Coverage Report

Created: 2024-06-18 06:05

/src/libjpeg-turbo/jdmarker.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * jdmarker.c
3
 *
4
 * This file was part of the Independent JPEG Group's software:
5
 * Copyright (C) 1991-1998, Thomas G. Lane.
6
 * Lossless JPEG Modifications:
7
 * Copyright (C) 1999, Ken Murchison.
8
 * libjpeg-turbo Modifications:
9
 * Copyright (C) 2012, 2015, 2022, 2024, D. R. Commander.
10
 * For conditions of distribution and use, see the accompanying README.ijg
11
 * file.
12
 *
13
 * This file contains routines to decode JPEG datastream markers.
14
 * Most of the complexity arises from our desire to support input
15
 * suspension: if not all of the data for a marker is available,
16
 * we must exit back to the application.  On resumption, we reprocess
17
 * the marker.
18
 */
19
20
#define JPEG_INTERNALS
21
#include "jinclude.h"
22
#include "jpeglib.h"
23
24
25
typedef enum {                  /* JPEG marker codes */
26
  M_SOF0  = 0xc0,
27
  M_SOF1  = 0xc1,
28
  M_SOF2  = 0xc2,
29
  M_SOF3  = 0xc3,
30
31
  M_SOF5  = 0xc5,
32
  M_SOF6  = 0xc6,
33
  M_SOF7  = 0xc7,
34
35
  M_JPG   = 0xc8,
36
  M_SOF9  = 0xc9,
37
  M_SOF10 = 0xca,
38
  M_SOF11 = 0xcb,
39
40
  M_SOF13 = 0xcd,
41
  M_SOF14 = 0xce,
42
  M_SOF15 = 0xcf,
43
44
  M_DHT   = 0xc4,
45
46
  M_DAC   = 0xcc,
47
48
  M_RST0  = 0xd0,
49
  M_RST1  = 0xd1,
50
  M_RST2  = 0xd2,
51
  M_RST3  = 0xd3,
52
  M_RST4  = 0xd4,
53
  M_RST5  = 0xd5,
54
  M_RST6  = 0xd6,
55
  M_RST7  = 0xd7,
56
57
  M_SOI   = 0xd8,
58
  M_EOI   = 0xd9,
59
  M_SOS   = 0xda,
60
  M_DQT   = 0xdb,
61
  M_DNL   = 0xdc,
62
  M_DRI   = 0xdd,
63
  M_DHP   = 0xde,
64
  M_EXP   = 0xdf,
65
66
  M_APP0  = 0xe0,
67
  M_APP1  = 0xe1,
68
  M_APP2  = 0xe2,
69
  M_APP3  = 0xe3,
70
  M_APP4  = 0xe4,
71
  M_APP5  = 0xe5,
72
  M_APP6  = 0xe6,
73
  M_APP7  = 0xe7,
74
  M_APP8  = 0xe8,
75
  M_APP9  = 0xe9,
76
  M_APP10 = 0xea,
77
  M_APP11 = 0xeb,
78
  M_APP12 = 0xec,
79
  M_APP13 = 0xed,
80
  M_APP14 = 0xee,
81
  M_APP15 = 0xef,
82
83
  M_JPG0  = 0xf0,
84
  M_JPG13 = 0xfd,
85
  M_COM   = 0xfe,
86
87
  M_TEM   = 0x01,
88
89
  M_ERROR = 0x100
90
} JPEG_MARKER;
91
92
93
/* Private state */
94
95
typedef struct {
96
  struct jpeg_marker_reader pub; /* public fields */
97
98
  /* Application-overridable marker processing methods */
99
  jpeg_marker_parser_method process_COM;
100
  jpeg_marker_parser_method process_APPn[16];
101
102
  /* Limit on marker data length to save for each marker type */
103
  unsigned int length_limit_COM;
104
  unsigned int length_limit_APPn[16];
105
106
  /* Status of COM/APPn marker saving */
107
  jpeg_saved_marker_ptr cur_marker;     /* NULL if not processing a marker */
108
  unsigned int bytes_read;              /* data bytes read so far in marker */
109
  /* Note: cur_marker is not linked into marker_list until it's all read. */
110
} my_marker_reader;
111
112
typedef my_marker_reader *my_marker_ptr;
113
114
115
/*
116
 * Macros for fetching data from the data source module.
117
 *
118
 * At all times, cinfo->src->next_input_byte and ->bytes_in_buffer reflect
119
 * the current restart point; we update them only when we have reached a
120
 * suitable place to restart if a suspension occurs.
121
 */
122
123
/* Declare and initialize local copies of input pointer/count */
124
#define INPUT_VARS(cinfo) \
125
0
  struct jpeg_source_mgr *datasrc = (cinfo)->src; \
126
0
  const JOCTET *next_input_byte = datasrc->next_input_byte; \
127
0
  size_t bytes_in_buffer = datasrc->bytes_in_buffer
128
129
/* Unload the local copies --- do this only at a restart boundary */
130
#define INPUT_SYNC(cinfo) \
131
0
  ( datasrc->next_input_byte = next_input_byte, \
132
0
    datasrc->bytes_in_buffer = bytes_in_buffer )
133
134
/* Reload the local copies --- used only in MAKE_BYTE_AVAIL */
135
#define INPUT_RELOAD(cinfo) \
136
0
  ( next_input_byte = datasrc->next_input_byte, \
137
0
    bytes_in_buffer = datasrc->bytes_in_buffer )
138
139
/* Internal macro for INPUT_BYTE and INPUT_2BYTES: make a byte available.
140
 * Note we do *not* do INPUT_SYNC before calling fill_input_buffer,
141
 * but we must reload the local copies after a successful fill.
142
 */
143
#define MAKE_BYTE_AVAIL(cinfo, action) \
144
0
  if (bytes_in_buffer == 0) { \
145
0
    if (!(*datasrc->fill_input_buffer) (cinfo)) \
146
0
      { action; } \
147
0
    INPUT_RELOAD(cinfo); \
148
0
  }
149
150
/* Read a byte into variable V.
151
 * If must suspend, take the specified action (typically "return FALSE").
152
 */
153
#define INPUT_BYTE(cinfo, V, action) \
154
0
  MAKESTMT( MAKE_BYTE_AVAIL(cinfo, action); \
155
0
            bytes_in_buffer--; \
156
0
            V = *next_input_byte++; )
157
158
/* As above, but read two bytes interpreted as an unsigned 16-bit integer.
159
 * V should be declared unsigned int or perhaps JLONG.
160
 */
161
#define INPUT_2BYTES(cinfo, V, action) \
162
0
  MAKESTMT( MAKE_BYTE_AVAIL(cinfo, action); \
163
0
            bytes_in_buffer--; \
164
0
            V = ((unsigned int)(*next_input_byte++)) << 8; \
165
0
            MAKE_BYTE_AVAIL(cinfo, action); \
166
0
            bytes_in_buffer--; \
167
0
            V += *next_input_byte++; )
168
169
170
/*
171
 * Routines to process JPEG markers.
172
 *
173
 * Entry condition: JPEG marker itself has been read and its code saved
174
 *   in cinfo->unread_marker; input restart point is just after the marker.
175
 *
176
 * Exit: if return TRUE, have read and processed any parameters, and have
177
 *   updated the restart point to point after the parameters.
178
 *   If return FALSE, was forced to suspend before reaching end of
179
 *   marker parameters; restart point has not been moved.  Same routine
180
 *   will be called again after application supplies more input data.
181
 *
182
 * This approach to suspension assumes that all of a marker's parameters
183
 * can fit into a single input bufferload.  This should hold for "normal"
184
 * markers.  Some COM/APPn markers might have large parameter segments
185
 * that might not fit.  If we are simply dropping such a marker, we use
186
 * skip_input_data to get past it, and thereby put the problem on the
187
 * source manager's shoulders.  If we are saving the marker's contents
188
 * into memory, we use a slightly different convention: when forced to
189
 * suspend, the marker processor updates the restart point to the end of
190
 * what it's consumed (ie, the end of the buffer) before returning FALSE.
191
 * On resumption, cinfo->unread_marker still contains the marker code,
192
 * but the data source will point to the next chunk of marker data.
193
 * The marker processor must retain internal state to deal with this.
194
 *
195
 * Note that we don't bother to avoid duplicate trace messages if a
196
 * suspension occurs within marker parameters.  Other side effects
197
 * require more care.
198
 */
199
200
201
LOCAL(boolean)
202
get_soi(j_decompress_ptr cinfo)
203
/* Process an SOI marker */
204
0
{
205
0
  int i;
206
207
0
  TRACEMS(cinfo, 1, JTRC_SOI);
208
209
0
  if (cinfo->marker->saw_SOI)
210
0
    ERREXIT(cinfo, JERR_SOI_DUPLICATE);
211
212
  /* Reset all parameters that are defined to be reset by SOI */
213
214
0
  for (i = 0; i < NUM_ARITH_TBLS; i++) {
215
0
    cinfo->arith_dc_L[i] = 0;
216
0
    cinfo->arith_dc_U[i] = 1;
217
0
    cinfo->arith_ac_K[i] = 5;
218
0
  }
219
0
  cinfo->restart_interval = 0;
220
221
  /* Set initial assumptions for colorspace etc */
222
223
0
  cinfo->jpeg_color_space = JCS_UNKNOWN;
224
0
  cinfo->CCIR601_sampling = FALSE; /* Assume non-CCIR sampling??? */
225
226
0
  cinfo->saw_JFIF_marker = FALSE;
227
0
  cinfo->JFIF_major_version = 1; /* set default JFIF APP0 values */
228
0
  cinfo->JFIF_minor_version = 1;
229
0
  cinfo->density_unit = 0;
230
0
  cinfo->X_density = 1;
231
0
  cinfo->Y_density = 1;
232
0
  cinfo->saw_Adobe_marker = FALSE;
233
0
  cinfo->Adobe_transform = 0;
234
235
0
  cinfo->marker->saw_SOI = TRUE;
236
237
0
  return TRUE;
238
0
}
239
240
241
LOCAL(boolean)
242
get_sof(j_decompress_ptr cinfo, boolean is_prog, boolean is_lossless,
243
        boolean is_arith)
244
/* Process a SOFn marker */
245
0
{
246
0
  JLONG length;
247
0
  int c, ci;
248
0
  jpeg_component_info *compptr;
249
0
  INPUT_VARS(cinfo);
250
251
0
  if (cinfo->marker->saw_SOF)
252
0
    ERREXIT(cinfo, JERR_SOF_DUPLICATE);
253
254
0
  cinfo->progressive_mode = is_prog;
255
0
  cinfo->master->lossless = is_lossless;
256
0
  cinfo->arith_code = is_arith;
257
258
0
  INPUT_2BYTES(cinfo, length, return FALSE);
259
260
0
  INPUT_BYTE(cinfo, cinfo->data_precision, return FALSE);
261
0
  INPUT_2BYTES(cinfo, cinfo->image_height, return FALSE);
262
0
  INPUT_2BYTES(cinfo, cinfo->image_width, return FALSE);
263
0
  INPUT_BYTE(cinfo, cinfo->num_components, return FALSE);
264
265
0
  length -= 8;
266
267
0
  TRACEMS4(cinfo, 1, JTRC_SOF, cinfo->unread_marker,
268
0
           (int)cinfo->image_width, (int)cinfo->image_height,
269
0
           cinfo->num_components);
270
271
  /* We don't support files in which the image height is initially specified */
272
  /* as 0 and is later redefined by DNL.  As long as we have to check that,  */
273
  /* might as well have a general sanity check. */
274
0
  if (cinfo->image_height <= 0 || cinfo->image_width <= 0 ||
275
0
      cinfo->num_components <= 0)
276
0
    ERREXIT(cinfo, JERR_EMPTY_IMAGE);
277
278
0
  if (length != (cinfo->num_components * 3))
279
0
    ERREXIT(cinfo, JERR_BAD_LENGTH);
280
281
0
  if (cinfo->comp_info == NULL) /* do only once, even if suspend */
282
0
    cinfo->comp_info = (jpeg_component_info *)(*cinfo->mem->alloc_small)
283
0
                        ((j_common_ptr)cinfo, JPOOL_IMAGE,
284
0
                         cinfo->num_components * sizeof(jpeg_component_info));
285
286
0
  for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
287
0
       ci++, compptr++) {
288
0
    compptr->component_index = ci;
289
0
    INPUT_BYTE(cinfo, compptr->component_id, return FALSE);
290
0
    INPUT_BYTE(cinfo, c, return FALSE);
291
0
    compptr->h_samp_factor = (c >> 4) & 15;
292
0
    compptr->v_samp_factor = (c     ) & 15;
293
0
    INPUT_BYTE(cinfo, compptr->quant_tbl_no, return FALSE);
294
295
0
    TRACEMS4(cinfo, 1, JTRC_SOF_COMPONENT,
296
0
             compptr->component_id, compptr->h_samp_factor,
297
0
             compptr->v_samp_factor, compptr->quant_tbl_no);
298
0
  }
299
300
0
  cinfo->marker->saw_SOF = TRUE;
301
302
0
  INPUT_SYNC(cinfo);
303
0
  return TRUE;
304
0
}
305
306
307
LOCAL(boolean)
308
get_sos(j_decompress_ptr cinfo)
309
/* Process a SOS marker */
310
0
{
311
0
  JLONG length;
312
0
  int i, ci, n, c, cc, pi;
313
0
  jpeg_component_info *compptr;
314
0
  INPUT_VARS(cinfo);
315
316
0
  if (!cinfo->marker->saw_SOF)
317
0
    ERREXIT(cinfo, JERR_SOS_NO_SOF);
318
319
0
  INPUT_2BYTES(cinfo, length, return FALSE);
320
321
0
  INPUT_BYTE(cinfo, n, return FALSE); /* Number of components */
322
323
0
  TRACEMS1(cinfo, 1, JTRC_SOS, n);
324
325
0
  if (length != (n * 2 + 6) || n < 1 || n > MAX_COMPS_IN_SCAN)
326
0
    ERREXIT(cinfo, JERR_BAD_LENGTH);
327
328
0
  cinfo->comps_in_scan = n;
329
330
  /* Collect the component-spec parameters */
331
332
0
  for (i = 0; i < MAX_COMPS_IN_SCAN; i++)
333
0
    cinfo->cur_comp_info[i] = NULL;
334
335
0
  for (i = 0; i < n; i++) {
336
0
    INPUT_BYTE(cinfo, cc, return FALSE);
337
0
    INPUT_BYTE(cinfo, c, return FALSE);
338
339
0
    for (ci = 0, compptr = cinfo->comp_info;
340
0
         ci < cinfo->num_components && ci < MAX_COMPS_IN_SCAN;
341
0
         ci++, compptr++) {
342
0
      if (cc == compptr->component_id && !cinfo->cur_comp_info[ci])
343
0
        goto id_found;
344
0
    }
345
346
0
    ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
347
348
0
id_found:
349
350
0
    cinfo->cur_comp_info[i] = compptr;
351
0
    compptr->dc_tbl_no = (c >> 4) & 15;
352
0
    compptr->ac_tbl_no = (c     ) & 15;
353
354
0
    TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, cc,
355
0
             compptr->dc_tbl_no, compptr->ac_tbl_no);
356
357
    /* This CSi (cc) should differ from the previous CSi */
358
0
    for (pi = 0; pi < i; pi++) {
359
0
      if (cinfo->cur_comp_info[pi] == compptr) {
360
0
        ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
361
0
      }
362
0
    }
363
0
  }
364
365
  /* Collect the additional scan parameters Ss, Se, Ah/Al. */
366
0
  INPUT_BYTE(cinfo, c, return FALSE);
367
0
  cinfo->Ss = c;
368
0
  INPUT_BYTE(cinfo, c, return FALSE);
369
0
  cinfo->Se = c;
370
0
  INPUT_BYTE(cinfo, c, return FALSE);
371
0
  cinfo->Ah = (c >> 4) & 15;
372
0
  cinfo->Al = (c     ) & 15;
373
374
0
  TRACEMS4(cinfo, 1, JTRC_SOS_PARAMS, cinfo->Ss, cinfo->Se,
375
0
           cinfo->Ah, cinfo->Al);
376
377
  /* Prepare to scan data & restart markers */
378
0
  cinfo->marker->next_restart_num = 0;
379
380
  /* Count another SOS marker */
381
0
  cinfo->input_scan_number++;
382
383
0
  INPUT_SYNC(cinfo);
384
0
  return TRUE;
385
0
}
386
387
388
#ifdef D_ARITH_CODING_SUPPORTED
389
390
LOCAL(boolean)
391
get_dac(j_decompress_ptr cinfo)
392
/* Process a DAC marker */
393
0
{
394
0
  JLONG length;
395
0
  int index, val;
396
0
  INPUT_VARS(cinfo);
397
398
0
  INPUT_2BYTES(cinfo, length, return FALSE);
399
0
  length -= 2;
400
401
0
  while (length > 0) {
402
0
    INPUT_BYTE(cinfo, index, return FALSE);
403
0
    INPUT_BYTE(cinfo, val, return FALSE);
404
405
0
    length -= 2;
406
407
0
    TRACEMS2(cinfo, 1, JTRC_DAC, index, val);
408
409
0
    if (index < 0 || index >= (2 * NUM_ARITH_TBLS))
410
0
      ERREXIT1(cinfo, JERR_DAC_INDEX, index);
411
412
0
    if (index >= NUM_ARITH_TBLS) { /* define AC table */
413
0
      cinfo->arith_ac_K[index - NUM_ARITH_TBLS] = (UINT8)val;
414
0
    } else {                    /* define DC table */
415
0
      cinfo->arith_dc_L[index] = (UINT8)(val & 0x0F);
416
0
      cinfo->arith_dc_U[index] = (UINT8)(val >> 4);
417
0
      if (cinfo->arith_dc_L[index] > cinfo->arith_dc_U[index])
418
0
        ERREXIT1(cinfo, JERR_DAC_VALUE, val);
419
0
    }
420
0
  }
421
422
0
  if (length != 0)
423
0
    ERREXIT(cinfo, JERR_BAD_LENGTH);
424
425
0
  INPUT_SYNC(cinfo);
426
0
  return TRUE;
427
0
}
428
429
#else /* !D_ARITH_CODING_SUPPORTED */
430
431
#define get_dac(cinfo)  skip_variable(cinfo)
432
433
#endif /* D_ARITH_CODING_SUPPORTED */
434
435
436
LOCAL(boolean)
437
get_dht(j_decompress_ptr cinfo)
438
/* Process a DHT marker */
439
0
{
440
0
  JLONG length;
441
0
  UINT8 bits[17];
442
0
  UINT8 huffval[256];
443
0
  int i, index, count;
444
0
  JHUFF_TBL **htblptr;
445
0
  INPUT_VARS(cinfo);
446
447
0
  INPUT_2BYTES(cinfo, length, return FALSE);
448
0
  length -= 2;
449
450
0
  while (length > 16) {
451
0
    INPUT_BYTE(cinfo, index, return FALSE);
452
453
0
    TRACEMS1(cinfo, 1, JTRC_DHT, index);
454
455
0
    bits[0] = 0;
456
0
    count = 0;
457
0
    for (i = 1; i <= 16; i++) {
458
0
      INPUT_BYTE(cinfo, bits[i], return FALSE);
459
0
      count += bits[i];
460
0
    }
461
462
0
    length -= 1 + 16;
463
464
0
    TRACEMS8(cinfo, 2, JTRC_HUFFBITS,
465
0
             bits[1], bits[2], bits[3], bits[4],
466
0
             bits[5], bits[6], bits[7], bits[8]);
467
0
    TRACEMS8(cinfo, 2, JTRC_HUFFBITS,
468
0
             bits[9], bits[10], bits[11], bits[12],
469
0
             bits[13], bits[14], bits[15], bits[16]);
470
471
    /* Here we just do minimal validation of the counts to avoid walking
472
     * off the end of our table space.  jdhuff.c will check more carefully.
473
     */
474
0
    if (count > 256 || ((JLONG)count) > length)
475
0
      ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
476
477
0
    for (i = 0; i < count; i++)
478
0
      INPUT_BYTE(cinfo, huffval[i], return FALSE);
479
480
0
    memset(&huffval[count], 0, (256 - count) * sizeof(UINT8));
481
482
0
    length -= count;
483
484
0
    if (index & 0x10) {         /* AC table definition */
485
0
      index -= 0x10;
486
0
      if (index < 0 || index >= NUM_HUFF_TBLS)
487
0
        ERREXIT1(cinfo, JERR_DHT_INDEX, index);
488
0
      htblptr = &cinfo->ac_huff_tbl_ptrs[index];
489
0
    } else {                    /* DC table definition */
490
0
      if (index < 0 || index >= NUM_HUFF_TBLS)
491
0
        ERREXIT1(cinfo, JERR_DHT_INDEX, index);
492
0
      htblptr = &cinfo->dc_huff_tbl_ptrs[index];
493
0
    }
494
495
0
    if (*htblptr == NULL)
496
0
      *htblptr = jpeg_alloc_huff_table((j_common_ptr)cinfo);
497
498
0
    memcpy((*htblptr)->bits, bits, sizeof((*htblptr)->bits));
499
0
    memcpy((*htblptr)->huffval, huffval, sizeof((*htblptr)->huffval));
500
0
  }
501
502
0
  if (length != 0)
503
0
    ERREXIT(cinfo, JERR_BAD_LENGTH);
504
505
0
  INPUT_SYNC(cinfo);
506
0
  return TRUE;
507
0
}
508
509
510
LOCAL(boolean)
511
get_dqt(j_decompress_ptr cinfo)
512
/* Process a DQT marker */
513
0
{
514
0
  JLONG length;
515
0
  int n, i, prec;
516
0
  unsigned int tmp;
517
0
  JQUANT_TBL *quant_ptr;
518
0
  INPUT_VARS(cinfo);
519
520
0
  INPUT_2BYTES(cinfo, length, return FALSE);
521
0
  length -= 2;
522
523
0
  while (length > 0) {
524
0
    INPUT_BYTE(cinfo, n, return FALSE);
525
0
    prec = n >> 4;
526
0
    n &= 0x0F;
527
528
0
    TRACEMS2(cinfo, 1, JTRC_DQT, n, prec);
529
530
0
    if (n >= NUM_QUANT_TBLS)
531
0
      ERREXIT1(cinfo, JERR_DQT_INDEX, n);
532
533
0
    if (cinfo->quant_tbl_ptrs[n] == NULL)
534
0
      cinfo->quant_tbl_ptrs[n] = jpeg_alloc_quant_table((j_common_ptr)cinfo);
535
0
    quant_ptr = cinfo->quant_tbl_ptrs[n];
536
537
0
    for (i = 0; i < DCTSIZE2; i++) {
538
0
      if (prec)
539
0
        INPUT_2BYTES(cinfo, tmp, return FALSE);
540
0
      else
541
0
        INPUT_BYTE(cinfo, tmp, return FALSE);
542
      /* We convert the zigzag-order table to natural array order. */
543
0
      quant_ptr->quantval[jpeg_natural_order[i]] = (UINT16)tmp;
544
0
    }
545
546
0
    if (cinfo->err->trace_level >= 2) {
547
0
      for (i = 0; i < DCTSIZE2; i += 8) {
548
0
        TRACEMS8(cinfo, 2, JTRC_QUANTVALS,
549
0
                 quant_ptr->quantval[i],     quant_ptr->quantval[i + 1],
550
0
                 quant_ptr->quantval[i + 2], quant_ptr->quantval[i + 3],
551
0
                 quant_ptr->quantval[i + 4], quant_ptr->quantval[i + 5],
552
0
                 quant_ptr->quantval[i + 6], quant_ptr->quantval[i + 7]);
553
0
      }
554
0
    }
555
556
0
    length -= DCTSIZE2 + 1;
557
0
    if (prec) length -= DCTSIZE2;
558
0
  }
559
560
0
  if (length != 0)
561
0
    ERREXIT(cinfo, JERR_BAD_LENGTH);
562
563
0
  INPUT_SYNC(cinfo);
564
0
  return TRUE;
565
0
}
566
567
568
LOCAL(boolean)
569
get_dri(j_decompress_ptr cinfo)
570
/* Process a DRI marker */
571
0
{
572
0
  JLONG length;
573
0
  unsigned int tmp;
574
0
  INPUT_VARS(cinfo);
575
576
0
  INPUT_2BYTES(cinfo, length, return FALSE);
577
578
0
  if (length != 4)
579
0
    ERREXIT(cinfo, JERR_BAD_LENGTH);
580
581
0
  INPUT_2BYTES(cinfo, tmp, return FALSE);
582
583
0
  TRACEMS1(cinfo, 1, JTRC_DRI, tmp);
584
585
0
  cinfo->restart_interval = tmp;
586
587
0
  INPUT_SYNC(cinfo);
588
0
  return TRUE;
589
0
}
590
591
592
/*
593
 * Routines for processing APPn and COM markers.
594
 * These are either saved in memory or discarded, per application request.
595
 * APP0 and APP14 are specially checked to see if they are
596
 * JFIF and Adobe markers, respectively.
597
 */
598
599
0
#define APP0_DATA_LEN   14      /* Length of interesting data in APP0 */
600
0
#define APP14_DATA_LEN  12      /* Length of interesting data in APP14 */
601
0
#define APPN_DATA_LEN   14      /* Must be the largest of the above!! */
602
603
604
LOCAL(void)
605
examine_app0(j_decompress_ptr cinfo, JOCTET *data, unsigned int datalen,
606
             JLONG remaining)
607
/* Examine first few bytes from an APP0.
608
 * Take appropriate action if it is a JFIF marker.
609
 * datalen is # of bytes at data[], remaining is length of rest of marker data.
610
 */
611
0
{
612
0
  JLONG totallen = (JLONG)datalen + remaining;
613
614
0
  if (datalen >= APP0_DATA_LEN &&
615
0
      data[0] == 0x4A &&
616
0
      data[1] == 0x46 &&
617
0
      data[2] == 0x49 &&
618
0
      data[3] == 0x46 &&
619
0
      data[4] == 0) {
620
    /* Found JFIF APP0 marker: save info */
621
0
    cinfo->saw_JFIF_marker = TRUE;
622
0
    cinfo->JFIF_major_version = data[5];
623
0
    cinfo->JFIF_minor_version = data[6];
624
0
    cinfo->density_unit = data[7];
625
0
    cinfo->X_density = (data[8] << 8) + data[9];
626
0
    cinfo->Y_density = (data[10] << 8) + data[11];
627
    /* Check version.
628
     * Major version must be 1, anything else signals an incompatible change.
629
     * (We used to treat this as an error, but now it's a nonfatal warning,
630
     * because some bozo at Hijaak couldn't read the spec.)
631
     * Minor version should be 0..2, but process anyway if newer.
632
     */
633
0
    if (cinfo->JFIF_major_version != 1)
634
0
      WARNMS2(cinfo, JWRN_JFIF_MAJOR,
635
0
              cinfo->JFIF_major_version, cinfo->JFIF_minor_version);
636
    /* Generate trace messages */
637
0
    TRACEMS5(cinfo, 1, JTRC_JFIF,
638
0
             cinfo->JFIF_major_version, cinfo->JFIF_minor_version,
639
0
             cinfo->X_density, cinfo->Y_density, cinfo->density_unit);
640
    /* Validate thumbnail dimensions and issue appropriate messages */
641
0
    if (data[12] | data[13])
642
0
      TRACEMS2(cinfo, 1, JTRC_JFIF_THUMBNAIL, data[12], data[13]);
643
0
    totallen -= APP0_DATA_LEN;
644
0
    if (totallen != ((JLONG)data[12] * (JLONG)data[13] * (JLONG)3))
645
0
      TRACEMS1(cinfo, 1, JTRC_JFIF_BADTHUMBNAILSIZE, (int)totallen);
646
0
  } else if (datalen >= 6 &&
647
0
             data[0] == 0x4A &&
648
0
             data[1] == 0x46 &&
649
0
             data[2] == 0x58 &&
650
0
             data[3] == 0x58 &&
651
0
             data[4] == 0) {
652
    /* Found JFIF "JFXX" extension APP0 marker */
653
    /* The library doesn't actually do anything with these,
654
     * but we try to produce a helpful trace message.
655
     */
656
0
    switch (data[5]) {
657
0
    case 0x10:
658
0
      TRACEMS1(cinfo, 1, JTRC_THUMB_JPEG, (int)totallen);
659
0
      break;
660
0
    case 0x11:
661
0
      TRACEMS1(cinfo, 1, JTRC_THUMB_PALETTE, (int)totallen);
662
0
      break;
663
0
    case 0x13:
664
0
      TRACEMS1(cinfo, 1, JTRC_THUMB_RGB, (int)totallen);
665
0
      break;
666
0
    default:
667
0
      TRACEMS2(cinfo, 1, JTRC_JFIF_EXTENSION, data[5], (int)totallen);
668
0
      break;
669
0
    }
670
0
  } else {
671
    /* Start of APP0 does not match "JFIF" or "JFXX", or too short */
672
0
    TRACEMS1(cinfo, 1, JTRC_APP0, (int)totallen);
673
0
  }
674
0
}
675
676
677
LOCAL(void)
678
examine_app14(j_decompress_ptr cinfo, JOCTET *data, unsigned int datalen,
679
              JLONG remaining)
680
/* Examine first few bytes from an APP14.
681
 * Take appropriate action if it is an Adobe marker.
682
 * datalen is # of bytes at data[], remaining is length of rest of marker data.
683
 */
684
0
{
685
0
  unsigned int version, flags0, flags1, transform;
686
687
0
  if (datalen >= APP14_DATA_LEN &&
688
0
      data[0] == 0x41 &&
689
0
      data[1] == 0x64 &&
690
0
      data[2] == 0x6F &&
691
0
      data[3] == 0x62 &&
692
0
      data[4] == 0x65) {
693
    /* Found Adobe APP14 marker */
694
0
    version = (data[5] << 8) + data[6];
695
0
    flags0 = (data[7] << 8) + data[8];
696
0
    flags1 = (data[9] << 8) + data[10];
697
0
    transform = data[11];
698
0
    TRACEMS4(cinfo, 1, JTRC_ADOBE, version, flags0, flags1, transform);
699
0
    cinfo->saw_Adobe_marker = TRUE;
700
0
    cinfo->Adobe_transform = (UINT8)transform;
701
0
  } else {
702
    /* Start of APP14 does not match "Adobe", or too short */
703
0
    TRACEMS1(cinfo, 1, JTRC_APP14, (int)(datalen + remaining));
704
0
  }
705
0
}
706
707
708
METHODDEF(boolean)
709
get_interesting_appn(j_decompress_ptr cinfo)
710
/* Process an APP0 or APP14 marker without saving it */
711
0
{
712
0
  JLONG length;
713
0
  JOCTET b[APPN_DATA_LEN];
714
0
  unsigned int i, numtoread;
715
0
  INPUT_VARS(cinfo);
716
717
0
  INPUT_2BYTES(cinfo, length, return FALSE);
718
0
  length -= 2;
719
720
  /* get the interesting part of the marker data */
721
0
  if (length >= APPN_DATA_LEN)
722
0
    numtoread = APPN_DATA_LEN;
723
0
  else if (length > 0)
724
0
    numtoread = (unsigned int)length;
725
0
  else
726
0
    numtoread = 0;
727
0
  for (i = 0; i < numtoread; i++)
728
0
    INPUT_BYTE(cinfo, b[i], return FALSE);
729
0
  length -= numtoread;
730
731
  /* process it */
732
0
  switch (cinfo->unread_marker) {
733
0
  case M_APP0:
734
0
    examine_app0(cinfo, (JOCTET *)b, numtoread, length);
735
0
    break;
736
0
  case M_APP14:
737
0
    examine_app14(cinfo, (JOCTET *)b, numtoread, length);
738
0
    break;
739
0
  default:
740
    /* can't get here unless jpeg_save_markers chooses wrong processor */
741
0
    ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
742
0
    break;
743
0
  }
744
745
  /* skip any remaining data -- could be lots */
746
0
  INPUT_SYNC(cinfo);
747
0
  if (length > 0)
748
0
    (*cinfo->src->skip_input_data) (cinfo, (long)length);
749
750
0
  return TRUE;
751
0
}
752
753
754
#ifdef SAVE_MARKERS_SUPPORTED
755
756
METHODDEF(boolean)
757
save_marker(j_decompress_ptr cinfo)
758
/* Save an APPn or COM marker into the marker list */
759
0
{
760
0
  my_marker_ptr marker = (my_marker_ptr)cinfo->marker;
761
0
  jpeg_saved_marker_ptr cur_marker = marker->cur_marker;
762
0
  unsigned int bytes_read, data_length;
763
0
  JOCTET *data;
764
0
  JLONG length = 0;
765
0
  INPUT_VARS(cinfo);
766
767
0
  if (cur_marker == NULL) {
768
    /* begin reading a marker */
769
0
    INPUT_2BYTES(cinfo, length, return FALSE);
770
0
    length -= 2;
771
0
    if (length >= 0) {          /* watch out for bogus length word */
772
      /* figure out how much we want to save */
773
0
      unsigned int limit;
774
0
      if (cinfo->unread_marker == (int)M_COM)
775
0
        limit = marker->length_limit_COM;
776
0
      else
777
0
        limit = marker->length_limit_APPn[cinfo->unread_marker - (int)M_APP0];
778
0
      if ((unsigned int)length < limit)
779
0
        limit = (unsigned int)length;
780
      /* allocate and initialize the marker item */
781
0
      cur_marker = (jpeg_saved_marker_ptr)
782
0
        (*cinfo->mem->alloc_large) ((j_common_ptr)cinfo, JPOOL_IMAGE,
783
0
                                    sizeof(struct jpeg_marker_struct) + limit);
784
0
      cur_marker->next = NULL;
785
0
      cur_marker->marker = (UINT8)cinfo->unread_marker;
786
0
      cur_marker->original_length = (unsigned int)length;
787
0
      cur_marker->data_length = limit;
788
      /* data area is just beyond the jpeg_marker_struct */
789
0
      data = cur_marker->data = (JOCTET *)(cur_marker + 1);
790
0
      marker->cur_marker = cur_marker;
791
0
      marker->bytes_read = 0;
792
0
      bytes_read = 0;
793
0
      data_length = limit;
794
0
    } else {
795
      /* deal with bogus length word */
796
0
      bytes_read = data_length = 0;
797
0
      data = NULL;
798
0
    }
799
0
  } else {
800
    /* resume reading a marker */
801
0
    bytes_read = marker->bytes_read;
802
0
    data_length = cur_marker->data_length;
803
0
    data = cur_marker->data + bytes_read;
804
0
  }
805
806
0
  while (bytes_read < data_length) {
807
0
    INPUT_SYNC(cinfo);          /* move the restart point to here */
808
0
    marker->bytes_read = bytes_read;
809
    /* If there's not at least one byte in buffer, suspend */
810
0
    MAKE_BYTE_AVAIL(cinfo, return FALSE);
811
    /* Copy bytes with reasonable rapidity */
812
0
    while (bytes_read < data_length && bytes_in_buffer > 0) {
813
0
      *data++ = *next_input_byte++;
814
0
      bytes_in_buffer--;
815
0
      bytes_read++;
816
0
    }
817
0
  }
818
819
  /* Done reading what we want to read */
820
0
  if (cur_marker != NULL) {     /* will be NULL if bogus length word */
821
    /* Add new marker to end of list */
822
0
    if (cinfo->marker_list == NULL || cinfo->master->marker_list_end == NULL) {
823
0
      cinfo->marker_list = cinfo->master->marker_list_end = cur_marker;
824
0
    } else {
825
0
      cinfo->master->marker_list_end->next = cur_marker;
826
0
      cinfo->master->marker_list_end = cur_marker;
827
0
    }
828
    /* Reset pointer & calc remaining data length */
829
0
    data = cur_marker->data;
830
0
    length = cur_marker->original_length - data_length;
831
0
  }
832
  /* Reset to initial state for next marker */
833
0
  marker->cur_marker = NULL;
834
835
  /* Process the marker if interesting; else just make a generic trace msg */
836
0
  switch (cinfo->unread_marker) {
837
0
  case M_APP0:
838
0
    examine_app0(cinfo, data, data_length, length);
839
0
    break;
840
0
  case M_APP14:
841
0
    examine_app14(cinfo, data, data_length, length);
842
0
    break;
843
0
  default:
844
0
    TRACEMS2(cinfo, 1, JTRC_MISC_MARKER, cinfo->unread_marker,
845
0
             (int)(data_length + length));
846
0
    break;
847
0
  }
848
849
  /* skip any remaining data -- could be lots */
850
0
  INPUT_SYNC(cinfo);            /* do before skip_input_data */
851
0
  if (length > 0)
852
0
    (*cinfo->src->skip_input_data) (cinfo, (long)length);
853
854
0
  return TRUE;
855
0
}
856
857
#endif /* SAVE_MARKERS_SUPPORTED */
858
859
860
METHODDEF(boolean)
861
skip_variable(j_decompress_ptr cinfo)
862
/* Skip over an unknown or uninteresting variable-length marker */
863
0
{
864
0
  JLONG length;
865
0
  INPUT_VARS(cinfo);
866
867
0
  INPUT_2BYTES(cinfo, length, return FALSE);
868
0
  length -= 2;
869
870
0
  TRACEMS2(cinfo, 1, JTRC_MISC_MARKER, cinfo->unread_marker, (int)length);
871
872
0
  INPUT_SYNC(cinfo);            /* do before skip_input_data */
873
0
  if (length > 0)
874
0
    (*cinfo->src->skip_input_data) (cinfo, (long)length);
875
876
0
  return TRUE;
877
0
}
878
879
880
/*
881
 * Find the next JPEG marker, save it in cinfo->unread_marker.
882
 * Returns FALSE if had to suspend before reaching a marker;
883
 * in that case cinfo->unread_marker is unchanged.
884
 *
885
 * Note that the result might not be a valid marker code,
886
 * but it will never be 0 or FF.
887
 */
888
889
LOCAL(boolean)
890
next_marker(j_decompress_ptr cinfo)
891
0
{
892
0
  int c;
893
0
  INPUT_VARS(cinfo);
894
895
0
  for (;;) {
896
0
    INPUT_BYTE(cinfo, c, return FALSE);
897
    /* Skip any non-FF bytes.
898
     * This may look a bit inefficient, but it will not occur in a valid file.
899
     * We sync after each discarded byte so that a suspending data source
900
     * can discard the byte from its buffer.
901
     */
902
0
    while (c != 0xFF) {
903
0
      cinfo->marker->discarded_bytes++;
904
0
      INPUT_SYNC(cinfo);
905
0
      INPUT_BYTE(cinfo, c, return FALSE);
906
0
    }
907
    /* This loop swallows any duplicate FF bytes.  Extra FFs are legal as
908
     * pad bytes, so don't count them in discarded_bytes.  We assume there
909
     * will not be so many consecutive FF bytes as to overflow a suspending
910
     * data source's input buffer.
911
     */
912
0
    do {
913
0
      INPUT_BYTE(cinfo, c, return FALSE);
914
0
    } while (c == 0xFF);
915
0
    if (c != 0)
916
0
      break;                    /* found a valid marker, exit loop */
917
    /* Reach here if we found a stuffed-zero data sequence (FF/00).
918
     * Discard it and loop back to try again.
919
     */
920
0
    cinfo->marker->discarded_bytes += 2;
921
0
    INPUT_SYNC(cinfo);
922
0
  }
923
924
0
  if (cinfo->marker->discarded_bytes != 0) {
925
0
    WARNMS2(cinfo, JWRN_EXTRANEOUS_DATA, cinfo->marker->discarded_bytes, c);
926
0
    cinfo->marker->discarded_bytes = 0;
927
0
  }
928
929
0
  cinfo->unread_marker = c;
930
931
0
  INPUT_SYNC(cinfo);
932
0
  return TRUE;
933
0
}
934
935
936
LOCAL(boolean)
937
first_marker(j_decompress_ptr cinfo)
938
/* Like next_marker, but used to obtain the initial SOI marker. */
939
/* For this marker, we do not allow preceding garbage or fill; otherwise,
940
 * we might well scan an entire input file before realizing it ain't JPEG.
941
 * If an application wants to process non-JFIF files, it must seek to the
942
 * SOI before calling the JPEG library.
943
 */
944
0
{
945
0
  int c, c2;
946
0
  INPUT_VARS(cinfo);
947
948
0
  INPUT_BYTE(cinfo, c, return FALSE);
949
0
  INPUT_BYTE(cinfo, c2, return FALSE);
950
0
  if (c != 0xFF || c2 != (int)M_SOI)
951
0
    ERREXIT2(cinfo, JERR_NO_SOI, c, c2);
952
953
0
  cinfo->unread_marker = c2;
954
955
0
  INPUT_SYNC(cinfo);
956
0
  return TRUE;
957
0
}
958
959
960
/*
961
 * Read markers until SOS or EOI.
962
 *
963
 * Returns same codes as are defined for jpeg_consume_input:
964
 * JPEG_SUSPENDED, JPEG_REACHED_SOS, or JPEG_REACHED_EOI.
965
 */
966
967
METHODDEF(int)
968
read_markers(j_decompress_ptr cinfo)
969
0
{
970
  /* Outer loop repeats once for each marker. */
971
0
  for (;;) {
972
    /* Collect the marker proper, unless we already did. */
973
    /* NB: first_marker() enforces the requirement that SOI appear first. */
974
0
    if (cinfo->unread_marker == 0) {
975
0
      if (!cinfo->marker->saw_SOI) {
976
0
        if (!first_marker(cinfo))
977
0
          return JPEG_SUSPENDED;
978
0
      } else {
979
0
        if (!next_marker(cinfo))
980
0
          return JPEG_SUSPENDED;
981
0
      }
982
0
    }
983
    /* At this point cinfo->unread_marker contains the marker code and the
984
     * input point is just past the marker proper, but before any parameters.
985
     * A suspension will cause us to return with this state still true.
986
     */
987
0
    switch (cinfo->unread_marker) {
988
0
    case M_SOI:
989
0
      if (!get_soi(cinfo))
990
0
        return JPEG_SUSPENDED;
991
0
      break;
992
993
0
    case M_SOF0:                /* Baseline */
994
0
    case M_SOF1:                /* Extended sequential, Huffman */
995
0
      if (!get_sof(cinfo, FALSE, FALSE, FALSE))
996
0
        return JPEG_SUSPENDED;
997
0
      break;
998
999
0
    case M_SOF2:                /* Progressive, Huffman */
1000
0
      if (!get_sof(cinfo, TRUE, FALSE, FALSE))
1001
0
        return JPEG_SUSPENDED;
1002
0
      break;
1003
1004
0
    case M_SOF3:                /* Lossless, Huffman */
1005
0
      if (!get_sof(cinfo, FALSE, TRUE, FALSE))
1006
0
        return JPEG_SUSPENDED;
1007
0
      break;
1008
1009
0
    case M_SOF9:                /* Extended sequential, arithmetic */
1010
0
      if (!get_sof(cinfo, FALSE, FALSE, TRUE))
1011
0
        return JPEG_SUSPENDED;
1012
0
      break;
1013
1014
0
    case M_SOF10:               /* Progressive, arithmetic */
1015
0
      if (!get_sof(cinfo, TRUE, FALSE, TRUE))
1016
0
        return JPEG_SUSPENDED;
1017
0
      break;
1018
1019
0
    case M_SOF11:               /* Lossless, arithmetic */
1020
0
      if (!get_sof(cinfo, FALSE, TRUE, TRUE))
1021
0
        return JPEG_SUSPENDED;
1022
0
      break;
1023
1024
    /* Currently unsupported SOFn types */
1025
0
    case M_SOF5:                /* Differential sequential, Huffman */
1026
0
    case M_SOF6:                /* Differential progressive, Huffman */
1027
0
    case M_SOF7:                /* Differential lossless, Huffman */
1028
0
    case M_JPG:                 /* Reserved for JPEG extensions */
1029
0
    case M_SOF13:               /* Differential sequential, arithmetic */
1030
0
    case M_SOF14:               /* Differential progressive, arithmetic */
1031
0
    case M_SOF15:               /* Differential lossless, arithmetic */
1032
0
      ERREXIT1(cinfo, JERR_SOF_UNSUPPORTED, cinfo->unread_marker);
1033
0
      break;
1034
1035
0
    case M_SOS:
1036
0
      if (!get_sos(cinfo))
1037
0
        return JPEG_SUSPENDED;
1038
0
      cinfo->unread_marker = 0; /* processed the marker */
1039
0
      return JPEG_REACHED_SOS;
1040
1041
0
    case M_EOI:
1042
0
      TRACEMS(cinfo, 1, JTRC_EOI);
1043
0
      cinfo->unread_marker = 0; /* processed the marker */
1044
0
      return JPEG_REACHED_EOI;
1045
1046
0
    case M_DAC:
1047
0
      if (!get_dac(cinfo))
1048
0
        return JPEG_SUSPENDED;
1049
0
      break;
1050
1051
0
    case M_DHT:
1052
0
      if (!get_dht(cinfo))
1053
0
        return JPEG_SUSPENDED;
1054
0
      break;
1055
1056
0
    case M_DQT:
1057
0
      if (!get_dqt(cinfo))
1058
0
        return JPEG_SUSPENDED;
1059
0
      break;
1060
1061
0
    case M_DRI:
1062
0
      if (!get_dri(cinfo))
1063
0
        return JPEG_SUSPENDED;
1064
0
      break;
1065
1066
0
    case M_APP0:
1067
0
    case M_APP1:
1068
0
    case M_APP2:
1069
0
    case M_APP3:
1070
0
    case M_APP4:
1071
0
    case M_APP5:
1072
0
    case M_APP6:
1073
0
    case M_APP7:
1074
0
    case M_APP8:
1075
0
    case M_APP9:
1076
0
    case M_APP10:
1077
0
    case M_APP11:
1078
0
    case M_APP12:
1079
0
    case M_APP13:
1080
0
    case M_APP14:
1081
0
    case M_APP15:
1082
0
      if (!(*((my_marker_ptr)cinfo->marker)->process_APPn[
1083
0
               cinfo->unread_marker - (int)M_APP0]) (cinfo))
1084
0
        return JPEG_SUSPENDED;
1085
0
      break;
1086
1087
0
    case M_COM:
1088
0
      if (!(*((my_marker_ptr)cinfo->marker)->process_COM) (cinfo))
1089
0
        return JPEG_SUSPENDED;
1090
0
      break;
1091
1092
0
    case M_RST0:                /* these are all parameterless */
1093
0
    case M_RST1:
1094
0
    case M_RST2:
1095
0
    case M_RST3:
1096
0
    case M_RST4:
1097
0
    case M_RST5:
1098
0
    case M_RST6:
1099
0
    case M_RST7:
1100
0
    case M_TEM:
1101
0
      TRACEMS1(cinfo, 1, JTRC_PARMLESS_MARKER, cinfo->unread_marker);
1102
0
      break;
1103
1104
0
    case M_DNL:                 /* Ignore DNL ... perhaps the wrong thing */
1105
0
      if (!skip_variable(cinfo))
1106
0
        return JPEG_SUSPENDED;
1107
0
      break;
1108
1109
0
    default:                    /* must be DHP, EXP, JPGn, or RESn */
1110
      /* For now, we treat the reserved markers as fatal errors since they are
1111
       * likely to be used to signal incompatible JPEG Part 3 extensions.
1112
       * Once the JPEG 3 version-number marker is well defined, this code
1113
       * ought to change!
1114
       */
1115
0
      ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
1116
0
      break;
1117
0
    }
1118
    /* Successfully processed marker, so reset state variable */
1119
0
    cinfo->unread_marker = 0;
1120
0
  } /* end loop */
1121
0
}
1122
1123
1124
/*
1125
 * Read a restart marker, which is expected to appear next in the datastream;
1126
 * if the marker is not there, take appropriate recovery action.
1127
 * Returns FALSE if suspension is required.
1128
 *
1129
 * This is called by the entropy decoder after it has read an appropriate
1130
 * number of MCUs.  cinfo->unread_marker may be nonzero if the entropy decoder
1131
 * has already read a marker from the data source.  Under normal conditions
1132
 * cinfo->unread_marker will be reset to 0 before returning; if not reset,
1133
 * it holds a marker which the decoder will be unable to read past.
1134
 */
1135
1136
METHODDEF(boolean)
1137
read_restart_marker(j_decompress_ptr cinfo)
1138
0
{
1139
  /* Obtain a marker unless we already did. */
1140
  /* Note that next_marker will complain if it skips any data. */
1141
0
  if (cinfo->unread_marker == 0) {
1142
0
    if (!next_marker(cinfo))
1143
0
      return FALSE;
1144
0
  }
1145
1146
0
  if (cinfo->unread_marker ==
1147
0
      ((int)M_RST0 + cinfo->marker->next_restart_num)) {
1148
    /* Normal case --- swallow the marker and let entropy decoder continue */
1149
0
    TRACEMS1(cinfo, 3, JTRC_RST, cinfo->marker->next_restart_num);
1150
0
    cinfo->unread_marker = 0;
1151
0
  } else {
1152
    /* Uh-oh, the restart markers have been messed up. */
1153
    /* Let the data source manager determine how to resync. */
1154
0
    if (!(*cinfo->src->resync_to_restart) (cinfo,
1155
0
                                           cinfo->marker->next_restart_num))
1156
0
      return FALSE;
1157
0
  }
1158
1159
  /* Update next-restart state */
1160
0
  cinfo->marker->next_restart_num = (cinfo->marker->next_restart_num + 1) & 7;
1161
1162
0
  return TRUE;
1163
0
}
1164
1165
1166
/*
1167
 * This is the default resync_to_restart method for data source managers
1168
 * to use if they don't have any better approach.  Some data source managers
1169
 * may be able to back up, or may have additional knowledge about the data
1170
 * which permits a more intelligent recovery strategy; such managers would
1171
 * presumably supply their own resync method.
1172
 *
1173
 * read_restart_marker calls resync_to_restart if it finds a marker other than
1174
 * the restart marker it was expecting.  (This code is *not* used unless
1175
 * a nonzero restart interval has been declared.)  cinfo->unread_marker is
1176
 * the marker code actually found (might be anything, except 0 or FF).
1177
 * The desired restart marker number (0..7) is passed as a parameter.
1178
 * This routine is supposed to apply whatever error recovery strategy seems
1179
 * appropriate in order to position the input stream to the next data segment.
1180
 * Note that cinfo->unread_marker is treated as a marker appearing before
1181
 * the current data-source input point; usually it should be reset to zero
1182
 * before returning.
1183
 * Returns FALSE if suspension is required.
1184
 *
1185
 * This implementation is substantially constrained by wanting to treat the
1186
 * input as a data stream; this means we can't back up.  Therefore, we have
1187
 * only the following actions to work with:
1188
 *   1. Simply discard the marker and let the entropy decoder resume at next
1189
 *      byte of file.
1190
 *   2. Read forward until we find another marker, discarding intervening
1191
 *      data.  (In theory we could look ahead within the current bufferload,
1192
 *      without having to discard data if we don't find the desired marker.
1193
 *      This idea is not implemented here, in part because it makes behavior
1194
 *      dependent on buffer size and chance buffer-boundary positions.)
1195
 *   3. Leave the marker unread (by failing to zero cinfo->unread_marker).
1196
 *      This will cause the entropy decoder to process an empty data segment,
1197
 *      inserting dummy zeroes, and then we will reprocess the marker.
1198
 *
1199
 * #2 is appropriate if we think the desired marker lies ahead, while #3 is
1200
 * appropriate if the found marker is a future restart marker (indicating
1201
 * that we have missed the desired restart marker, probably because it got
1202
 * corrupted).
1203
 * We apply #2 or #3 if the found marker is a restart marker no more than
1204
 * two counts behind or ahead of the expected one.  We also apply #2 if the
1205
 * found marker is not a legal JPEG marker code (it's certainly bogus data).
1206
 * If the found marker is a restart marker more than 2 counts away, we do #1
1207
 * (too much risk that the marker is erroneous; with luck we will be able to
1208
 * resync at some future point).
1209
 * For any valid non-restart JPEG marker, we apply #3.  This keeps us from
1210
 * overrunning the end of a scan.  An implementation limited to single-scan
1211
 * files might find it better to apply #2 for markers other than EOI, since
1212
 * any other marker would have to be bogus data in that case.
1213
 */
1214
1215
GLOBAL(boolean)
1216
jpeg_resync_to_restart(j_decompress_ptr cinfo, int desired)
1217
0
{
1218
0
  int marker = cinfo->unread_marker;
1219
0
  int action = 1;
1220
1221
  /* Always put up a warning. */
1222
0
  WARNMS2(cinfo, JWRN_MUST_RESYNC, marker, desired);
1223
1224
  /* Outer loop handles repeated decision after scanning forward. */
1225
0
  for (;;) {
1226
0
    if (marker < (int)M_SOF0)
1227
0
      action = 2;               /* invalid marker */
1228
0
    else if (marker < (int)M_RST0 || marker > (int)M_RST7)
1229
0
      action = 3;               /* valid non-restart marker */
1230
0
    else {
1231
0
      if (marker == ((int)M_RST0 + ((desired + 1) & 7)) ||
1232
0
          marker == ((int)M_RST0 + ((desired + 2) & 7)))
1233
0
        action = 3;             /* one of the next two expected restarts */
1234
0
      else if (marker == ((int)M_RST0 + ((desired - 1) & 7)) ||
1235
0
               marker == ((int)M_RST0 + ((desired - 2) & 7)))
1236
0
        action = 2;             /* a prior restart, so advance */
1237
0
      else
1238
0
        action = 1;             /* desired restart or too far away */
1239
0
    }
1240
0
    TRACEMS2(cinfo, 4, JTRC_RECOVERY_ACTION, marker, action);
1241
0
    switch (action) {
1242
0
    case 1:
1243
      /* Discard marker and let entropy decoder resume processing. */
1244
0
      cinfo->unread_marker = 0;
1245
0
      return TRUE;
1246
0
    case 2:
1247
      /* Scan to the next marker, and repeat the decision loop. */
1248
0
      if (!next_marker(cinfo))
1249
0
        return FALSE;
1250
0
      marker = cinfo->unread_marker;
1251
0
      break;
1252
0
    case 3:
1253
      /* Return without advancing past this marker. */
1254
      /* Entropy decoder will be forced to process an empty segment. */
1255
0
      return TRUE;
1256
0
    }
1257
0
  } /* end loop */
1258
0
}
1259
1260
1261
/*
1262
 * Reset marker processing state to begin a fresh datastream.
1263
 */
1264
1265
METHODDEF(void)
1266
reset_marker_reader(j_decompress_ptr cinfo)
1267
0
{
1268
0
  my_marker_ptr marker = (my_marker_ptr)cinfo->marker;
1269
1270
0
  cinfo->comp_info = NULL;              /* until allocated by get_sof */
1271
0
  cinfo->input_scan_number = 0;         /* no SOS seen yet */
1272
0
  cinfo->unread_marker = 0;             /* no pending marker */
1273
0
  marker->pub.saw_SOI = FALSE;          /* set internal state too */
1274
0
  marker->pub.saw_SOF = FALSE;
1275
0
  marker->pub.discarded_bytes = 0;
1276
0
  marker->cur_marker = NULL;
1277
0
}
1278
1279
1280
/*
1281
 * Initialize the marker reader module.
1282
 * This is called only once, when the decompression object is created.
1283
 */
1284
1285
GLOBAL(void)
1286
jinit_marker_reader(j_decompress_ptr cinfo)
1287
0
{
1288
0
  my_marker_ptr marker;
1289
0
  int i;
1290
1291
  /* Create subobject in permanent pool */
1292
0
  marker = (my_marker_ptr)
1293
0
    (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_PERMANENT,
1294
0
                                sizeof(my_marker_reader));
1295
0
  cinfo->marker = (struct jpeg_marker_reader *)marker;
1296
  /* Initialize public method pointers */
1297
0
  marker->pub.reset_marker_reader = reset_marker_reader;
1298
0
  marker->pub.read_markers = read_markers;
1299
0
  marker->pub.read_restart_marker = read_restart_marker;
1300
  /* Initialize COM/APPn processing.
1301
   * By default, we examine and then discard APP0 and APP14,
1302
   * but simply discard COM and all other APPn.
1303
   */
1304
0
  marker->process_COM = skip_variable;
1305
0
  marker->length_limit_COM = 0;
1306
0
  for (i = 0; i < 16; i++) {
1307
0
    marker->process_APPn[i] = skip_variable;
1308
0
    marker->length_limit_APPn[i] = 0;
1309
0
  }
1310
0
  marker->process_APPn[0] = get_interesting_appn;
1311
0
  marker->process_APPn[14] = get_interesting_appn;
1312
  /* Reset marker processing state */
1313
0
  reset_marker_reader(cinfo);
1314
0
}
1315
1316
1317
/*
1318
 * Control saving of COM and APPn markers into marker_list.
1319
 */
1320
1321
#ifdef SAVE_MARKERS_SUPPORTED
1322
1323
GLOBAL(void)
1324
jpeg_save_markers(j_decompress_ptr cinfo, int marker_code,
1325
                  unsigned int length_limit)
1326
0
{
1327
0
  my_marker_ptr marker = (my_marker_ptr)cinfo->marker;
1328
0
  long maxlength;
1329
0
  jpeg_marker_parser_method processor;
1330
1331
  /* Length limit mustn't be larger than what we can allocate
1332
   * (should only be a concern in a 16-bit environment).
1333
   */
1334
0
  maxlength = cinfo->mem->max_alloc_chunk - sizeof(struct jpeg_marker_struct);
1335
0
  if (((long)length_limit) > maxlength)
1336
0
    length_limit = (unsigned int)maxlength;
1337
1338
  /* Choose processor routine to use.
1339
   * APP0/APP14 have special requirements.
1340
   */
1341
0
  if (length_limit) {
1342
0
    processor = save_marker;
1343
    /* If saving APP0/APP14, save at least enough for our internal use. */
1344
0
    if (marker_code == (int)M_APP0 && length_limit < APP0_DATA_LEN)
1345
0
      length_limit = APP0_DATA_LEN;
1346
0
    else if (marker_code == (int)M_APP14 && length_limit < APP14_DATA_LEN)
1347
0
      length_limit = APP14_DATA_LEN;
1348
0
  } else {
1349
0
    processor = skip_variable;
1350
    /* If discarding APP0/APP14, use our regular on-the-fly processor. */
1351
0
    if (marker_code == (int)M_APP0 || marker_code == (int)M_APP14)
1352
0
      processor = get_interesting_appn;
1353
0
  }
1354
1355
0
  if (marker_code == (int)M_COM) {
1356
0
    marker->process_COM = processor;
1357
0
    marker->length_limit_COM = length_limit;
1358
0
  } else if (marker_code >= (int)M_APP0 && marker_code <= (int)M_APP15) {
1359
0
    marker->process_APPn[marker_code - (int)M_APP0] = processor;
1360
0
    marker->length_limit_APPn[marker_code - (int)M_APP0] = length_limit;
1361
0
  } else
1362
0
    ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
1363
0
}
1364
1365
#endif /* SAVE_MARKERS_SUPPORTED */
1366
1367
1368
/*
1369
 * Install a special processing method for COM or APPn markers.
1370
 */
1371
1372
GLOBAL(void)
1373
jpeg_set_marker_processor(j_decompress_ptr cinfo, int marker_code,
1374
                          jpeg_marker_parser_method routine)
1375
0
{
1376
0
  my_marker_ptr marker = (my_marker_ptr)cinfo->marker;
1377
1378
0
  if (marker_code == (int)M_COM)
1379
0
    marker->process_COM = routine;
1380
0
  else if (marker_code >= (int)M_APP0 && marker_code <= (int)M_APP15)
1381
0
    marker->process_APPn[marker_code - (int)M_APP0] = routine;
1382
0
  else
1383
0
    ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
1384
0
}