Coverage Report

Created: 2025-08-09 06:49

/src/libjpeg-turbo.3.0.x/jdhuff.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * jdhuff.c
3
 *
4
 * This file was part of the Independent JPEG Group's software:
5
 * Copyright (C) 1991-1997, Thomas G. Lane.
6
 * Lossless JPEG Modifications:
7
 * Copyright (C) 1999, Ken Murchison.
8
 * libjpeg-turbo Modifications:
9
 * Copyright (C) 2009-2011, 2016, 2018-2019, 2022, D. R. Commander.
10
 * Copyright (C) 2018, Matthias Räncker.
11
 * For conditions of distribution and use, see the accompanying README.ijg
12
 * file.
13
 *
14
 * This file contains Huffman entropy decoding routines.
15
 *
16
 * Much of the complexity here has to do with supporting input suspension.
17
 * If the data source module demands suspension, we want to be able to back
18
 * up to the start of the current MCU.  To do this, we copy state variables
19
 * into local working storage, and update them back to the permanent
20
 * storage only upon successful completion of an MCU.
21
 *
22
 * NOTE: All referenced figures are from
23
 * Recommendation ITU-T T.81 (1992) | ISO/IEC 10918-1:1994.
24
 */
25
26
#define JPEG_INTERNALS
27
#include "jinclude.h"
28
#include "jpeglib.h"
29
#include "jdhuff.h"             /* Declarations shared with jd*huff.c */
30
#include "jpegapicomp.h"
31
#include "jstdhuff.c"
32
33
34
/*
35
 * Expanded entropy decoder object for Huffman decoding.
36
 *
37
 * The savable_state subrecord contains fields that change within an MCU,
38
 * but must not be updated permanently until we complete the MCU.
39
 */
40
41
typedef struct {
42
  int last_dc_val[MAX_COMPS_IN_SCAN]; /* last DC coef for each component */
43
} savable_state;
44
45
typedef struct {
46
  struct jpeg_entropy_decoder pub; /* public fields */
47
48
  /* These fields are loaded into local variables at start of each MCU.
49
   * In case of suspension, we exit WITHOUT updating them.
50
   */
51
  bitread_perm_state bitstate;  /* Bit buffer at start of MCU */
52
  savable_state saved;          /* Other state at start of MCU */
53
54
  /* These fields are NOT loaded into local working state. */
55
  unsigned int restarts_to_go;  /* MCUs left in this restart interval */
56
57
  /* Pointers to derived tables (these workspaces have image lifespan) */
58
  d_derived_tbl *dc_derived_tbls[NUM_HUFF_TBLS];
59
  d_derived_tbl *ac_derived_tbls[NUM_HUFF_TBLS];
60
61
  /* Precalculated info set up by start_pass for use in decode_mcu: */
62
63
  /* Pointers to derived tables to be used for each block within an MCU */
64
  d_derived_tbl *dc_cur_tbls[D_MAX_BLOCKS_IN_MCU];
65
  d_derived_tbl *ac_cur_tbls[D_MAX_BLOCKS_IN_MCU];
66
  /* Whether we care about the DC and AC coefficient values for each block */
67
  boolean dc_needed[D_MAX_BLOCKS_IN_MCU];
68
  boolean ac_needed[D_MAX_BLOCKS_IN_MCU];
69
} huff_entropy_decoder;
70
71
typedef huff_entropy_decoder *huff_entropy_ptr;
72
73
74
/*
75
 * Initialize for a Huffman-compressed scan.
76
 */
77
78
METHODDEF(void)
79
start_pass_huff_decoder(j_decompress_ptr cinfo)
80
108k
{
81
108k
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
82
108k
  int ci, blkn, dctbl, actbl;
83
108k
  d_derived_tbl **pdtbl;
84
108k
  jpeg_component_info *compptr;
85
86
  /* Check that the scan parameters Ss, Se, Ah/Al are OK for sequential JPEG.
87
   * This ought to be an error condition, but we make it a warning because
88
   * there are some baseline files out there with all zeroes in these bytes.
89
   */
90
108k
  if (cinfo->Ss != 0 || cinfo->Se != DCTSIZE2 - 1 ||
91
108k
      cinfo->Ah != 0 || cinfo->Al != 0)
92
94.6k
    WARNMS(cinfo, JWRN_NOT_SEQUENTIAL);
93
94
290k
  for (ci = 0; ci < cinfo->comps_in_scan; ci++) {
95
181k
    compptr = cinfo->cur_comp_info[ci];
96
181k
    dctbl = compptr->dc_tbl_no;
97
181k
    actbl = compptr->ac_tbl_no;
98
    /* Compute derived values for Huffman tables */
99
    /* We may do this more than once for a table, but it's not expensive */
100
181k
    pdtbl = (d_derived_tbl **)(entropy->dc_derived_tbls) + dctbl;
101
181k
    jpeg_make_d_derived_tbl(cinfo, TRUE, dctbl, pdtbl);
102
181k
    pdtbl = (d_derived_tbl **)(entropy->ac_derived_tbls) + actbl;
103
181k
    jpeg_make_d_derived_tbl(cinfo, FALSE, actbl, pdtbl);
104
    /* Initialize DC predictions to 0 */
105
181k
    entropy->saved.last_dc_val[ci] = 0;
106
181k
  }
107
108
  /* Precalculate decoding info for each block in an MCU of this scan */
109
493k
  for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
110
384k
    ci = cinfo->MCU_membership[blkn];
111
384k
    compptr = cinfo->cur_comp_info[ci];
112
    /* Precalculate which table to use for each block */
113
384k
    entropy->dc_cur_tbls[blkn] = entropy->dc_derived_tbls[compptr->dc_tbl_no];
114
384k
    entropy->ac_cur_tbls[blkn] = entropy->ac_derived_tbls[compptr->ac_tbl_no];
115
    /* Decide whether we really care about the coefficient values */
116
384k
    if (compptr->component_needed) {
117
381k
      entropy->dc_needed[blkn] = TRUE;
118
      /* we don't need the ACs if producing a 1/8th-size image */
119
381k
      entropy->ac_needed[blkn] = (compptr->_DCT_scaled_size > 1);
120
381k
    } else {
121
3.55k
      entropy->dc_needed[blkn] = entropy->ac_needed[blkn] = FALSE;
122
3.55k
    }
123
384k
  }
124
125
  /* Initialize bitread state variables */
126
108k
  entropy->bitstate.bits_left = 0;
127
108k
  entropy->bitstate.get_buffer = 0; /* unnecessary, but keeps Purify quiet */
128
108k
  entropy->pub.insufficient_data = FALSE;
129
130
  /* Initialize restart counter */
131
108k
  entropy->restarts_to_go = cinfo->restart_interval;
132
108k
}
133
134
135
/*
136
 * Compute the derived values for a Huffman table.
137
 * This routine also performs some validation checks on the table.
138
 *
139
 * Note this is also used by jdphuff.c and jdlhuff.c.
140
 */
141
142
GLOBAL(void)
143
jpeg_make_d_derived_tbl(j_decompress_ptr cinfo, boolean isDC, int tblno,
144
                        d_derived_tbl **pdtbl)
145
413k
{
146
413k
  JHUFF_TBL *htbl;
147
413k
  d_derived_tbl *dtbl;
148
413k
  int p, i, l, si, numsymbols;
149
413k
  int lookbits, ctr;
150
413k
  char huffsize[257];
151
413k
  unsigned int huffcode[257];
152
413k
  unsigned int code;
153
154
  /* Note that huffsize[] and huffcode[] are filled in code-length order,
155
   * paralleling the order of the symbols themselves in htbl->huffval[].
156
   */
157
158
  /* Find the input Huffman table */
159
413k
  if (tblno < 0 || tblno >= NUM_HUFF_TBLS)
160
348
    ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno);
161
413k
  htbl =
162
413k
    isDC ? cinfo->dc_huff_tbl_ptrs[tblno] : cinfo->ac_huff_tbl_ptrs[tblno];
163
413k
  if (htbl == NULL)
164
255
    ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno);
165
166
  /* Allocate a workspace if we haven't already done so. */
167
413k
  if (*pdtbl == NULL)
168
47.2k
    *pdtbl = (d_derived_tbl *)
169
47.2k
      (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
170
47.2k
                                  sizeof(d_derived_tbl));
171
413k
  dtbl = *pdtbl;
172
413k
  dtbl->pub = htbl;             /* fill in back link */
173
174
  /* Figure C.1: make table of Huffman code length for each symbol */
175
176
413k
  p = 0;
177
7.02M
  for (l = 1; l <= 16; l++) {
178
6.60M
    i = (int)htbl->bits[l];
179
6.60M
    if (i < 0 || p + i > 256)   /* protect against table overrun */
180
0
      ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
181
24.0M
    while (i--)
182
17.4M
      huffsize[p++] = (char)l;
183
6.60M
  }
184
413k
  huffsize[p] = 0;
185
413k
  numsymbols = p;
186
187
  /* Figure C.2: generate the codes themselves */
188
  /* We also validate that the counts represent a legal Huffman code tree. */
189
190
413k
  code = 0;
191
413k
  si = huffsize[0];
192
413k
  p = 0;
193
4.48M
  while (huffsize[p]) {
194
21.5M
    while (((int)huffsize[p]) == si) {
195
17.4M
      huffcode[p++] = code;
196
17.4M
      code++;
197
17.4M
    }
198
    /* code is now 1 more than the last code used for codelength si; but
199
     * it must still fit in si bits, since no code is allowed to be all ones.
200
     */
201
4.07M
    if (((JLONG)code) >= (((JLONG)1) << si))
202
702
      ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
203
4.07M
    code <<= 1;
204
4.07M
    si++;
205
4.07M
  }
206
207
  /* Figure F.15: generate decoding tables for bit-sequential decoding */
208
209
413k
  p = 0;
210
7.01M
  for (l = 1; l <= 16; l++) {
211
6.59M
    if (htbl->bits[l]) {
212
      /* valoffset[l] = huffval[] index of 1st symbol of code length l,
213
       * minus the minimum code of length l
214
       */
215
3.02M
      dtbl->valoffset[l] = (JLONG)p - (JLONG)huffcode[p];
216
3.02M
      p += htbl->bits[l];
217
3.02M
      dtbl->maxcode[l] = huffcode[p - 1]; /* maximum code of length l */
218
3.56M
    } else {
219
3.56M
      dtbl->maxcode[l] = -1;    /* -1 if no codes of this length */
220
3.56M
    }
221
6.59M
  }
222
413k
  dtbl->valoffset[17] = 0;
223
413k
  dtbl->maxcode[17] = 0xFFFFFL; /* ensures jpeg_huff_decode terminates */
224
225
  /* Compute lookahead tables to speed up decoding.
226
   * First we set all the table entries to 0, indicating "too long";
227
   * then we iterate through the Huffman codes that are short enough and
228
   * fill in all the entries that correspond to bit sequences starting
229
   * with that code.
230
   */
231
232
105M
  for (i = 0; i < (1 << HUFF_LOOKAHEAD); i++)
233
105M
    dtbl->lookup[i] = (HUFF_LOOKAHEAD + 1) << HUFF_LOOKAHEAD;
234
235
413k
  p = 0;
236
3.71M
  for (l = 1; l <= HUFF_LOOKAHEAD; l++) {
237
7.42M
    for (i = 1; i <= (int)htbl->bits[l]; i++, p++) {
238
      /* l = current code's length, p = its index in huffcode[] & huffval[]. */
239
      /* Generate left-justified code followed by all possible bit sequences */
240
4.13M
      lookbits = huffcode[p] << (HUFF_LOOKAHEAD - l);
241
99.5M
      for (ctr = 1 << (HUFF_LOOKAHEAD - l); ctr > 0; ctr--) {
242
95.3M
        dtbl->lookup[lookbits] = (l << HUFF_LOOKAHEAD) | htbl->huffval[p];
243
95.3M
        lookbits++;
244
95.3M
      }
245
4.13M
    }
246
3.29M
  }
247
248
  /* Validate symbols as being reasonable.
249
   * For AC tables, we make no check, but accept all byte values 0..255.
250
   * For DC tables, we require the symbols to be in range 0..15 in lossy mode
251
   * and 0..16 in lossless mode.  (Tighter bounds could be applied depending on
252
   * the data depth and mode, but this is sufficient to ensure safe decoding.)
253
   */
254
413k
  if (isDC) {
255
2.01M
    for (i = 0; i < numsymbols; i++) {
256
1.79M
      int sym = htbl->huffval[i];
257
1.79M
      if (sym < 0 || sym > (cinfo->master->lossless ? 16 : 15))
258
1.03k
        ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
259
1.79M
    }
260
215k
  }
261
413k
}
262
263
264
/*
265
 * Out-of-line code for bit fetching (shared with jdphuff.c and jdlhuff.c).
266
 * See jdhuff.h for info about usage.
267
 * Note: current values of get_buffer and bits_left are passed as parameters,
268
 * but are returned in the corresponding fields of the state struct.
269
 *
270
 * On most machines MIN_GET_BITS should be 25 to allow the full 32-bit width
271
 * of get_buffer to be used.  (On machines with wider words, an even larger
272
 * buffer could be used.)  However, on some machines 32-bit shifts are
273
 * quite slow and take time proportional to the number of places shifted.
274
 * (This is true with most PC compilers, for instance.)  In this case it may
275
 * be a win to set MIN_GET_BITS to the minimum value of 15.  This reduces the
276
 * average shift distance at the cost of more calls to jpeg_fill_bit_buffer.
277
 */
278
279
#ifdef SLOW_SHIFT_32
280
#define MIN_GET_BITS  15        /* minimum allowable value */
281
#else
282
605M
#define MIN_GET_BITS  (BIT_BUF_SIZE - 7)
283
#endif
284
285
286
GLOBAL(boolean)
287
jpeg_fill_bit_buffer(bitread_working_state *state,
288
                     register bit_buf_type get_buffer, register int bits_left,
289
                     int nbits)
290
/* Load up the bit buffer to a depth of at least nbits */
291
319M
{
292
  /* Copy heavily used state fields into locals (hopefully registers) */
293
319M
  register const JOCTET *next_input_byte = state->next_input_byte;
294
319M
  register size_t bytes_in_buffer = state->bytes_in_buffer;
295
319M
  j_decompress_ptr cinfo = state->cinfo;
296
297
  /* Attempt to load at least MIN_GET_BITS bits into get_buffer. */
298
  /* (It is assumed that no request will be for more than that many bits.) */
299
  /* We fail to do so only if we hit a marker or are forced to suspend. */
300
301
319M
  if (cinfo->unread_marker == 0) {      /* cannot advance past a marker */
302
6.92M
    while (bits_left < MIN_GET_BITS) {
303
6.10M
      register int c;
304
305
      /* Attempt to read a byte */
306
6.10M
      if (bytes_in_buffer == 0) {
307
12.6k
        if (!(*cinfo->src->fill_input_buffer) (cinfo))
308
0
          return FALSE;
309
12.6k
        next_input_byte = cinfo->src->next_input_byte;
310
12.6k
        bytes_in_buffer = cinfo->src->bytes_in_buffer;
311
12.6k
      }
312
6.10M
      bytes_in_buffer--;
313
6.10M
      c = *next_input_byte++;
314
315
      /* If it's 0xFF, check and discard stuffed zero byte */
316
6.10M
      if (c == 0xFF) {
317
        /* Loop here to discard any padding FF's on terminating marker,
318
         * so that we can save a valid unread_marker value.  NOTE: we will
319
         * accept multiple FF's followed by a 0 as meaning a single FF data
320
         * byte.  This data pattern is not valid according to the standard.
321
         */
322
614k
        do {
323
614k
          if (bytes_in_buffer == 0) {
324
347
            if (!(*cinfo->src->fill_input_buffer) (cinfo))
325
0
              return FALSE;
326
347
            next_input_byte = cinfo->src->next_input_byte;
327
347
            bytes_in_buffer = cinfo->src->bytes_in_buffer;
328
347
          }
329
614k
          bytes_in_buffer--;
330
614k
          c = *next_input_byte++;
331
614k
        } while (c == 0xFF);
332
333
380k
        if (c == 0) {
334
          /* Found FF/00, which represents an FF data byte */
335
177k
          c = 0xFF;
336
203k
        } else {
337
          /* Oops, it's actually a marker indicating end of compressed data.
338
           * Save the marker code for later use.
339
           * Fine point: it might appear that we should save the marker into
340
           * bitread working state, not straight into permanent state.  But
341
           * once we have hit a marker, we cannot need to suspend within the
342
           * current MCU, because we will read no more bytes from the data
343
           * source.  So it is OK to update permanent state right away.
344
           */
345
203k
          cinfo->unread_marker = c;
346
          /* See if we need to insert some fake zero bits. */
347
203k
          goto no_more_bytes;
348
203k
        }
349
380k
      }
350
351
      /* OK, load c into get_buffer */
352
5.90M
      get_buffer = (get_buffer << 8) | c;
353
5.90M
      bits_left += 8;
354
5.90M
    } /* end while */
355
318M
  } else {
356
318M
no_more_bytes:
357
    /* We get here if we've read the marker that terminates the compressed
358
     * data segment.  There should be enough bits in the buffer register
359
     * to satisfy the request; if so, no problem.
360
     */
361
318M
    if (nbits > bits_left) {
362
      /* Uh-oh.  Report corrupted data to user and stuff zeroes into
363
       * the data stream, so that we can produce some kind of image.
364
       * We use a nonvolatile flag to ensure that only one warning message
365
       * appears per data segment.
366
       */
367
299M
      if (!cinfo->entropy->insufficient_data) {
368
191k
        WARNMS(cinfo, JWRN_HIT_MARKER);
369
191k
        cinfo->entropy->insufficient_data = TRUE;
370
191k
      }
371
      /* Fill the buffer with zero bits */
372
299M
      get_buffer <<= MIN_GET_BITS - bits_left;
373
299M
      bits_left = MIN_GET_BITS;
374
299M
    }
375
318M
  }
376
377
  /* Unload the local registers */
378
319M
  state->next_input_byte = next_input_byte;
379
319M
  state->bytes_in_buffer = bytes_in_buffer;
380
319M
  state->get_buffer = get_buffer;
381
319M
  state->bits_left = bits_left;
382
383
319M
  return TRUE;
384
319M
}
385
386
387
/* Macro version of the above, which performs much better but does not
388
   handle markers.  We have to hand off any blocks with markers to the
389
   slower routines. */
390
391
10.5M
#define GET_BYTE { \
392
10.5M
  register int c0, c1; \
393
10.5M
  c0 = *buffer++; \
394
10.5M
  c1 = *buffer; \
395
10.5M
  /* Pre-execute most common case */ \
396
10.5M
  get_buffer = (get_buffer << 8) | c0; \
397
10.5M
  bits_left += 8; \
398
10.5M
  if (c0 == 0xFF) { \
399
1.60M
    /* Pre-execute case of FF/00, which represents an FF data byte */ \
400
1.60M
    buffer++; \
401
1.60M
    if (c1 != 0) { \
402
1.42M
      /* Oops, it's actually a marker indicating end of compressed data. */ \
403
1.42M
      cinfo->unread_marker = c1; \
404
1.42M
      /* Back out pre-execution and fill the buffer with zero bits */ \
405
1.42M
      buffer -= 2; \
406
1.42M
      get_buffer &= ~0xFF; \
407
1.42M
    } \
408
1.60M
  } \
409
10.5M
}
410
411
#if SIZEOF_SIZE_T == 8 || defined(_WIN64) || (defined(__x86_64__) && defined(__ILP32__))
412
413
/* Pre-fetch 48 bytes, because the holding register is 64-bit */
414
#define FILL_BIT_BUFFER_FAST \
415
34.4M
  if (bits_left <= 16) { \
416
1.76M
    GET_BYTE GET_BYTE GET_BYTE GET_BYTE GET_BYTE GET_BYTE \
417
1.76M
  }
418
419
#else
420
421
/* Pre-fetch 16 bytes, because the holding register is 32-bit */
422
#define FILL_BIT_BUFFER_FAST \
423
  if (bits_left <= 16) { \
424
    GET_BYTE GET_BYTE \
425
  }
426
427
#endif
428
429
430
/*
431
 * Out-of-line code for Huffman code decoding.
432
 * See jdhuff.h for info about usage.
433
 */
434
435
GLOBAL(int)
436
jpeg_huff_decode(bitread_working_state *state,
437
                 register bit_buf_type get_buffer, register int bits_left,
438
                 d_derived_tbl *htbl, int min_bits)
439
64.5M
{
440
64.5M
  register int l = min_bits;
441
64.5M
  register JLONG code;
442
443
  /* HUFF_DECODE has determined that the code is at least min_bits */
444
  /* bits long, so fetch that many bits in one swoop. */
445
446
64.5M
  CHECK_BIT_BUFFER(*state, l, return -1);
447
64.5M
  code = GET_BITS(l);
448
449
  /* Collect the rest of the Huffman code one bit at a time. */
450
  /* This is per Figure F.16. */
451
452
560M
  while (code > htbl->maxcode[l]) {
453
495M
    code <<= 1;
454
495M
    CHECK_BIT_BUFFER(*state, 1, return -1);
455
495M
    code |= GET_BITS(1);
456
495M
    l++;
457
495M
  }
458
459
  /* Unload the local registers */
460
64.5M
  state->get_buffer = get_buffer;
461
64.5M
  state->bits_left = bits_left;
462
463
  /* With garbage input we may reach the sentinel value l = 17. */
464
465
64.5M
  if (l > 16) {
466
48.6M
    WARNMS(state->cinfo, JWRN_HUFF_BAD_CODE);
467
48.6M
    return 0;                   /* fake a zero as the safest result */
468
48.6M
  }
469
470
15.9M
  return htbl->pub->huffval[(int)(code + htbl->valoffset[l])];
471
64.5M
}
472
473
474
/*
475
 * Figure F.12: extend sign bit.
476
 * On some machines, a shift and add will be faster than a table lookup.
477
 */
478
479
#define AVOID_TABLES
480
#ifdef AVOID_TABLES
481
482
25.0M
#define NEG_1  ((unsigned int)-1)
483
#define HUFF_EXTEND(x, s) \
484
25.0M
  ((x) + ((((x) - (1 << ((s) - 1))) >> 31) & (((NEG_1) << (s)) + 1)))
485
486
#else
487
488
#define HUFF_EXTEND(x, s) \
489
  ((x) < extend_test[s] ? (x) + extend_offset[s] : (x))
490
491
static const int extend_test[16] = {   /* entry n is 2**(n-1) */
492
  0, 0x0001, 0x0002, 0x0004, 0x0008, 0x0010, 0x0020, 0x0040, 0x0080,
493
  0x0100, 0x0200, 0x0400, 0x0800, 0x1000, 0x2000, 0x4000
494
};
495
496
static const int extend_offset[16] = { /* entry n is (-1 << n) + 1 */
497
  0, ((-1) << 1) + 1, ((-1) << 2) + 1, ((-1) << 3) + 1, ((-1) << 4) + 1,
498
  ((-1) << 5) + 1, ((-1) << 6) + 1, ((-1) << 7) + 1, ((-1) << 8) + 1,
499
  ((-1) << 9) + 1, ((-1) << 10) + 1, ((-1) << 11) + 1, ((-1) << 12) + 1,
500
  ((-1) << 13) + 1, ((-1) << 14) + 1, ((-1) << 15) + 1
501
};
502
503
#endif /* AVOID_TABLES */
504
505
506
/*
507
 * Check for a restart marker & resynchronize decoder.
508
 * Returns FALSE if must suspend.
509
 */
510
511
LOCAL(boolean)
512
process_restart(j_decompress_ptr cinfo)
513
473k
{
514
473k
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
515
473k
  int ci;
516
517
  /* Throw away any unused bits remaining in bit buffer; */
518
  /* include any full bytes in next_marker's count of discarded bytes */
519
473k
  cinfo->marker->discarded_bytes += entropy->bitstate.bits_left / 8;
520
473k
  entropy->bitstate.bits_left = 0;
521
522
  /* Advance past the RSTn marker */
523
473k
  if (!(*cinfo->marker->read_restart_marker) (cinfo))
524
0
    return FALSE;
525
526
  /* Re-initialize DC predictions to 0 */
527
1.14M
  for (ci = 0; ci < cinfo->comps_in_scan; ci++)
528
669k
    entropy->saved.last_dc_val[ci] = 0;
529
530
  /* Reset restart counter */
531
473k
  entropy->restarts_to_go = cinfo->restart_interval;
532
533
  /* Reset out-of-data flag, unless read_restart_marker left us smack up
534
   * against a marker.  In that case we will end up treating the next data
535
   * segment as empty, and we can avoid producing bogus output pixels by
536
   * leaving the flag set.
537
   */
538
473k
  if (cinfo->unread_marker == 0)
539
15.1k
    entropy->pub.insufficient_data = FALSE;
540
541
473k
  return TRUE;
542
473k
}
543
544
545
#if defined(__has_feature)
546
#if __has_feature(undefined_behavior_sanitizer)
547
__attribute__((no_sanitize("signed-integer-overflow"),
548
               no_sanitize("unsigned-integer-overflow")))
549
#endif
550
#endif
551
LOCAL(boolean)
552
decode_mcu_slow(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
553
733k
{
554
733k
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
555
733k
  BITREAD_STATE_VARS;
556
733k
  int blkn;
557
733k
  savable_state state;
558
  /* Outer loop handles each block in the MCU */
559
560
  /* Load up working state */
561
733k
  BITREAD_LOAD_STATE(cinfo, entropy->bitstate);
562
733k
  state = entropy->saved;
563
564
1.95M
  for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
565
1.22M
    JBLOCKROW block = MCU_data ? MCU_data[blkn] : NULL;
566
1.22M
    d_derived_tbl *dctbl = entropy->dc_cur_tbls[blkn];
567
1.22M
    d_derived_tbl *actbl = entropy->ac_cur_tbls[blkn];
568
1.22M
    register int s, k, r;
569
570
    /* Decode a single block's worth of coefficients */
571
572
    /* Section F.2.2.1: decode the DC coefficient difference */
573
1.22M
    HUFF_DECODE(s, br_state, dctbl, return FALSE, label1);
574
1.22M
    if (s) {
575
509k
      CHECK_BIT_BUFFER(br_state, s, return FALSE);
576
509k
      r = GET_BITS(s);
577
509k
      s = HUFF_EXTEND(r, s);
578
509k
    }
579
580
1.22M
    if (entropy->dc_needed[blkn]) {
581
      /* Convert DC difference to actual value, update last_dc_val */
582
1.20M
      int ci = cinfo->MCU_membership[blkn];
583
      /* Certain malformed JPEG images produce repeated DC coefficient
584
       * differences of 2047 or -2047, which causes state.last_dc_val[ci] to
585
       * grow until it overflows or underflows a 32-bit signed integer.  This
586
       * behavior is, to the best of our understanding, innocuous, and it is
587
       * unclear how to work around it without potentially affecting
588
       * performance.  Thus, we (hopefully temporarily) suppress UBSan integer
589
       * overflow errors for this function and decode_mcu_fast().
590
       */
591
1.20M
      s += state.last_dc_val[ci];
592
1.20M
      state.last_dc_val[ci] = s;
593
1.20M
      if (block) {
594
        /* Output the DC coefficient (assumes jpeg_natural_order[0] = 0) */
595
1.20M
        (*block)[0] = (JCOEF)s;
596
1.20M
      }
597
1.20M
    }
598
599
1.22M
    if (entropy->ac_needed[blkn] && block) {
600
601
      /* Section F.2.2.2: decode the AC coefficients */
602
      /* Since zeroes are skipped, output area must be cleared beforehand */
603
11.7M
      for (k = 1; k < DCTSIZE2; k++) {
604
11.3M
        HUFF_DECODE(s, br_state, actbl, return FALSE, label2);
605
606
11.3M
        r = s >> 4;
607
11.3M
        s &= 15;
608
609
11.3M
        if (s) {
610
10.5M
          k += r;
611
10.5M
          CHECK_BIT_BUFFER(br_state, s, return FALSE);
612
10.5M
          r = GET_BITS(s);
613
10.5M
          s = HUFF_EXTEND(r, s);
614
          /* Output coefficient in natural (dezigzagged) order.
615
           * Note: the extra entries in jpeg_natural_order[] will save us
616
           * if k >= DCTSIZE2, which could happen if the data is corrupted.
617
           */
618
10.5M
          (*block)[jpeg_natural_order[k]] = (JCOEF)s;
619
10.5M
        } else {
620
895k
          if (r != 15)
621
863k
            break;
622
32.0k
          k += 15;
623
32.0k
        }
624
11.3M
      }
625
626
1.20M
    } else {
627
628
      /* Section F.2.2.2: decode the AC coefficients */
629
      /* In this path we just discard the values */
630
203k
      for (k = 1; k < DCTSIZE2; k++) {
631
199k
        HUFF_DECODE(s, br_state, actbl, return FALSE, label3);
632
633
199k
        r = s >> 4;
634
199k
        s &= 15;
635
636
199k
        if (s) {
637
180k
          k += r;
638
180k
          CHECK_BIT_BUFFER(br_state, s, return FALSE);
639
180k
          DROP_BITS(s);
640
180k
        } else {
641
18.7k
          if (r != 15)
642
17.4k
            break;
643
1.27k
          k += 15;
644
1.27k
        }
645
199k
      }
646
21.8k
    }
647
1.22M
  }
648
649
  /* Completed MCU, so update state */
650
733k
  BITREAD_SAVE_STATE(cinfo, entropy->bitstate);
651
733k
  entropy->saved = state;
652
733k
  return TRUE;
653
733k
}
654
655
656
#if defined(__has_feature)
657
#if __has_feature(undefined_behavior_sanitizer)
658
__attribute__((no_sanitize("signed-integer-overflow"),
659
               no_sanitize("unsigned-integer-overflow")))
660
#endif
661
#endif
662
LOCAL(boolean)
663
decode_mcu_fast(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
664
1.16M
{
665
1.16M
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
666
1.16M
  BITREAD_STATE_VARS;
667
1.16M
  JOCTET *buffer;
668
1.16M
  int blkn;
669
1.16M
  savable_state state;
670
  /* Outer loop handles each block in the MCU */
671
672
  /* Load up working state */
673
1.16M
  BITREAD_LOAD_STATE(cinfo, entropy->bitstate);
674
1.16M
  buffer = (JOCTET *)br_state.next_input_byte;
675
1.16M
  state = entropy->saved;
676
677
3.55M
  for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
678
2.38M
    JBLOCKROW block = MCU_data ? MCU_data[blkn] : NULL;
679
2.38M
    d_derived_tbl *dctbl = entropy->dc_cur_tbls[blkn];
680
2.38M
    d_derived_tbl *actbl = entropy->ac_cur_tbls[blkn];
681
2.38M
    register int s, k, r, l;
682
683
2.38M
    HUFF_DECODE_FAST(s, l, dctbl);
684
2.38M
    if (s) {
685
1.51M
      FILL_BIT_BUFFER_FAST
686
1.51M
      r = GET_BITS(s);
687
1.51M
      s = HUFF_EXTEND(r, s);
688
1.51M
    }
689
690
2.38M
    if (entropy->dc_needed[blkn]) {
691
2.30M
      int ci = cinfo->MCU_membership[blkn];
692
      /* Refer to the comment in decode_mcu_slow() regarding the supression of
693
       * a UBSan integer overflow error in this line of code.
694
       */
695
2.30M
      s += state.last_dc_val[ci];
696
2.30M
      state.last_dc_val[ci] = s;
697
2.30M
      if (block)
698
2.30M
        (*block)[0] = (JCOEF)s;
699
2.30M
    }
700
701
2.38M
    if (entropy->ac_needed[blkn] && block) {
702
703
14.8M
      for (k = 1; k < DCTSIZE2; k++) {
704
14.6M
        HUFF_DECODE_FAST(s, l, actbl);
705
14.6M
        r = s >> 4;
706
14.6M
        s &= 15;
707
708
14.6M
        if (s) {
709
12.5M
          k += r;
710
12.5M
          FILL_BIT_BUFFER_FAST
711
12.5M
          r = GET_BITS(s);
712
12.5M
          s = HUFF_EXTEND(r, s);
713
12.5M
          (*block)[jpeg_natural_order[k]] = (JCOEF)s;
714
12.5M
        } else {
715
2.14M
          if (r != 15) break;
716
57.2k
          k += 15;
717
57.2k
        }
718
14.6M
      }
719
720
2.30M
    } else {
721
722
1.71M
      for (k = 1; k < DCTSIZE2; k++) {
723
1.71M
        HUFF_DECODE_FAST(s, l, actbl);
724
1.71M
        r = s >> 4;
725
1.71M
        s &= 15;
726
727
1.71M
        if (s) {
728
1.63M
          k += r;
729
1.63M
          FILL_BIT_BUFFER_FAST
730
1.63M
          DROP_BITS(s);
731
1.63M
        } else {
732
76.2k
          if (r != 15) break;
733
1.58k
          k += 15;
734
1.58k
        }
735
1.71M
      }
736
78.8k
    }
737
2.38M
  }
738
739
1.16M
  if (cinfo->unread_marker != 0) {
740
86.2k
    cinfo->unread_marker = 0;
741
86.2k
    return FALSE;
742
86.2k
  }
743
744
1.08M
  br_state.bytes_in_buffer -= (buffer - br_state.next_input_byte);
745
1.08M
  br_state.next_input_byte = buffer;
746
1.08M
  BITREAD_SAVE_STATE(cinfo, entropy->bitstate);
747
1.08M
  entropy->saved = state;
748
1.08M
  return TRUE;
749
1.16M
}
750
751
752
/*
753
 * Decode and return one MCU's worth of Huffman-compressed coefficients.
754
 * The coefficients are reordered from zigzag order into natural array order,
755
 * but are not dequantized.
756
 *
757
 * The i'th block of the MCU is stored into the block pointed to by
758
 * MCU_data[i].  WE ASSUME THIS AREA HAS BEEN ZEROED BY THE CALLER.
759
 * (Wholesale zeroing is usually a little faster than retail...)
760
 *
761
 * Returns FALSE if data source requested suspension.  In that case no
762
 * changes have been made to permanent state.  (Exception: some output
763
 * coefficients may already have been assigned.  This is harmless for
764
 * this module, since we'll just re-assign them on the next call.)
765
 */
766
767
163M
#define BUFSIZE  (DCTSIZE2 * 8)
768
769
METHODDEF(boolean)
770
decode_mcu(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
771
163M
{
772
163M
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
773
163M
  int usefast = 1;
774
775
  /* Process restart marker if needed; may have to suspend */
776
163M
  if (cinfo->restart_interval) {
777
66.4M
    if (entropy->restarts_to_go == 0)
778
473k
      if (!process_restart(cinfo))
779
0
        return FALSE;
780
66.4M
    usefast = 0;
781
66.4M
  }
782
783
163M
  if (cinfo->src->bytes_in_buffer < BUFSIZE * (size_t)cinfo->blocks_in_MCU ||
784
163M
      cinfo->unread_marker != 0)
785
162M
    usefast = 0;
786
787
  /* If we've run out of data, just leave the MCU set to zeroes.
788
   * This way, we return uniform gray for the remainder of the segment.
789
   */
790
163M
  if (!entropy->pub.insufficient_data) {
791
792
1.81M
    if (usefast) {
793
1.16M
      if (!decode_mcu_fast(cinfo, MCU_data)) goto use_slow;
794
1.16M
    } else {
795
733k
use_slow:
796
733k
      if (!decode_mcu_slow(cinfo, MCU_data)) return FALSE;
797
733k
    }
798
799
1.81M
  }
800
801
  /* Account for restart interval (no-op if not using restarts) */
802
163M
  if (cinfo->restart_interval)
803
66.4M
    entropy->restarts_to_go--;
804
805
163M
  return TRUE;
806
163M
}
807
808
809
/*
810
 * Module initialization routine for Huffman entropy decoding.
811
 */
812
813
GLOBAL(void)
814
jinit_huff_decoder(j_decompress_ptr cinfo)
815
17.8k
{
816
17.8k
  huff_entropy_ptr entropy;
817
17.8k
  int i;
818
819
  /* Motion JPEG frames typically do not include the Huffman tables if they
820
     are the default tables.  Thus, if the tables are not set by the time
821
     the Huffman decoder is initialized (usually within the body of
822
     jpeg_start_decompress()), we set them to default values. */
823
17.8k
  std_huff_tables((j_common_ptr)cinfo);
824
825
17.8k
  entropy = (huff_entropy_ptr)
826
17.8k
    (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
827
17.8k
                                sizeof(huff_entropy_decoder));
828
17.8k
  cinfo->entropy = (struct jpeg_entropy_decoder *)entropy;
829
17.8k
  entropy->pub.start_pass = start_pass_huff_decoder;
830
17.8k
  entropy->pub.decode_mcu = decode_mcu;
831
832
  /* Mark tables unallocated */
833
89.0k
  for (i = 0; i < NUM_HUFF_TBLS; i++) {
834
71.2k
    entropy->dc_derived_tbls[i] = entropy->ac_derived_tbls[i] = NULL;
835
71.2k
  }
836
17.8k
}