
55
56
22.2k
  if (brob_decode_) {
57
18.8k
    if (!header_done_) {
58
195
      if (avail_in < 4) return JXL_DEC_NEED_MORE_INPUT;
59
195
      if (!box_until_eof_) {
60
86
        if (remaining_ < 4) return JXL_DEC_ERROR;
61
86
        remaining_ -= 4;
62
86
      }
63
195
      next_in += 4;
64
195
      avail_in -= 4;
65
195
      pos_ += 4;
66
195
      header_done_ = true;
67
195
    }
68
69
18.8k
    if (!brotli_dec) {
70
195
      brotli_dec = BrotliDecoderCreateInstance(nullptr, nullptr, nullptr);
71
195
    }
72
73
18.8k
    size_t avail_in_brotli = avail_in;
74
18.8k
    if (!box_until_eof_) avail_in_brotli = std::min<size_t>(avail_in_brotli, remaining_);
75
18.8k
    const uint8_t* next_in_before = next_in;
76
18.8k
    uint8_t* next_out_before = *next_out;
77
18.8k
    msan::MemoryIsInitialized(next_in, avail_in_brotli);
78
18.8k
    BrotliDecoderResult res = BrotliDecoderDecompressStream(
79
18.8k
        brotli_dec, &avail_in_brotli, &next_in, avail_out, next_out, nullptr);
80
18.8k
    size_t consumed = next_in - next_in_before;
81
18.8k
    size_t produced = *next_out - next_out_before;
82
18.8k
    if (res == BROTLI_DECODER_RESULT_ERROR) {
83
61
      return JXL_DEC_ERROR;
84
61
    }
85
18.7k
    msan::UnpoisonMemory(next_out_before, produced);
86
18.7k
    pos_ += consumed;
87
18.7k
    if (!box_until_eof_) {
88
11.2k
      remaining_ -= consumed;
89
11.2k
      if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT && remaining_ == 0) {
90
23
        return JXL_DEC_ERROR;
91
23
      }
92
11.2k
    }
93
18.7k
    if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT) {
94
82
      return JXL_DEC_NEED_MORE_INPUT;
95
82
    }
96
18.6k
    if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT) {
97
18.6k
      return JXL_DEC_BOX_NEED_MORE_OUTPUT;
98
18.6k
    }
99
29
    if (res == BROTLI_DECODER_RESULT_SUCCESS) {
100
29
      if (!box_until_eof_ && remaining_ != 0) return JXL_DEC_ERROR;
101
27
      return JXL_DEC_BOX_COMPLETE;
102
29
    }
103
    // unknown Brotli result
104
0
    return JXL_DEC_ERROR;
105
3.41k
  } else {
106
    // remaining box bytes as seen from dec->file_pos
107
3.41k
    size_t can_read = avail_in;
108
3.41k
    if (!box_until_eof_) can_read = std::min<size_t>(can_read, remaining_);
109
3.41k
    size_t to_write = std::min<size_t>(can_read, *avail_out);
110
3.41k
    memcpy(*next_out, next_in, to_write);
111
112
3.41k
    *next_out += to_write;
113
3.41k
    *avail_out -= to_write;
114
3.41k
    if (!box_until_eof_) remaining_ -= to_write;
115
3.41k
    pos_ += to_write;
116
117
3.41k
    if (to_write < can_read) return JXL_DEC_BOX_NEED_MORE_OUTPUT;
118
119
989
    if (!box_until_eof_ && remaining_ > 0) return JXL_DEC_NEED_MORE_INPUT;
120
121
988
    return JXL_DEC_BOX_COMPLETE;
122
989
  }
123
22.2k
}
124
}  // namespace jxl