Coverage Report

Created: 2024-06-18 06:05

/src/libjpeg-turbo/jdhuff.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * jdhuff.c
3
 *
4
 * This file was part of the Independent JPEG Group's software:
5
 * Copyright (C) 1991-1997, Thomas G. Lane.
6
 * Lossless JPEG Modifications:
7
 * Copyright (C) 1999, Ken Murchison.
8
 * libjpeg-turbo Modifications:
9
 * Copyright (C) 2009-2011, 2016, 2018-2019, 2022, D. R. Commander.
10
 * Copyright (C) 2018, Matthias Räncker.
11
 * For conditions of distribution and use, see the accompanying README.ijg
12
 * file.
13
 *
14
 * This file contains Huffman entropy decoding routines.
15
 *
16
 * Much of the complexity here has to do with supporting input suspension.
17
 * If the data source module demands suspension, we want to be able to back
18
 * up to the start of the current MCU.  To do this, we copy state variables
19
 * into local working storage, and update them back to the permanent
20
 * storage only upon successful completion of an MCU.
21
 *
22
 * NOTE: All referenced figures are from
23
 * Recommendation ITU-T T.81 (1992) | ISO/IEC 10918-1:1994.
24
 */
25
26
#define JPEG_INTERNALS
27
#include "jinclude.h"
28
#include "jpeglib.h"
29
#include "jdhuff.h"             /* Declarations shared with jd*huff.c */
30
#include "jpegapicomp.h"
31
#include "jstdhuff.c"
32
33
34
/*
35
 * Expanded entropy decoder object for Huffman decoding.
36
 *
37
 * The savable_state subrecord contains fields that change within an MCU,
38
 * but must not be updated permanently until we complete the MCU.
39
 */
40
41
typedef struct {
42
  int last_dc_val[MAX_COMPS_IN_SCAN]; /* last DC coef for each component */
43
} savable_state;
44
45
typedef struct {
46
  struct jpeg_entropy_decoder pub; /* public fields */
47
48
  /* These fields are loaded into local variables at start of each MCU.
49
   * In case of suspension, we exit WITHOUT updating them.
50
   */
51
  bitread_perm_state bitstate;  /* Bit buffer at start of MCU */
52
  savable_state saved;          /* Other state at start of MCU */
53
54
  /* These fields are NOT loaded into local working state. */
55
  unsigned int restarts_to_go;  /* MCUs left in this restart interval */
56
57
  /* Pointers to derived tables (these workspaces have image lifespan) */
58
  d_derived_tbl *dc_derived_tbls[NUM_HUFF_TBLS];
59
  d_derived_tbl *ac_derived_tbls[NUM_HUFF_TBLS];
60
61
  /* Precalculated info set up by start_pass for use in decode_mcu: */
62
63
  /* Pointers to derived tables to be used for each block within an MCU */
64
  d_derived_tbl *dc_cur_tbls[D_MAX_BLOCKS_IN_MCU];
65
  d_derived_tbl *ac_cur_tbls[D_MAX_BLOCKS_IN_MCU];
66
  /* Whether we care about the DC and AC coefficient values for each block */
67
  boolean dc_needed[D_MAX_BLOCKS_IN_MCU];
68
  boolean ac_needed[D_MAX_BLOCKS_IN_MCU];
69
} huff_entropy_decoder;
70
71
typedef huff_entropy_decoder *huff_entropy_ptr;
72
73
74
/*
75
 * Initialize for a Huffman-compressed scan.
76
 */
77
78
METHODDEF(void)
79
start_pass_huff_decoder(j_decompress_ptr cinfo)
80
0
{
81
0
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
82
0
  int ci, blkn, dctbl, actbl;
83
0
  d_derived_tbl **pdtbl;
84
0
  jpeg_component_info *compptr;
85
86
  /* Check that the scan parameters Ss, Se, Ah/Al are OK for sequential JPEG.
87
   * This ought to be an error condition, but we make it a warning because
88
   * there are some baseline files out there with all zeroes in these bytes.
89
   */
90
0
  if (cinfo->Ss != 0 || cinfo->Se != DCTSIZE2 - 1 ||
91
0
      cinfo->Ah != 0 || cinfo->Al != 0)
92
0
    WARNMS(cinfo, JWRN_NOT_SEQUENTIAL);
93
94
0
  for (ci = 0; ci < cinfo->comps_in_scan; ci++) {
95
0
    compptr = cinfo->cur_comp_info[ci];
96
0
    dctbl = compptr->dc_tbl_no;
97
0
    actbl = compptr->ac_tbl_no;
98
    /* Compute derived values for Huffman tables */
99
    /* We may do this more than once for a table, but it's not expensive */
100
0
    pdtbl = (d_derived_tbl **)(entropy->dc_derived_tbls) + dctbl;
101
0
    jpeg_make_d_derived_tbl(cinfo, TRUE, dctbl, pdtbl);
102
0
    pdtbl = (d_derived_tbl **)(entropy->ac_derived_tbls) + actbl;
103
0
    jpeg_make_d_derived_tbl(cinfo, FALSE, actbl, pdtbl);
104
    /* Initialize DC predictions to 0 */
105
0
    entropy->saved.last_dc_val[ci] = 0;
106
0
  }
107
108
  /* Precalculate decoding info for each block in an MCU of this scan */
109
0
  for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
110
0
    ci = cinfo->MCU_membership[blkn];
111
0
    compptr = cinfo->cur_comp_info[ci];
112
    /* Precalculate which table to use for each block */
113
0
    entropy->dc_cur_tbls[blkn] = entropy->dc_derived_tbls[compptr->dc_tbl_no];
114
0
    entropy->ac_cur_tbls[blkn] = entropy->ac_derived_tbls[compptr->ac_tbl_no];
115
    /* Decide whether we really care about the coefficient values */
116
0
    if (compptr->component_needed) {
117
0
      entropy->dc_needed[blkn] = TRUE;
118
      /* we don't need the ACs if producing a 1/8th-size image */
119
0
      entropy->ac_needed[blkn] = (compptr->_DCT_scaled_size > 1);
120
0
    } else {
121
0
      entropy->dc_needed[blkn] = entropy->ac_needed[blkn] = FALSE;
122
0
    }
123
0
  }
124
125
  /* Initialize bitread state variables */
126
0
  entropy->bitstate.bits_left = 0;
127
0
  entropy->bitstate.get_buffer = 0; /* unnecessary, but keeps Purify quiet */
128
0
  entropy->pub.insufficient_data = FALSE;
129
130
  /* Initialize restart counter */
131
0
  entropy->restarts_to_go = cinfo->restart_interval;
132
0
}
133
134
135
/*
136
 * Compute the derived values for a Huffman table.
137
 * This routine also performs some validation checks on the table.
138
 *
139
 * Note this is also used by jdphuff.c and jdlhuff.c.
140
 */
141
142
GLOBAL(void)
143
jpeg_make_d_derived_tbl(j_decompress_ptr cinfo, boolean isDC, int tblno,
144
                        d_derived_tbl **pdtbl)
145
0
{
146
0
  JHUFF_TBL *htbl;
147
0
  d_derived_tbl *dtbl;
148
0
  int p, i, l, si, numsymbols;
149
0
  int lookbits, ctr;
150
0
  char huffsize[257];
151
0
  unsigned int huffcode[257];
152
0
  unsigned int code;
153
154
  /* Note that huffsize[] and huffcode[] are filled in code-length order,
155
   * paralleling the order of the symbols themselves in htbl->huffval[].
156
   */
157
158
  /* Find the input Huffman table */
159
0
  if (tblno < 0 || tblno >= NUM_HUFF_TBLS)
160
0
    ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno);
161
0
  htbl =
162
0
    isDC ? cinfo->dc_huff_tbl_ptrs[tblno] : cinfo->ac_huff_tbl_ptrs[tblno];
163
0
  if (htbl == NULL)
164
0
    ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno);
165
166
  /* Allocate a workspace if we haven't already done so. */
167
0
  if (*pdtbl == NULL)
168
0
    *pdtbl = (d_derived_tbl *)
169
0
      (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
170
0
                                  sizeof(d_derived_tbl));
171
0
  dtbl = *pdtbl;
172
0
  dtbl->pub = htbl;             /* fill in back link */
173
174
  /* Figure C.1: make table of Huffman code length for each symbol */
175
176
0
  p = 0;
177
0
  for (l = 1; l <= 16; l++) {
178
0
    i = (int)htbl->bits[l];
179
0
    if (i < 0 || p + i > 256)   /* protect against table overrun */
180
0
      ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
181
0
    while (i--)
182
0
      huffsize[p++] = (char)l;
183
0
  }
184
0
  huffsize[p] = 0;
185
0
  numsymbols = p;
186
187
  /* Figure C.2: generate the codes themselves */
188
  /* We also validate that the counts represent a legal Huffman code tree. */
189
190
0
  code = 0;
191
0
  si = huffsize[0];
192
0
  p = 0;
193
0
  while (huffsize[p]) {
194
0
    while (((int)huffsize[p]) == si) {
195
0
      huffcode[p++] = code;
196
0
      code++;
197
0
    }
198
    /* code is now 1 more than the last code used for codelength si; but
199
     * it must still fit in si bits, since no code is allowed to be all ones.
200
     */
201
0
    if (((JLONG)code) >= (((JLONG)1) << si))
202
0
      ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
203
0
    code <<= 1;
204
0
    si++;
205
0
  }
206
207
  /* Figure F.15: generate decoding tables for bit-sequential decoding */
208
209
0
  p = 0;
210
0
  for (l = 1; l <= 16; l++) {
211
0
    if (htbl->bits[l]) {
212
      /* valoffset[l] = huffval[] index of 1st symbol of code length l,
213
       * minus the minimum code of length l
214
       */
215
0
      dtbl->valoffset[l] = (JLONG)p - (JLONG)huffcode[p];
216
0
      p += htbl->bits[l];
217
0
      dtbl->maxcode[l] = huffcode[p - 1]; /* maximum code of length l */
218
0
    } else {
219
0
      dtbl->maxcode[l] = -1;    /* -1 if no codes of this length */
220
0
    }
221
0
  }
222
0
  dtbl->valoffset[17] = 0;
223
0
  dtbl->maxcode[17] = 0xFFFFFL; /* ensures jpeg_huff_decode terminates */
224
225
  /* Compute lookahead tables to speed up decoding.
226
   * First we set all the table entries to 0, indicating "too long";
227
   * then we iterate through the Huffman codes that are short enough and
228
   * fill in all the entries that correspond to bit sequences starting
229
   * with that code.
230
   */
231
232
0
  for (i = 0; i < (1 << HUFF_LOOKAHEAD); i++)
233
0
    dtbl->lookup[i] = (HUFF_LOOKAHEAD + 1) << HUFF_LOOKAHEAD;
234
235
0
  p = 0;
236
0
  for (l = 1; l <= HUFF_LOOKAHEAD; l++) {
237
0
    for (i = 1; i <= (int)htbl->bits[l]; i++, p++) {
238
      /* l = current code's length, p = its index in huffcode[] & huffval[]. */
239
      /* Generate left-justified code followed by all possible bit sequences */
240
0
      lookbits = huffcode[p] << (HUFF_LOOKAHEAD - l);
241
0
      for (ctr = 1 << (HUFF_LOOKAHEAD - l); ctr > 0; ctr--) {
242
0
        dtbl->lookup[lookbits] = (l << HUFF_LOOKAHEAD) | htbl->huffval[p];
243
0
        lookbits++;
244
0
      }
245
0
    }
246
0
  }
247
248
  /* Validate symbols as being reasonable.
249
   * For AC tables, we make no check, but accept all byte values 0..255.
250
   * For DC tables, we require the symbols to be in range 0..15 in lossy mode
251
   * and 0..16 in lossless mode.  (Tighter bounds could be applied depending on
252
   * the data depth and mode, but this is sufficient to ensure safe decoding.)
253
   */
254
0
  if (isDC) {
255
0
    for (i = 0; i < numsymbols; i++) {
256
0
      int sym = htbl->huffval[i];
257
0
      if (sym < 0 || sym > (cinfo->master->lossless ? 16 : 15))
258
0
        ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
259
0
    }
260
0
  }
261
0
}
262
263
264
/*
265
 * Out-of-line code for bit fetching (shared with jdphuff.c and jdlhuff.c).
266
 * See jdhuff.h for info about usage.
267
 * Note: current values of get_buffer and bits_left are passed as parameters,
268
 * but are returned in the corresponding fields of the state struct.
269
 *
270
 * On most machines MIN_GET_BITS should be 25 to allow the full 32-bit width
271
 * of get_buffer to be used.  (On machines with wider words, an even larger
272
 * buffer could be used.)  However, on some machines 32-bit shifts are
273
 * quite slow and take time proportional to the number of places shifted.
274
 * (This is true with most PC compilers, for instance.)  In this case it may
275
 * be a win to set MIN_GET_BITS to the minimum value of 15.  This reduces the
276
 * average shift distance at the cost of more calls to jpeg_fill_bit_buffer.
277
 */
278
279
#ifdef SLOW_SHIFT_32
280
#define MIN_GET_BITS  15        /* minimum allowable value */
281
#else
282
0
#define MIN_GET_BITS  (BIT_BUF_SIZE - 7)
283
#endif
284
285
286
GLOBAL(boolean)
287
jpeg_fill_bit_buffer(bitread_working_state *state,
288
                     register bit_buf_type get_buffer, register int bits_left,
289
                     int nbits)
290
/* Load up the bit buffer to a depth of at least nbits */
291
0
{
292
  /* Copy heavily used state fields into locals (hopefully registers) */
293
0
  register const JOCTET *next_input_byte = state->next_input_byte;
294
0
  register size_t bytes_in_buffer = state->bytes_in_buffer;
295
0
  j_decompress_ptr cinfo = state->cinfo;
296
297
  /* Attempt to load at least MIN_GET_BITS bits into get_buffer. */
298
  /* (It is assumed that no request will be for more than that many bits.) */
299
  /* We fail to do so only if we hit a marker or are forced to suspend. */
300
301
0
  if (cinfo->unread_marker == 0) {      /* cannot advance past a marker */
302
0
    while (bits_left < MIN_GET_BITS) {
303
0
      register int c;
304
305
      /* Attempt to read a byte */
306
0
      if (bytes_in_buffer == 0) {
307
0
        if (!(*cinfo->src->fill_input_buffer) (cinfo))
308
0
          return FALSE;
309
0
        next_input_byte = cinfo->src->next_input_byte;
310
0
        bytes_in_buffer = cinfo->src->bytes_in_buffer;
311
0
      }
312
0
      bytes_in_buffer--;
313
0
      c = *next_input_byte++;
314
315
      /* If it's 0xFF, check and discard stuffed zero byte */
316
0
      if (c == 0xFF) {
317
        /* Loop here to discard any padding FF's on terminating marker,
318
         * so that we can save a valid unread_marker value.  NOTE: we will
319
         * accept multiple FF's followed by a 0 as meaning a single FF data
320
         * byte.  This data pattern is not valid according to the standard.
321
         */
322
0
        do {
323
0
          if (bytes_in_buffer == 0) {
324
0
            if (!(*cinfo->src->fill_input_buffer) (cinfo))
325
0
              return FALSE;
326
0
            next_input_byte = cinfo->src->next_input_byte;
327
0
            bytes_in_buffer = cinfo->src->bytes_in_buffer;
328
0
          }
329
0
          bytes_in_buffer--;
330
0
          c = *next_input_byte++;
331
0
        } while (c == 0xFF);
332
333
0
        if (c == 0) {
334
          /* Found FF/00, which represents an FF data byte */
335
0
          c = 0xFF;
336
0
        } else {
337
          /* Oops, it's actually a marker indicating end of compressed data.
338
           * Save the marker code for later use.
339
           * Fine point: it might appear that we should save the marker into
340
           * bitread working state, not straight into permanent state.  But
341
           * once we have hit a marker, we cannot need to suspend within the
342
           * current MCU, because we will read no more bytes from the data
343
           * source.  So it is OK to update permanent state right away.
344
           */
345
0
          cinfo->unread_marker = c;
346
          /* See if we need to insert some fake zero bits. */
347
0
          goto no_more_bytes;
348
0
        }
349
0
      }
350
351
      /* OK, load c into get_buffer */
352
0
      get_buffer = (get_buffer << 8) | c;
353
0
      bits_left += 8;
354
0
    } /* end while */
355
0
  } else {
356
0
no_more_bytes:
357
    /* We get here if we've read the marker that terminates the compressed
358
     * data segment.  There should be enough bits in the buffer register
359
     * to satisfy the request; if so, no problem.
360
     */
361
0
    if (nbits > bits_left) {
362
      /* Uh-oh.  Report corrupted data to user and stuff zeroes into
363
       * the data stream, so that we can produce some kind of image.
364
       * We use a nonvolatile flag to ensure that only one warning message
365
       * appears per data segment.
366
       */
367
0
      if (!cinfo->entropy->insufficient_data) {
368
0
        WARNMS(cinfo, JWRN_HIT_MARKER);
369
0
        cinfo->entropy->insufficient_data = TRUE;
370
0
      }
371
      /* Fill the buffer with zero bits */
372
0
      get_buffer <<= MIN_GET_BITS - bits_left;
373
0
      bits_left = MIN_GET_BITS;
374
0
    }
375
0
  }
376
377
  /* Unload the local registers */
378
0
  state->next_input_byte = next_input_byte;
379
0
  state->bytes_in_buffer = bytes_in_buffer;
380
0
  state->get_buffer = get_buffer;
381
0
  state->bits_left = bits_left;
382
383
0
  return TRUE;
384
0
}
385
386
387
/* Macro version of the above, which performs much better but does not
388
   handle markers.  We have to hand off any blocks with markers to the
389
   slower routines. */
390
391
0
#define GET_BYTE { \
392
0
  register int c0, c1; \
393
0
  c0 = *buffer++; \
394
0
  c1 = *buffer; \
395
0
  /* Pre-execute most common case */ \
396
0
  get_buffer = (get_buffer << 8) | c0; \
397
0
  bits_left += 8; \
398
0
  if (c0 == 0xFF) { \
399
0
    /* Pre-execute case of FF/00, which represents an FF data byte */ \
400
0
    buffer++; \
401
0
    if (c1 != 0) { \
402
0
      /* Oops, it's actually a marker indicating end of compressed data. */ \
403
0
      cinfo->unread_marker = c1; \
404
0
      /* Back out pre-execution and fill the buffer with zero bits */ \
405
0
      buffer -= 2; \
406
0
      get_buffer &= ~0xFF; \
407
0
    } \
408
0
  } \
409
0
}
410
411
#if SIZEOF_SIZE_T == 8 || defined(_WIN64) || (defined(__x86_64__) && defined(__ILP32__))
412
413
/* Pre-fetch 48 bytes, because the holding register is 64-bit */
414
#define FILL_BIT_BUFFER_FAST \
415
0
  if (bits_left <= 16) { \
416
0
    GET_BYTE GET_BYTE GET_BYTE GET_BYTE GET_BYTE GET_BYTE \
417
0
  }
418
419
#else
420
421
/* Pre-fetch 16 bytes, because the holding register is 32-bit */
422
#define FILL_BIT_BUFFER_FAST \
423
  if (bits_left <= 16) { \
424
    GET_BYTE GET_BYTE \
425
  }
426
427
#endif
428
429
430
/*
431
 * Out-of-line code for Huffman code decoding.
432
 * See jdhuff.h for info about usage.
433
 */
434
435
GLOBAL(int)
436
jpeg_huff_decode(bitread_working_state *state,
437
                 register bit_buf_type get_buffer, register int bits_left,
438
                 d_derived_tbl *htbl, int min_bits)
439
0
{
440
0
  register int l = min_bits;
441
0
  register JLONG code;
442
443
  /* HUFF_DECODE has determined that the code is at least min_bits */
444
  /* bits long, so fetch that many bits in one swoop. */
445
446
0
  CHECK_BIT_BUFFER(*state, l, return -1);
447
0
  code = GET_BITS(l);
448
449
  /* Collect the rest of the Huffman code one bit at a time. */
450
  /* This is per Figure F.16. */
451
452
0
  while (code > htbl->maxcode[l]) {
453
0
    code <<= 1;
454
0
    CHECK_BIT_BUFFER(*state, 1, return -1);
455
0
    code |= GET_BITS(1);
456
0
    l++;
457
0
  }
458
459
  /* Unload the local registers */
460
0
  state->get_buffer = get_buffer;
461
0
  state->bits_left = bits_left;
462
463
  /* With garbage input we may reach the sentinel value l = 17. */
464
465
0
  if (l > 16) {
466
0
    WARNMS(state->cinfo, JWRN_HUFF_BAD_CODE);
467
0
    return 0;                   /* fake a zero as the safest result */
468
0
  }
469
470
0
  return htbl->pub->huffval[(int)(code + htbl->valoffset[l])];
471
0
}
472
473
474
/*
475
 * Figure F.12: extend sign bit.
476
 * On some machines, a shift and add will be faster than a table lookup.
477
 */
478
479
#define AVOID_TABLES
480
#ifdef AVOID_TABLES
481
482
0
#define NEG_1  ((unsigned int)-1)
483
#define HUFF_EXTEND(x, s) \
484
0
  ((x) + ((((x) - (1 << ((s) - 1))) >> 31) & (((NEG_1) << (s)) + 1)))
485
486
#else
487
488
#define HUFF_EXTEND(x, s) \
489
  ((x) < extend_test[s] ? (x) + extend_offset[s] : (x))
490
491
static const int extend_test[16] = {   /* entry n is 2**(n-1) */
492
  0, 0x0001, 0x0002, 0x0004, 0x0008, 0x0010, 0x0020, 0x0040, 0x0080,
493
  0x0100, 0x0200, 0x0400, 0x0800, 0x1000, 0x2000, 0x4000
494
};
495
496
static const int extend_offset[16] = { /* entry n is (-1 << n) + 1 */
497
  0, ((-1) << 1) + 1, ((-1) << 2) + 1, ((-1) << 3) + 1, ((-1) << 4) + 1,
498
  ((-1) << 5) + 1, ((-1) << 6) + 1, ((-1) << 7) + 1, ((-1) << 8) + 1,
499
  ((-1) << 9) + 1, ((-1) << 10) + 1, ((-1) << 11) + 1, ((-1) << 12) + 1,
500
  ((-1) << 13) + 1, ((-1) << 14) + 1, ((-1) << 15) + 1
501
};
502
503
#endif /* AVOID_TABLES */
504
505
506
/*
507
 * Check for a restart marker & resynchronize decoder.
508
 * Returns FALSE if must suspend.
509
 */
510
511
LOCAL(boolean)
512
process_restart(j_decompress_ptr cinfo)
513
0
{
514
0
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
515
0
  int ci;
516
517
  /* Throw away any unused bits remaining in bit buffer; */
518
  /* include any full bytes in next_marker's count of discarded bytes */
519
0
  cinfo->marker->discarded_bytes += entropy->bitstate.bits_left / 8;
520
0
  entropy->bitstate.bits_left = 0;
521
522
  /* Advance past the RSTn marker */
523
0
  if (!(*cinfo->marker->read_restart_marker) (cinfo))
524
0
    return FALSE;
525
526
  /* Re-initialize DC predictions to 0 */
527
0
  for (ci = 0; ci < cinfo->comps_in_scan; ci++)
528
0
    entropy->saved.last_dc_val[ci] = 0;
529
530
  /* Reset restart counter */
531
0
  entropy->restarts_to_go = cinfo->restart_interval;
532
533
  /* Reset out-of-data flag, unless read_restart_marker left us smack up
534
   * against a marker.  In that case we will end up treating the next data
535
   * segment as empty, and we can avoid producing bogus output pixels by
536
   * leaving the flag set.
537
   */
538
0
  if (cinfo->unread_marker == 0)
539
0
    entropy->pub.insufficient_data = FALSE;
540
541
0
  return TRUE;
542
0
}
543
544
545
#if defined(__has_feature)
546
#if __has_feature(undefined_behavior_sanitizer)
547
__attribute__((no_sanitize("signed-integer-overflow"),
548
               no_sanitize("unsigned-integer-overflow")))
549
#endif
550
#endif
551
LOCAL(boolean)
552
decode_mcu_slow(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
553
0
{
554
0
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
555
0
  BITREAD_STATE_VARS;
556
0
  int blkn;
557
0
  savable_state state;
558
  /* Outer loop handles each block in the MCU */
559
560
  /* Load up working state */
561
0
  BITREAD_LOAD_STATE(cinfo, entropy->bitstate);
562
0
  state = entropy->saved;
563
564
0
  for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
565
0
    JBLOCKROW block = MCU_data ? MCU_data[blkn] : NULL;
566
0
    d_derived_tbl *dctbl = entropy->dc_cur_tbls[blkn];
567
0
    d_derived_tbl *actbl = entropy->ac_cur_tbls[blkn];
568
0
    register int s, k, r;
569
570
    /* Decode a single block's worth of coefficients */
571
572
    /* Section F.2.2.1: decode the DC coefficient difference */
573
0
    HUFF_DECODE(s, br_state, dctbl, return FALSE, label1);
574
0
    if (s) {
575
0
      CHECK_BIT_BUFFER(br_state, s, return FALSE);
576
0
      r = GET_BITS(s);
577
0
      s = HUFF_EXTEND(r, s);
578
0
    }
579
580
0
    if (entropy->dc_needed[blkn]) {
581
      /* Convert DC difference to actual value, update last_dc_val */
582
0
      int ci = cinfo->MCU_membership[blkn];
583
      /* Certain malformed JPEG images produce repeated DC coefficient
584
       * differences of 2047 or -2047, which causes state.last_dc_val[ci] to
585
       * grow until it overflows or underflows a 32-bit signed integer.  This
586
       * behavior is, to the best of our understanding, innocuous, and it is
587
       * unclear how to work around it without potentially affecting
588
       * performance.  Thus, we (hopefully temporarily) suppress UBSan integer
589
       * overflow errors for this function and decode_mcu_fast().
590
       */
591
0
      s += state.last_dc_val[ci];
592
0
      state.last_dc_val[ci] = s;
593
0
      if (block) {
594
        /* Output the DC coefficient (assumes jpeg_natural_order[0] = 0) */
595
0
        (*block)[0] = (JCOEF)s;
596
0
      }
597
0
    }
598
599
0
    if (entropy->ac_needed[blkn] && block) {
600
601
      /* Section F.2.2.2: decode the AC coefficients */
602
      /* Since zeroes are skipped, output area must be cleared beforehand */
603
0
      for (k = 1; k < DCTSIZE2; k++) {
604
0
        HUFF_DECODE(s, br_state, actbl, return FALSE, label2);
605
606
0
        r = s >> 4;
607
0
        s &= 15;
608
609
0
        if (s) {
610
0
          k += r;
611
0
          CHECK_BIT_BUFFER(br_state, s, return FALSE);
612
0
          r = GET_BITS(s);
613
0
          s = HUFF_EXTEND(r, s);
614
          /* Output coefficient in natural (dezigzagged) order.
615
           * Note: the extra entries in jpeg_natural_order[] will save us
616
           * if k >= DCTSIZE2, which could happen if the data is corrupted.
617
           */
618
0
          (*block)[jpeg_natural_order[k]] = (JCOEF)s;
619
0
        } else {
620
0
          if (r != 15)
621
0
            break;
622
0
          k += 15;
623
0
        }
624
0
      }
625
626
0
    } else {
627
628
      /* Section F.2.2.2: decode the AC coefficients */
629
      /* In this path we just discard the values */
630
0
      for (k = 1; k < DCTSIZE2; k++) {
631
0
        HUFF_DECODE(s, br_state, actbl, return FALSE, label3);
632
633
0
        r = s >> 4;
634
0
        s &= 15;
635
636
0
        if (s) {
637
0
          k += r;
638
0
          CHECK_BIT_BUFFER(br_state, s, return FALSE);
639
0
          DROP_BITS(s);
640
0
        } else {
641
0
          if (r != 15)
642
0
            break;
643
0
          k += 15;
644
0
        }
645
0
      }
646
0
    }
647
0
  }
648
649
  /* Completed MCU, so update state */
650
0
  BITREAD_SAVE_STATE(cinfo, entropy->bitstate);
651
0
  entropy->saved = state;
652
0
  return TRUE;
653
0
}
654
655
656
#if defined(__has_feature)
657
#if __has_feature(undefined_behavior_sanitizer)
658
__attribute__((no_sanitize("signed-integer-overflow"),
659
               no_sanitize("unsigned-integer-overflow")))
660
#endif
661
#endif
662
LOCAL(boolean)
663
decode_mcu_fast(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
664
0
{
665
0
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
666
0
  BITREAD_STATE_VARS;
667
0
  JOCTET *buffer;
668
0
  int blkn;
669
0
  savable_state state;
670
  /* Outer loop handles each block in the MCU */
671
672
  /* Load up working state */
673
0
  BITREAD_LOAD_STATE(cinfo, entropy->bitstate);
674
0
  buffer = (JOCTET *)br_state.next_input_byte;
675
0
  state = entropy->saved;
676
677
0
  for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
678
0
    JBLOCKROW block = MCU_data ? MCU_data[blkn] : NULL;
679
0
    d_derived_tbl *dctbl = entropy->dc_cur_tbls[blkn];
680
0
    d_derived_tbl *actbl = entropy->ac_cur_tbls[blkn];
681
0
    register int s, k, r, l;
682
683
0
    HUFF_DECODE_FAST(s, l, dctbl);
684
0
    if (s) {
685
0
      FILL_BIT_BUFFER_FAST
686
0
      r = GET_BITS(s);
687
0
      s = HUFF_EXTEND(r, s);
688
0
    }
689
690
0
    if (entropy->dc_needed[blkn]) {
691
0
      int ci = cinfo->MCU_membership[blkn];
692
      /* Refer to the comment in decode_mcu_slow() regarding the supression of
693
       * a UBSan integer overflow error in this line of code.
694
       */
695
0
      s += state.last_dc_val[ci];
696
0
      state.last_dc_val[ci] = s;
697
0
      if (block)
698
0
        (*block)[0] = (JCOEF)s;
699
0
    }
700
701
0
    if (entropy->ac_needed[blkn] && block) {
702
703
0
      for (k = 1; k < DCTSIZE2; k++) {
704
0
        HUFF_DECODE_FAST(s, l, actbl);
705
0
        r = s >> 4;
706
0
        s &= 15;
707
708
0
        if (s) {
709
0
          k += r;
710
0
          FILL_BIT_BUFFER_FAST
711
0
          r = GET_BITS(s);
712
0
          s = HUFF_EXTEND(r, s);
713
0
          (*block)[jpeg_natural_order[k]] = (JCOEF)s;
714
0
        } else {
715
0
          if (r != 15) break;
716
0
          k += 15;
717
0
        }
718
0
      }
719
720
0
    } else {
721
722
0
      for (k = 1; k < DCTSIZE2; k++) {
723
0
        HUFF_DECODE_FAST(s, l, actbl);
724
0
        r = s >> 4;
725
0
        s &= 15;
726
727
0
        if (s) {
728
0
          k += r;
729
0
          FILL_BIT_BUFFER_FAST
730
0
          DROP_BITS(s);
731
0
        } else {
732
0
          if (r != 15) break;
733
0
          k += 15;
734
0
        }
735
0
      }
736
0
    }
737
0
  }
738
739
0
  if (cinfo->unread_marker != 0) {
740
0
    cinfo->unread_marker = 0;
741
0
    return FALSE;
742
0
  }
743
744
0
  br_state.bytes_in_buffer -= (buffer - br_state.next_input_byte);
745
0
  br_state.next_input_byte = buffer;
746
0
  BITREAD_SAVE_STATE(cinfo, entropy->bitstate);
747
0
  entropy->saved = state;
748
0
  return TRUE;
749
0
}
750
751
752
/*
753
 * Decode and return one MCU's worth of Huffman-compressed coefficients.
754
 * The coefficients are reordered from zigzag order into natural array order,
755
 * but are not dequantized.
756
 *
757
 * The i'th block of the MCU is stored into the block pointed to by
758
 * MCU_data[i].  WE ASSUME THIS AREA HAS BEEN ZEROED BY THE CALLER.
759
 * (Wholesale zeroing is usually a little faster than retail...)
760
 *
761
 * Returns FALSE if data source requested suspension.  In that case no
762
 * changes have been made to permanent state.  (Exception: some output
763
 * coefficients may already have been assigned.  This is harmless for
764
 * this module, since we'll just re-assign them on the next call.)
765
 */
766
767
0
#define BUFSIZE  (DCTSIZE2 * 8)
768
769
METHODDEF(boolean)
770
decode_mcu(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
771
0
{
772
0
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
773
0
  int usefast = 1;
774
775
  /* Process restart marker if needed; may have to suspend */
776
0
  if (cinfo->restart_interval) {
777
0
    if (entropy->restarts_to_go == 0)
778
0
      if (!process_restart(cinfo))
779
0
        return FALSE;
780
0
    usefast = 0;
781
0
  }
782
783
0
  if (cinfo->src->bytes_in_buffer < BUFSIZE * (size_t)cinfo->blocks_in_MCU ||
784
0
      cinfo->unread_marker != 0)
785
0
    usefast = 0;
786
787
  /* If we've run out of data, just leave the MCU set to zeroes.
788
   * This way, we return uniform gray for the remainder of the segment.
789
   */
790
0
  if (!entropy->pub.insufficient_data) {
791
792
0
    if (usefast) {
793
0
      if (!decode_mcu_fast(cinfo, MCU_data)) goto use_slow;
794
0
    } else {
795
0
use_slow:
796
0
      if (!decode_mcu_slow(cinfo, MCU_data)) return FALSE;
797
0
    }
798
799
0
  }
800
801
  /* Account for restart interval (no-op if not using restarts) */
802
0
  if (cinfo->restart_interval)
803
0
    entropy->restarts_to_go--;
804
805
0
  return TRUE;
806
0
}
807
808
809
/*
810
 * Module initialization routine for Huffman entropy decoding.
811
 */
812
813
GLOBAL(void)
814
jinit_huff_decoder(j_decompress_ptr cinfo)
815
0
{
816
0
  huff_entropy_ptr entropy;
817
0
  int i;
818
819
  /* Motion JPEG frames typically do not include the Huffman tables if they
820
     are the default tables.  Thus, if the tables are not set by the time
821
     the Huffman decoder is initialized (usually within the body of
822
     jpeg_start_decompress()), we set them to default values. */
823
0
  std_huff_tables((j_common_ptr)cinfo);
824
825
0
  entropy = (huff_entropy_ptr)
826
0
    (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
827
0
                                sizeof(huff_entropy_decoder));
828
0
  cinfo->entropy = (struct jpeg_entropy_decoder *)entropy;
829
0
  entropy->pub.start_pass = start_pass_huff_decoder;
830
0
  entropy->pub.decode_mcu = decode_mcu;
831
832
  /* Mark tables unallocated */
833
0
  for (i = 0; i < NUM_HUFF_TBLS; i++) {
834
0
    entropy->dc_derived_tbls[i] = entropy->ac_derived_tbls[i] = NULL;
835
0
  }
836
0
}