Coverage Report

Created: 2026-03-31 06:35

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libwebp/src/utils/bit_writer_utils.c
Line
Count
Source
1
// Copyright 2011 Google Inc. All Rights Reserved.
2
//
3
// Use of this source code is governed by a BSD-style license
4
// that can be found in the COPYING file in the root of the source
5
// tree. An additional intellectual property rights grant can be found
6
// in the file PATENTS. All contributing project authors may
7
// be found in the AUTHORS file in the root of the source tree.
8
// -----------------------------------------------------------------------------
9
//
10
// Bit writing and boolean coder
11
//
12
// Author: Skal (pascal.massimino@gmail.com)
13
//         Vikas Arora (vikaas.arora@gmail.com)
14
15
#include "src/utils/bit_writer_utils.h"
16
17
#include <assert.h>
18
#include <stdlib.h>
19
#include <string.h>  // for memcpy()
20
21
#include "src/utils/bounds_safety.h"
22
#include "src/utils/endian_inl_utils.h"
23
#include "src/utils/utils.h"
24
#include "src/webp/types.h"
25
26
WEBP_ASSUME_UNSAFE_INDEXABLE_ABI
27
28
//------------------------------------------------------------------------------
29
// VP8BitWriter
30
31
0
static int BitWriterResize(VP8BitWriter* const bw, size_t extra_size) {
32
0
  uint8_t* new_buf;
33
0
  size_t new_size;
34
0
  const uint64_t needed_size_64b = (uint64_t)bw->pos + extra_size;
35
0
  const size_t needed_size = (size_t)needed_size_64b;
36
0
  if (needed_size_64b != needed_size) {
37
0
    bw->error = 1;
38
0
    return 0;
39
0
  }
40
0
  if (needed_size <= bw->max_pos) return 1;
41
  // If the following line wraps over 32bit, the test just after will catch it.
42
0
  new_size = 2 * bw->max_pos;
43
0
  if (new_size < needed_size) new_size = needed_size;
44
0
  if (new_size < 1024) new_size = 1024;
45
0
  new_buf = (uint8_t*)WebPSafeMalloc(1ULL, new_size);
46
0
  if (new_buf == NULL) {
47
0
    bw->error = 1;
48
0
    return 0;
49
0
  }
50
0
  if (bw->pos > 0) {
51
0
    assert(bw->buf != NULL);
52
0
    WEBP_UNSAFE_MEMCPY(new_buf, bw->buf, bw->pos);
53
0
  }
54
0
  WebPSafeFree(bw->buf);
55
0
  bw->buf = WEBP_UNSAFE_FORGE_BIDI_INDEXABLE(uint8_t*, new_buf, new_size);
56
0
  bw->max_pos = new_size;
57
0
  return 1;
58
0
}
59
60
0
static void Flush(VP8BitWriter* const bw) {
61
0
  const int s = 8 + bw->nb_bits;
62
0
  const int32_t bits = bw->value >> s;
63
0
  assert(bw->nb_bits >= 0);
64
0
  bw->value -= bits << s;
65
0
  bw->nb_bits -= 8;
66
0
  if ((bits & 0xff) != 0xff) {
67
0
    size_t pos = bw->pos;
68
0
    if (!BitWriterResize(bw, bw->run + 1)) {
69
0
      return;
70
0
    }
71
0
    if (bits & 0x100) {  // overflow -> propagate carry over pending 0xff's
72
0
      if (pos > 0) bw->buf[pos - 1]++;
73
0
    }
74
0
    if (bw->run > 0) {
75
0
      const int value = (bits & 0x100) ? 0x00 : 0xff;
76
0
      for (; bw->run > 0; --bw->run) bw->buf[pos++] = value;
77
0
    }
78
0
    bw->buf[pos++] = bits & 0xff;
79
0
    bw->pos = pos;
80
0
  } else {
81
0
    bw->run++;  // delay writing of bytes 0xff, pending eventual carry.
82
0
  }
83
0
}
84
85
//------------------------------------------------------------------------------
86
// renormalization
87
88
static const uint8_t kNorm[128] = {  // renorm_sizes[i] = 8 - log2(i)
89
    7, 6, 6, 5, 5, 5, 5, 4, 4, 4, 4, 4, 4, 4, 4, 3, 3, 3, 3, 3, 3, 3,
90
    3, 3, 3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
91
    2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 1, 1, 1,
92
    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
93
    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
94
    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0};
95
96
// range = ((range + 1) << kVP8Log2Range[range]) - 1
97
static const uint8_t kNewRange[128] = {
98
    127, 127, 191, 127, 159, 191, 223, 127, 143, 159, 175, 191, 207, 223, 239,
99
    127, 135, 143, 151, 159, 167, 175, 183, 191, 199, 207, 215, 223, 231, 239,
100
    247, 127, 131, 135, 139, 143, 147, 151, 155, 159, 163, 167, 171, 175, 179,
101
    183, 187, 191, 195, 199, 203, 207, 211, 215, 219, 223, 227, 231, 235, 239,
102
    243, 247, 251, 127, 129, 131, 133, 135, 137, 139, 141, 143, 145, 147, 149,
103
    151, 153, 155, 157, 159, 161, 163, 165, 167, 169, 171, 173, 175, 177, 179,
104
    181, 183, 185, 187, 189, 191, 193, 195, 197, 199, 201, 203, 205, 207, 209,
105
    211, 213, 215, 217, 219, 221, 223, 225, 227, 229, 231, 233, 235, 237, 239,
106
    241, 243, 245, 247, 249, 251, 253, 127};
107
108
0
int VP8PutBit(VP8BitWriter* const bw, int bit, int prob) {
109
0
  const int split = (bw->range * prob) >> 8;
110
0
  if (bit) {
111
0
    bw->value += split + 1;
112
0
    bw->range -= split + 1;
113
0
  } else {
114
0
    bw->range = split;
115
0
  }
116
0
  if (bw->range < 127) {  // emit 'shift' bits out and renormalize
117
0
    const int shift = kNorm[bw->range];
118
0
    bw->range = kNewRange[bw->range];
119
0
    bw->value <<= shift;
120
0
    bw->nb_bits += shift;
121
0
    if (bw->nb_bits > 0) Flush(bw);
122
0
  }
123
0
  return bit;
124
0
}
125
126
0
int VP8PutBitUniform(VP8BitWriter* const bw, int bit) {
127
0
  const int split = bw->range >> 1;
128
0
  if (bit) {
129
0
    bw->value += split + 1;
130
0
    bw->range -= split + 1;
131
0
  } else {
132
0
    bw->range = split;
133
0
  }
134
0
  if (bw->range < 127) {
135
0
    bw->range = kNewRange[bw->range];
136
0
    bw->value <<= 1;
137
0
    bw->nb_bits += 1;
138
0
    if (bw->nb_bits > 0) Flush(bw);
139
0
  }
140
0
  return bit;
141
0
}
142
143
0
void VP8PutBits(VP8BitWriter* const bw, uint32_t value, int nb_bits) {
144
0
  uint32_t mask;
145
0
  assert(nb_bits > 0 && nb_bits < 32);
146
0
  for (mask = 1u << (nb_bits - 1); mask; mask >>= 1) {
147
0
    VP8PutBitUniform(bw, value & mask);
148
0
  }
149
0
}
150
151
0
void VP8PutSignedBits(VP8BitWriter* const bw, int value, int nb_bits) {
152
0
  if (!VP8PutBitUniform(bw, value != 0)) return;
153
0
  if (value < 0) {
154
0
    VP8PutBits(bw, ((-value) << 1) | 1, nb_bits + 1);
155
0
  } else {
156
0
    VP8PutBits(bw, value << 1, nb_bits + 1);
157
0
  }
158
0
}
159
160
//------------------------------------------------------------------------------
161
162
0
int VP8BitWriterInit(VP8BitWriter* const bw, size_t expected_size) {
163
0
  bw->range = 255 - 1;
164
0
  bw->value = 0;
165
0
  bw->run = 0;
166
0
  bw->nb_bits = -8;
167
0
  bw->pos = 0;
168
0
  bw->max_pos = 0;
169
0
  bw->error = 0;
170
0
  bw->buf = NULL;
171
0
  return (expected_size > 0) ? BitWriterResize(bw, expected_size) : 1;
172
0
}
173
174
0
uint8_t* VP8BitWriterFinish(VP8BitWriter* const bw) {
175
0
  VP8PutBits(bw, 0, 9 - bw->nb_bits);
176
0
  bw->nb_bits = 0;  // pad with zeroes
177
0
  Flush(bw);
178
0
  return bw->buf;
179
0
}
180
181
int VP8BitWriterAppend(VP8BitWriter* const bw, const uint8_t* data,
182
0
                       size_t size) {
183
0
  assert(data != NULL);
184
0
  if (bw->nb_bits != -8) return 0;  // Flush() must have been called
185
0
  if (!BitWriterResize(bw, size)) return 0;
186
0
  WEBP_UNSAFE_MEMCPY(bw->buf + bw->pos, data, size);
187
0
  bw->pos += size;
188
0
  return 1;
189
0
}
190
191
0
void VP8BitWriterWipeOut(VP8BitWriter* const bw) {
192
0
  if (bw != NULL) {
193
0
    WebPSafeFree(bw->buf);
194
0
    WEBP_UNSAFE_MEMSET(bw, 0, sizeof(*bw));
195
0
  }
196
0
}
197
198
//------------------------------------------------------------------------------
199
// VP8LBitWriter
200
201
// This is the minimum amount of size the memory buffer is guaranteed to grow
202
// when extra space is needed.
203
0
#define MIN_EXTRA_SIZE (32768ULL)
204
205
// Returns 1 on success.
206
0
static int VP8LBitWriterResize(VP8LBitWriter* const bw, size_t extra_size) {
207
0
  uint8_t* WEBP_BIDI_INDEXABLE allocated_buf;
208
0
  size_t allocated_size;
209
0
  const size_t max_bytes = bw->end - bw->buf;
210
0
  const size_t current_size = bw->cur - bw->buf;
211
0
  const uint64_t size_required_64b = (uint64_t)current_size + extra_size;
212
0
  const size_t size_required = (size_t)size_required_64b;
213
0
  if (size_required != size_required_64b) {
214
0
    bw->error = 1;
215
0
    return 0;
216
0
  }
217
0
  if (max_bytes > 0 && size_required <= max_bytes) return 1;
218
0
  allocated_size = (3 * max_bytes) >> 1;
219
0
  if (allocated_size < size_required) allocated_size = size_required;
220
  // make allocated size multiple of 1k
221
0
  allocated_size = (((allocated_size >> 10) + 1) << 10);
222
0
  allocated_buf = (uint8_t*)WEBP_UNSAFE_FORGE_BIDI_INDEXABLE(
223
0
      void*, WebPSafeMalloc(1ULL, allocated_size), allocated_size);
224
0
  if (allocated_buf == NULL) {
225
0
    bw->error = 1;
226
0
    return 0;
227
0
  }
228
0
  if (current_size > 0) {
229
0
    WEBP_UNSAFE_MEMCPY(allocated_buf, bw->buf, current_size);
230
0
  }
231
0
  WebPSafeFree(bw->buf);
232
0
  bw->buf = allocated_buf;
233
0
  bw->end = allocated_buf + allocated_size;
234
0
  bw->cur = allocated_buf + current_size;
235
0
  return 1;
236
0
}
237
238
0
int VP8LBitWriterInit(VP8LBitWriter* const bw, size_t expected_size) {
239
0
  WEBP_UNSAFE_MEMSET(bw, 0, sizeof(*bw));
240
0
  return VP8LBitWriterResize(bw, expected_size);
241
0
}
242
243
int VP8LBitWriterClone(const VP8LBitWriter* const src,
244
0
                       VP8LBitWriter* const dst) {
245
0
  const size_t current_size = src->cur - src->buf;
246
0
  assert(src->cur >= src->buf && src->cur <= src->end);
247
0
  if (!VP8LBitWriterResize(dst, current_size)) return 0;
248
0
  WEBP_UNSAFE_MEMCPY(dst->buf, src->buf, current_size);
249
0
  dst->bits = src->bits;
250
0
  dst->used = src->used;
251
0
  dst->error = src->error;
252
0
  dst->cur = dst->buf + current_size;
253
0
  return 1;
254
0
}
255
256
0
void VP8LBitWriterWipeOut(VP8LBitWriter* const bw) {
257
0
  if (bw != NULL) {
258
0
    WebPSafeFree(bw->buf);
259
0
    WEBP_UNSAFE_MEMSET(bw, 0, sizeof(*bw));
260
0
  }
261
0
}
262
263
void VP8LBitWriterReset(const VP8LBitWriter* const bw_init,
264
0
                        VP8LBitWriter* const bw) {
265
0
  bw->bits = bw_init->bits;
266
0
  bw->used = bw_init->used;
267
0
  bw->cur = bw->buf + (bw_init->cur - bw_init->buf);
268
0
  assert(bw->cur <= bw->end);
269
0
  bw->error = bw_init->error;
270
0
}
271
272
0
void VP8LBitWriterSwap(VP8LBitWriter* const src, VP8LBitWriter* const dst) {
273
0
  const VP8LBitWriter tmp = *src;
274
0
  *src = *dst;
275
0
  *dst = tmp;
276
0
}
277
278
void VP8LPutBitsFlushBits(VP8LBitWriter* const bw, int* used,
279
0
                          vp8l_atype_t* bits) {
280
  // If needed, make some room by flushing some bits out.
281
0
  if (bw->cur + VP8L_WRITER_BYTES > bw->end) {
282
0
    const uint64_t extra_size = (bw->end - bw->buf) + MIN_EXTRA_SIZE;
283
0
    if (!CheckSizeOverflow(extra_size) ||
284
0
        !VP8LBitWriterResize(bw, (size_t)extra_size)) {
285
0
      bw->cur = bw->buf;
286
0
      bw->error = 1;
287
0
      return;
288
0
    }
289
0
  }
290
0
  *(vp8l_wtype_t*)bw->cur = (vp8l_wtype_t)WSWAP((vp8l_wtype_t)*bits);
291
0
  bw->cur += VP8L_WRITER_BYTES;
292
0
  *bits >>= VP8L_WRITER_BITS;
293
0
  *used -= VP8L_WRITER_BITS;
294
0
}
295
296
#if VP8L_WRITER_BITS == 16
297
void VP8LPutBitsInternal(VP8LBitWriter* const bw, uint32_t bits, int n_bits) {
298
  vp8l_atype_t lbits = bw->bits;
299
  int used = bw->used;
300
  assert(n_bits <= VP8L_WRITER_MAX_BITS);
301
  if (n_bits == 0) return;
302
  // Special case of overflow handling for 32bit accumulator (2-steps flush).
303
  if (used + n_bits >= VP8L_WRITER_MAX_BITS) {
304
    // Fill up all the VP8L_WRITER_MAX_BITS so it can be flushed out below.
305
    const int shift = VP8L_WRITER_MAX_BITS - used;
306
    lbits |= (vp8l_atype_t)bits << used;
307
    used = VP8L_WRITER_MAX_BITS;
308
    n_bits -= shift;
309
    if (shift >= (int)sizeof(bits) * 8) {
310
      // Undefined behavior.
311
      assert(shift == (int)sizeof(bits) * 8);
312
      bits = 0;
313
    } else {
314
      bits >>= shift;
315
    }
316
    assert(n_bits <= VP8L_WRITER_MAX_BITS);
317
  }
318
  // If needed, make some room by flushing some bits out.
319
  while (used >= VP8L_WRITER_BITS) {
320
    VP8LPutBitsFlushBits(bw, &used, &lbits);
321
  }
322
  bw->bits = lbits | ((vp8l_atype_t)bits << used);
323
  bw->used = used + n_bits;
324
}
325
#endif  // VP8L_WRITER_BITS == 16
326
327
0
uint8_t* VP8LBitWriterFinish(VP8LBitWriter* const bw) {
328
  // flush leftover bits
329
0
  if (VP8LBitWriterResize(bw, (bw->used + 7) >> 3)) {
330
0
    while (bw->used > 0) {
331
0
      *bw->cur++ = (uint8_t)bw->bits;
332
0
      bw->bits >>= 8;
333
0
      bw->used -= 8;
334
0
    }
335
0
    bw->used = 0;
336
0
  }
337
0
  return bw->buf;
338
0
}
339
340
//------------------------------------------------------------------------------