Coverage Report

Created: 2026-10-14 06:45

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libjxl/lib/jxl/box_content_decoder.cc
Line
Count
Source
1
// Copyright (c) the JPEG XL Project Authors. All rights reserved.
2
//
3
// Use of this source code is governed by a BSD-style
4
// license that can be found in the LICENSE file.
5
6
#include "lib/jxl/box_content_decoder.h"
7
8
#include <brotli/decode.h>
9
#include <jxl/decode.h>
10
11
#include <algorithm>
12
#include <cstddef>
13
#include <cstdint>
14
#include <cstring>
15
16
#include "lib/jxl/base/sanitizers.h"
17
18
namespace jxl {
19
20
4.17k
JxlBoxContentDecoder::JxlBoxContentDecoder() = default;
21
22
4.17k
JxlBoxContentDecoder::~JxlBoxContentDecoder() {
23
4.17k
  if (brotli_dec) {
24
191
    BrotliDecoderDestroyInstance(brotli_dec);
25
191
  }
26
4.17k
}
27
28
void JxlBoxContentDecoder::StartBox(bool brob_decode, bool box_until_eof,
29
8.03k
                                    size_t contents_size) {
30
8.03k
  if (brotli_dec) {
31
13
    BrotliDecoderDestroyInstance(brotli_dec);
32
13
    brotli_dec = nullptr;
33
13
  }
34
8.03k
  header_done_ = false;
35
8.03k
  brob_decode_ = brob_decode;
36
8.03k
  box_until_eof_ = box_until_eof;
37
8.03k
  remaining_ = box_until_eof ? 0 : contents_size;
38
8.03k
  pos_ = 0;
39
8.03k
}
40
41
JxlDecoderStatus JxlBoxContentDecoder::Process(const uint8_t* next_in,
42
                                               size_t avail_in, size_t box_pos,
43
                                               uint8_t** next_out,
44
30.1k
                                               size_t* avail_out) {
45
  // The caller provides `box_pos` as the current position (in bytes) within
46
  // the box contents corresponding to `next_in`. Our internal `pos_` tracks
47
  // how many bytes of box contents have been consumed/processed so far.
48
  // If `box_pos` ever exceeds `pos_`, adjusting by `pos_ - box_pos` would
49
  // underflow and cause out-of-bounds reads.
50
30.1k
  if (box_pos > pos_) return JXL_DEC_ERROR;
51
30.1k
  const size_t offset = pos_ - box_pos;
52
30.1k
  if (offset > avail_in) return JXL_DEC_ERROR;
53
30.1k
  next_in += offset;
54
30.1k
  avail_in -= offset;
55
56
30.1k
  if (brob_decode_) {
57
25.2k
    if (!header_done_) {
58
204
      if (avail_in < 4) return JXL_DEC_NEED_MORE_INPUT;
59
204
      if (!box_until_eof_) {
60
82
        if (remaining_ < 4) return JXL_DEC_ERROR;
61
82
        remaining_ -= 4;
62
82
      }
63
204
      next_in += 4;
64
204
      avail_in -= 4;
65
204
      pos_ += 4;
66
204
      header_done_ = true;
67
204
    }
68
69
25.2k
    if (!brotli_dec) {
70
204
      brotli_dec = BrotliDecoderCreateInstance(nullptr, nullptr, nullptr);
71
204
    }
72
73
25.2k
    size_t avail_in_brotli = avail_in;
74
25.2k
    if (!box_until_eof_) avail_in_brotli = std::min<size_t>(avail_in_brotli, remaining_);
75
25.2k
    const uint8_t* next_in_before = next_in;
76
25.2k
    uint8_t* next_out_before = *next_out;
77
25.2k
    msan::MemoryIsInitialized(next_in, avail_in_brotli);
78
25.2k
    BrotliDecoderResult res = BrotliDecoderDecompressStream(
79
25.2k
        brotli_dec, &avail_in_brotli, &next_in, avail_out, next_out, nullptr);
80
25.2k
    size_t consumed = next_in - next_in_before;
81
25.2k
    size_t produced = *next_out - next_out_before;
82
25.2k
    if (res == BROTLI_DECODER_RESULT_ERROR) {
83
67
      return JXL_DEC_ERROR;
84
67
    }
85
25.2k
    msan::UnpoisonMemory(next_out_before, produced);
86
25.2k
    pos_ += consumed;
87
25.2k
    if (!box_until_eof_) {
88
10.2k
      remaining_ -= consumed;
89
10.2k
      if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT && remaining_ == 0) {
90
17
        return JXL_DEC_ERROR;
91
17
      }
92
10.2k
    }
93
25.1k
    if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT) {
94
90
      return JXL_DEC_NEED_MORE_INPUT;
95
90
    }
96
25.0k
    if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT) {
97
25.0k
      return JXL_DEC_BOX_NEED_MORE_OUTPUT;
98
25.0k
    }
99
30
    if (res == BROTLI_DECODER_RESULT_SUCCESS) {
100
30
      if (!box_until_eof_ && remaining_ != 0) return JXL_DEC_ERROR;
101
26
      return JXL_DEC_BOX_COMPLETE;
102
30
    }
103
    // unknown Brotli result
104
0
    return JXL_DEC_ERROR;
105
4.91k
  } else {
106
    // remaining box bytes as seen from dec->file_pos
107
4.91k
    size_t can_read = avail_in;
108
4.91k
    if (!box_until_eof_) can_read = std::min<size_t>(can_read, remaining_);
109
4.91k
    size_t to_write = std::min<size_t>(can_read, *avail_out);
110
4.91k
    memcpy(*next_out, next_in, to_write);
111
112
4.91k
    *next_out += to_write;
113
4.91k
    *avail_out -= to_write;
114
4.91k
    if (!box_until_eof_) remaining_ -= to_write;
115
4.91k
    pos_ += to_write;
116
117
4.91k
    if (to_write < can_read) return JXL_DEC_BOX_NEED_MORE_OUTPUT;
118
119
1.40k
    if (!box_until_eof_ && remaining_ > 0) return JXL_DEC_NEED_MORE_INPUT;
120
121
1.40k
    return JXL_DEC_BOX_COMPLETE;
122
1.40k
  }
123
30.1k
}
124
}  // namespace jxl