Coverage Report

Created: 2026-04-12 06:05

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libjpeg-turbo.main/src/jdmarker.c
Line
Count
Source
1
/*
2
 * jdmarker.c
3
 *
4
 * This file was part of the Independent JPEG Group's software:
5
 * Copyright (C) 1991-1998, Thomas G. Lane.
6
 * Lossless JPEG Modifications:
7
 * Copyright (C) 1999, Ken Murchison.
8
 * libjpeg-turbo Modifications:
9
 * Copyright (C) 2012, 2015, 2022, 2024, 2026, D. R. Commander.
10
 * For conditions of distribution and use, see the accompanying README.ijg
11
 * file.
12
 *
13
 * This file contains routines to decode JPEG datastream markers.
14
 * Most of the complexity arises from our desire to support input
15
 * suspension: if not all of the data for a marker is available,
16
 * we must exit back to the application.  On resumption, we reprocess
17
 * the marker.
18
 */
19
20
#define JPEG_INTERNALS
21
#include "jinclude.h"
22
#include "jpeglib.h"
23
24
25
typedef enum {                  /* JPEG marker codes */
26
  M_SOF0  = 0xc0,
27
  M_SOF1  = 0xc1,
28
  M_SOF2  = 0xc2,
29
  M_SOF3  = 0xc3,
30
31
  M_SOF5  = 0xc5,
32
  M_SOF6  = 0xc6,
33
  M_SOF7  = 0xc7,
34
35
  M_JPG   = 0xc8,
36
  M_SOF9  = 0xc9,
37
  M_SOF10 = 0xca,
38
  M_SOF11 = 0xcb,
39
40
  M_SOF13 = 0xcd,
41
  M_SOF14 = 0xce,
42
  M_SOF15 = 0xcf,
43
44
  M_DHT   = 0xc4,
45
46
  M_DAC   = 0xcc,
47
48
  M_RST0  = 0xd0,
49
  M_RST1  = 0xd1,
50
  M_RST2  = 0xd2,
51
  M_RST3  = 0xd3,
52
  M_RST4  = 0xd4,
53
  M_RST5  = 0xd5,
54
  M_RST6  = 0xd6,
55
  M_RST7  = 0xd7,
56
57
  M_SOI   = 0xd8,
58
  M_EOI   = 0xd9,
59
  M_SOS   = 0xda,
60
  M_DQT   = 0xdb,
61
  M_DNL   = 0xdc,
62
  M_DRI   = 0xdd,
63
  M_DHP   = 0xde,
64
  M_EXP   = 0xdf,
65
66
  M_APP0  = 0xe0,
67
  M_APP1  = 0xe1,
68
  M_APP2  = 0xe2,
69
  M_APP3  = 0xe3,
70
  M_APP4  = 0xe4,
71
  M_APP5  = 0xe5,
72
  M_APP6  = 0xe6,
73
  M_APP7  = 0xe7,
74
  M_APP8  = 0xe8,
75
  M_APP9  = 0xe9,
76
  M_APP10 = 0xea,
77
  M_APP11 = 0xeb,
78
  M_APP12 = 0xec,
79
  M_APP13 = 0xed,
80
  M_APP14 = 0xee,
81
  M_APP15 = 0xef,
82
83
  M_JPG0  = 0xf0,
84
  M_JPG13 = 0xfd,
85
  M_COM   = 0xfe,
86
87
  M_TEM   = 0x01,
88
89
  M_ERROR = 0x100
90
} JPEG_MARKER;
91
92
93
/* Private state */
94
95
typedef struct {
96
  struct jpeg_marker_reader pub; /* public fields */
97
98
  /* Application-overridable marker processing methods */
99
  jpeg_marker_parser_method process_COM;
100
  jpeg_marker_parser_method process_APPn[16];
101
102
  /* Limit on marker data length to save for each marker type */
103
  unsigned int length_limit_COM;
104
  unsigned int length_limit_APPn[16];
105
106
  /* Status of COM/APPn marker saving */
107
  jpeg_saved_marker_ptr cur_marker;     /* NULL if not processing a marker */
108
  unsigned int bytes_read;              /* data bytes read so far in marker */
109
  /* Note: cur_marker is not linked into marker_list until it's all read. */
110
} my_marker_reader;
111
112
typedef my_marker_reader *my_marker_ptr;
113
114
115
/*
116
 * Macros for fetching data from the data source module.
117
 *
118
 * At all times, cinfo->src->next_input_byte and ->bytes_in_buffer reflect
119
 * the current restart point; we update them only when we have reached a
120
 * suitable place to restart if a suspension occurs.
121
 */
122
123
/* Declare and initialize local copies of input pointer/count */
124
#define INPUT_VARS(cinfo) \
125
18.5M
  struct jpeg_source_mgr *datasrc = (cinfo)->src; \
126
18.5M
  const JOCTET *next_input_byte = datasrc->next_input_byte; \
127
18.5M
  size_t bytes_in_buffer = datasrc->bytes_in_buffer
128
129
/* Unload the local copies --- do this only at a restart boundary */
130
#define INPUT_SYNC(cinfo) \
131
195M
  ( datasrc->next_input_byte = next_input_byte, \
132
195M
    datasrc->bytes_in_buffer = bytes_in_buffer )
133
134
/* Reload the local copies --- used only in MAKE_BYTE_AVAIL */
135
#define INPUT_RELOAD(cinfo) \
136
51.6M
  ( next_input_byte = datasrc->next_input_byte, \
137
51.6M
    bytes_in_buffer = datasrc->bytes_in_buffer )
138
139
/* Internal macro for INPUT_BYTE and INPUT_2BYTES: make a byte available.
140
 * Note we do *not* do INPUT_SYNC before calling fill_input_buffer,
141
 * but we must reload the local copies after a successful fill.
142
 */
143
#define MAKE_BYTE_AVAIL(cinfo, action) \
144
52.5M
  if (bytes_in_buffer == 0) { \
145
51.6M
    if (!(*datasrc->fill_input_buffer) (cinfo)) \
146
51.6M
      { action; } \
147
51.6M
    INPUT_RELOAD(cinfo); \
148
51.6M
  }
149
150
/* Read a byte into variable V.
151
 * If must suspend, take the specified action (typically "return FALSE").
152
 */
153
#define INPUT_BYTE(cinfo, V, action) \
154
194M
  MAKESTMT( MAKE_BYTE_AVAIL(cinfo, action); \
155
180M
            bytes_in_buffer--; \
156
180M
            V = *next_input_byte++; )
157
158
/* As above, but read two bytes interpreted as an unsigned 16-bit integer.
159
 * V should be declared unsigned int or perhaps JLONG.
160
 */
161
#define INPUT_2BYTES(cinfo, V, action) \
162
10.6M
  MAKESTMT( MAKE_BYTE_AVAIL(cinfo, action); \
163
29.5M
            bytes_in_buffer--; \
164
29.5M
            V = ((unsigned int)(*next_input_byte++)) << 8; \
165
29.5M
            MAKE_BYTE_AVAIL(cinfo, action); \
166
29.5M
            bytes_in_buffer--; \
167
29.5M
            V += *next_input_byte++; )
168
169
170
/*
171
 * Routines to process JPEG markers.
172
 *
173
 * Entry condition: JPEG marker itself has been read and its code saved
174
 *   in cinfo->unread_marker; input restart point is just after the marker.
175
 *
176
 * Exit: if return TRUE, have read and processed any parameters, and have
177
 *   updated the restart point to point after the parameters.
178
 *   If return FALSE, was forced to suspend before reaching end of
179
 *   marker parameters; restart point has not been moved.  Same routine
180
 *   will be called again after application supplies more input data.
181
 *
182
 * This approach to suspension assumes that all of a marker's parameters
183
 * can fit into a single input bufferload.  This should hold for "normal"
184
 * markers.  Some COM/APPn markers might have large parameter segments
185
 * that might not fit.  If we are simply dropping such a marker, we use
186
 * skip_input_data to get past it, and thereby put the problem on the
187
 * source manager's shoulders.  If we are saving the marker's contents
188
 * into memory, we use a slightly different convention: when forced to
189
 * suspend, the marker processor updates the restart point to the end of
190
 * what it's consumed (ie, the end of the buffer) before returning FALSE.
191
 * On resumption, cinfo->unread_marker still contains the marker code,
192
 * but the data source will point to the next chunk of marker data.
193
 * The marker processor must retain internal state to deal with this.
194
 *
195
 * Note that we don't bother to avoid duplicate trace messages if a
196
 * suspension occurs within marker parameters.  Other side effects
197
 * require more care.
198
 */
199
200
201
LOCAL(boolean)
202
get_soi(j_decompress_ptr cinfo)
203
/* Process an SOI marker */
204
267k
{
205
267k
  int i;
206
207
267k
  TRACEMS(cinfo, 1, JTRC_SOI);
208
209
267k
  if (cinfo->marker->saw_SOI)
210
2.69k
    ERREXIT(cinfo, JERR_SOI_DUPLICATE);
211
212
  /* Reset all parameters that are defined to be reset by SOI */
213
214
4.51M
  for (i = 0; i < NUM_ARITH_TBLS; i++) {
215
4.24M
    cinfo->arith_dc_L[i] = 0;
216
4.24M
    cinfo->arith_dc_U[i] = 1;
217
4.24M
    cinfo->arith_ac_K[i] = 5;
218
4.24M
  }
219
267k
  cinfo->restart_interval = 0;
220
221
  /* Set initial assumptions for colorspace etc */
222
223
267k
  cinfo->jpeg_color_space = JCS_UNKNOWN;
224
267k
  cinfo->CCIR601_sampling = FALSE; /* Assume non-CCIR sampling??? */
225
226
267k
  cinfo->saw_JFIF_marker = FALSE;
227
267k
  cinfo->JFIF_major_version = 1; /* set default JFIF APP0 values */
228
267k
  cinfo->JFIF_minor_version = 1;
229
267k
  cinfo->density_unit = 0;
230
267k
  cinfo->X_density = 1;
231
267k
  cinfo->Y_density = 1;
232
267k
  cinfo->saw_Adobe_marker = FALSE;
233
267k
  cinfo->Adobe_transform = 0;
234
235
267k
  cinfo->marker->saw_SOI = TRUE;
236
237
267k
  return TRUE;
238
267k
}
239
240
241
LOCAL(boolean)
242
get_sof(j_decompress_ptr cinfo, boolean is_prog, boolean is_lossless,
243
        boolean is_arith)
244
/* Process a SOFn marker */
245
257k
{
246
257k
  JLONG length;
247
257k
  int c, ci;
248
257k
  jpeg_component_info *compptr;
249
257k
  INPUT_VARS(cinfo);
250
251
257k
  if (cinfo->marker->saw_SOF)
252
2.21k
    ERREXIT(cinfo, JERR_SOF_DUPLICATE);
253
254
257k
  cinfo->progressive_mode = is_prog;
255
257k
  cinfo->master->lossless = is_lossless;
256
257k
  cinfo->arith_code = is_arith;
257
258
257k
  INPUT_2BYTES(cinfo, length, return FALSE);
259
260
257k
  INPUT_BYTE(cinfo, cinfo->data_precision, return FALSE);
261
257k
  cinfo->master->jpeg_data_precision = cinfo->data_precision;
262
257k
  INPUT_2BYTES(cinfo, cinfo->image_height, return FALSE);
263
257k
  INPUT_2BYTES(cinfo, cinfo->image_width, return FALSE);
264
257k
  INPUT_BYTE(cinfo, cinfo->num_components, return FALSE);
265
266
257k
  length -= 8;
267
268
257k
  TRACEMS4(cinfo, 1, JTRC_SOF, cinfo->unread_marker,
269
257k
           (int)cinfo->image_width, (int)cinfo->image_height,
270
257k
           cinfo->num_components);
271
272
  /* We don't support files in which the image height is initially specified */
273
  /* as 0 and is later redefined by DNL.  As long as we have to check that,  */
274
  /* might as well have a general sanity check. */
275
257k
  if (cinfo->image_height <= 0 || cinfo->image_width <= 0 ||
276
255k
      cinfo->num_components <= 0)
277
59
    ERREXIT(cinfo, JERR_EMPTY_IMAGE);
278
279
257k
  if (length != (cinfo->num_components * 3))
280
807
    ERREXIT(cinfo, JERR_BAD_LENGTH);
281
282
257k
  if (cinfo->comp_info == NULL) /* do only once, even if suspend */
283
254k
    cinfo->comp_info = (jpeg_component_info *)(*cinfo->mem->alloc_small)
284
254k
                        ((j_common_ptr)cinfo, JPOOL_IMAGE,
285
254k
                         cinfo->num_components * sizeof(jpeg_component_info));
286
287
847k
  for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
288
589k
       ci++, compptr++) {
289
589k
    compptr->component_index = ci;
290
589k
    INPUT_BYTE(cinfo, compptr->component_id, return FALSE);
291
589k
    INPUT_BYTE(cinfo, c, return FALSE);
292
589k
    compptr->h_samp_factor = (c >> 4) & 15;
293
589k
    compptr->v_samp_factor = (c     ) & 15;
294
589k
    INPUT_BYTE(cinfo, compptr->quant_tbl_no, return FALSE);
295
296
589k
    TRACEMS4(cinfo, 1, JTRC_SOF_COMPONENT,
297
589k
             compptr->component_id, compptr->h_samp_factor,
298
589k
             compptr->v_samp_factor, compptr->quant_tbl_no);
299
589k
  }
300
301
257k
  cinfo->marker->saw_SOF = TRUE;
302
303
257k
  INPUT_SYNC(cinfo);
304
257k
  return TRUE;
305
257k
}
306
307
308
LOCAL(boolean)
309
get_sos(j_decompress_ptr cinfo)
310
/* Process a SOS marker */
311
1.03M
{
312
1.03M
  JLONG length;
313
1.03M
  int i, ci, n, c, cc, pi;
314
1.03M
  jpeg_component_info *compptr;
315
1.03M
  INPUT_VARS(cinfo);
316
317
1.03M
  if (!cinfo->marker->saw_SOF)
318
103
    ERREXIT(cinfo, JERR_SOS_NO_SOF);
319
320
1.03M
  INPUT_2BYTES(cinfo, length, return FALSE);
321
322
1.03M
  INPUT_BYTE(cinfo, n, return FALSE); /* Number of components */
323
324
1.03M
  TRACEMS1(cinfo, 1, JTRC_SOS, n);
325
326
1.03M
  if (length != (n * 2 + 6) || n < 1 || n > MAX_COMPS_IN_SCAN)
327
3.20k
    ERREXIT(cinfo, JERR_BAD_LENGTH);
328
329
1.03M
  cinfo->comps_in_scan = n;
330
331
  /* Collect the component-spec parameters */
332
333
5.15M
  for (i = 0; i < MAX_COMPS_IN_SCAN; i++)
334
4.12M
    cinfo->cur_comp_info[i] = NULL;
335
336
2.46M
  for (i = 0; i < n; i++) {
337
1.43M
    INPUT_BYTE(cinfo, cc, return FALSE);
338
1.43M
    INPUT_BYTE(cinfo, c, return FALSE);
339
340
1.43M
    for (ci = 0, compptr = cinfo->comp_info;
341
2.53M
         ci < cinfo->num_components && ci < MAX_COMPS_IN_SCAN;
342
2.52M
         ci++, compptr++) {
343
2.52M
      if (cc == compptr->component_id && !cinfo->cur_comp_info[ci])
344
1.42M
        goto id_found;
345
2.52M
    }
346
347
2.01k
    ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
348
349
1.42M
id_found:
350
351
1.42M
    cinfo->cur_comp_info[i] = compptr;
352
1.42M
    compptr->dc_tbl_no = (c >> 4) & 15;
353
1.42M
    compptr->ac_tbl_no = (c     ) & 15;
354
355
1.42M
    TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, cc,
356
1.42M
             compptr->dc_tbl_no, compptr->ac_tbl_no);
357
358
    /* This CSi (cc) should differ from the previous CSi */
359
1.99M
    for (pi = 0; pi < i; pi++) {
360
571k
      if (cinfo->cur_comp_info[pi] == compptr) {
361
96
        ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
362
96
      }
363
571k
    }
364
1.42M
  }
365
366
  /* Collect the additional scan parameters Ss, Se, Ah/Al. */
367
1.03M
  INPUT_BYTE(cinfo, c, return FALSE);
368
1.03M
  cinfo->Ss = c;
369
1.03M
  INPUT_BYTE(cinfo, c, return FALSE);
370
1.03M
  cinfo->Se = c;
371
1.03M
  INPUT_BYTE(cinfo, c, return FALSE);
372
1.03M
  cinfo->Ah = (c >> 4) & 15;
373
1.03M
  cinfo->Al = (c     ) & 15;
374
375
1.03M
  TRACEMS4(cinfo, 1, JTRC_SOS_PARAMS, cinfo->Ss, cinfo->Se,
376
1.03M
           cinfo->Ah, cinfo->Al);
377
378
  /* Prepare to scan data & restart markers */
379
1.03M
  cinfo->marker->next_restart_num = 0;
380
381
  /* Count another SOS marker */
382
1.03M
  cinfo->input_scan_number++;
383
384
1.03M
  INPUT_SYNC(cinfo);
385
1.03M
  return TRUE;
386
1.03M
}
387
388
389
#ifdef D_ARITH_CODING_SUPPORTED
390
391
LOCAL(boolean)
392
get_dac(j_decompress_ptr cinfo)
393
/* Process a DAC marker */
394
37.8k
{
395
37.8k
  JLONG length;
396
37.8k
  int index, val;
397
37.8k
  INPUT_VARS(cinfo);
398
399
37.8k
  INPUT_2BYTES(cinfo, length, return FALSE);
400
37.8k
  length -= 2;
401
402
104k
  while (length > 0) {
403
66.1k
    INPUT_BYTE(cinfo, index, return FALSE);
404
66.1k
    INPUT_BYTE(cinfo, val, return FALSE);
405
406
66.1k
    length -= 2;
407
408
66.1k
    TRACEMS2(cinfo, 1, JTRC_DAC, index, val);
409
410
66.1k
    if (index < 0 || index >= (2 * NUM_ARITH_TBLS))
411
1.12k
      ERREXIT1(cinfo, JERR_DAC_INDEX, index);
412
413
66.1k
    if (index >= NUM_ARITH_TBLS) { /* define AC table */
414
23.2k
      cinfo->arith_ac_K[index - NUM_ARITH_TBLS] = (UINT8)val;
415
42.9k
    } else {                    /* define DC table */
416
42.9k
      cinfo->arith_dc_L[index] = (UINT8)(val & 0x0F);
417
42.9k
      cinfo->arith_dc_U[index] = (UINT8)(val >> 4);
418
42.9k
      if (cinfo->arith_dc_L[index] > cinfo->arith_dc_U[index])
419
276
        ERREXIT1(cinfo, JERR_DAC_VALUE, val);
420
42.9k
    }
421
66.1k
  }
422
423
37.8k
  if (length != 0)
424
107
    ERREXIT(cinfo, JERR_BAD_LENGTH);
425
426
37.8k
  INPUT_SYNC(cinfo);
427
37.8k
  return TRUE;
428
37.8k
}
429
430
#else /* !D_ARITH_CODING_SUPPORTED */
431
432
#define get_dac(cinfo)  skip_variable(cinfo)
433
434
#endif /* D_ARITH_CODING_SUPPORTED */
435
436
437
LOCAL(boolean)
438
get_dht(j_decompress_ptr cinfo)
439
/* Process a DHT marker */
440
307k
{
441
307k
  JLONG length;
442
307k
  UINT8 bits[17];
443
307k
  UINT8 huffval[256];
444
307k
  int i, index, count;
445
307k
  JHUFF_TBL **htblptr;
446
307k
  INPUT_VARS(cinfo);
447
448
307k
  INPUT_2BYTES(cinfo, length, return FALSE);
449
307k
  length -= 2;
450
451
623k
  while (length > 16) {
452
316k
    INPUT_BYTE(cinfo, index, return FALSE);
453
454
316k
    TRACEMS1(cinfo, 1, JTRC_DHT, index);
455
456
316k
    bits[0] = 0;
457
316k
    count = 0;
458
5.37M
    for (i = 1; i <= 16; i++) {
459
5.05M
      INPUT_BYTE(cinfo, bits[i], return FALSE);
460
5.05M
      count += bits[i];
461
5.05M
    }
462
463
316k
    length -= 1 + 16;
464
465
316k
    TRACEMS8(cinfo, 2, JTRC_HUFFBITS,
466
316k
             bits[1], bits[2], bits[3], bits[4],
467
316k
             bits[5], bits[6], bits[7], bits[8]);
468
316k
    TRACEMS8(cinfo, 2, JTRC_HUFFBITS,
469
316k
             bits[9], bits[10], bits[11], bits[12],
470
316k
             bits[13], bits[14], bits[15], bits[16]);
471
472
    /* Here we just do minimal validation of the counts to avoid walking
473
     * off the end of our table space.  jdhuff.c will check more carefully.
474
     */
475
316k
    if (count > 256 || ((JLONG)count) > length)
476
6.15k
      ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
477
478
3.78M
    for (i = 0; i < count; i++)
479
3.46M
      INPUT_BYTE(cinfo, huffval[i], return FALSE);
480
481
316k
    memset(&huffval[count], 0, (256 - count) * sizeof(UINT8));
482
483
316k
    length -= count;
484
485
316k
    if (index & 0x10) {         /* AC table definition */
486
164k
      index -= 0x10;
487
164k
      if (index < 0 || index >= NUM_HUFF_TBLS)
488
210
        ERREXIT1(cinfo, JERR_DHT_INDEX, index);
489
164k
      htblptr = &cinfo->ac_huff_tbl_ptrs[index];
490
164k
    } else {                    /* DC table definition */
491
151k
      if (index < 0 || index >= NUM_HUFF_TBLS)
492
181
        ERREXIT1(cinfo, JERR_DHT_INDEX, index);
493
151k
      htblptr = &cinfo->dc_huff_tbl_ptrs[index];
494
151k
    }
495
496
316k
    if (*htblptr == NULL)
497
35.0k
      *htblptr = jpeg_alloc_huff_table((j_common_ptr)cinfo);
498
499
316k
    memcpy((*htblptr)->bits, bits, sizeof((*htblptr)->bits));
500
316k
    memcpy((*htblptr)->huffval, huffval, sizeof((*htblptr)->huffval));
501
316k
  }
502
503
307k
  if (length != 0)
504
1.17k
    ERREXIT(cinfo, JERR_BAD_LENGTH);
505
506
307k
  INPUT_SYNC(cinfo);
507
307k
  return TRUE;
508
307k
}
509
510
511
LOCAL(boolean)
512
get_dqt(j_decompress_ptr cinfo)
513
/* Process a DQT marker */
514
301k
{
515
301k
  JLONG length;
516
301k
  int n, i, prec;
517
301k
  unsigned int tmp;
518
301k
  JQUANT_TBL *quant_ptr;
519
301k
  INPUT_VARS(cinfo);
520
521
301k
  INPUT_2BYTES(cinfo, length, return FALSE);
522
301k
  length -= 2;
523
524
606k
  while (length > 0) {
525
305k
    INPUT_BYTE(cinfo, n, return FALSE);
526
305k
    prec = n >> 4;
527
305k
    n &= 0x0F;
528
529
305k
    TRACEMS2(cinfo, 1, JTRC_DQT, n, prec);
530
531
305k
    if (n >= NUM_QUANT_TBLS)
532
1.55k
      ERREXIT1(cinfo, JERR_DQT_INDEX, n);
533
534
305k
    if (cinfo->quant_tbl_ptrs[n] == NULL)
535
49.1k
      cinfo->quant_tbl_ptrs[n] = jpeg_alloc_quant_table((j_common_ptr)cinfo);
536
305k
    quant_ptr = cinfo->quant_tbl_ptrs[n];
537
538
19.7M
    for (i = 0; i < DCTSIZE2; i++) {
539
19.4M
      if (prec)
540
19.4M
        INPUT_2BYTES(cinfo, tmp, return FALSE);
541
18.8M
      else
542
19.4M
        INPUT_BYTE(cinfo, tmp, return FALSE);
543
      /* We convert the zigzag-order table to natural array order. */
544
19.4M
      quant_ptr->quantval[jpeg_natural_order[i]] = (UINT16)tmp;
545
19.4M
    }
546
547
305k
    if (cinfo->err->trace_level >= 2) {
548
0
      for (i = 0; i < DCTSIZE2; i += 8) {
549
0
        TRACEMS8(cinfo, 2, JTRC_QUANTVALS,
550
0
                 quant_ptr->quantval[i],     quant_ptr->quantval[i + 1],
551
0
                 quant_ptr->quantval[i + 2], quant_ptr->quantval[i + 3],
552
0
                 quant_ptr->quantval[i + 4], quant_ptr->quantval[i + 5],
553
0
                 quant_ptr->quantval[i + 6], quant_ptr->quantval[i + 7]);
554
0
      }
555
0
    }
556
557
305k
    length -= DCTSIZE2 + 1;
558
305k
    if (prec) length -= DCTSIZE2;
559
305k
  }
560
561
301k
  if (length != 0)
562
508
    ERREXIT(cinfo, JERR_BAD_LENGTH);
563
564
301k
  INPUT_SYNC(cinfo);
565
301k
  return TRUE;
566
301k
}
567
568
569
LOCAL(boolean)
570
get_dri(j_decompress_ptr cinfo)
571
/* Process a DRI marker */
572
216k
{
573
216k
  JLONG length;
574
216k
  unsigned int tmp;
575
216k
  INPUT_VARS(cinfo);
576
577
216k
  INPUT_2BYTES(cinfo, length, return FALSE);
578
579
216k
  if (length != 4)
580
621
    ERREXIT(cinfo, JERR_BAD_LENGTH);
581
582
216k
  INPUT_2BYTES(cinfo, tmp, return FALSE);
583
584
216k
  TRACEMS1(cinfo, 1, JTRC_DRI, tmp);
585
586
216k
  cinfo->restart_interval = tmp;
587
588
216k
  INPUT_SYNC(cinfo);
589
216k
  return TRUE;
590
216k
}
591
592
593
/*
594
 * Routines for processing APPn and COM markers.
595
 * These are either saved in memory or discarded, per application request.
596
 * APP0 and APP14 are specially checked to see if they are
597
 * JFIF and Adobe markers, respectively.
598
 */
599
600
1.82M
#define APP0_DATA_LEN   14      /* Length of interesting data in APP0 */
601
1.39M
#define APP14_DATA_LEN  12      /* Length of interesting data in APP14 */
602
1.65M
#define APPN_DATA_LEN   14      /* Must be the largest of the above!! */
603
604
605
LOCAL(void)
606
examine_app0(j_decompress_ptr cinfo, JOCTET *data, unsigned int datalen,
607
             JLONG remaining)
608
/* Examine first few bytes from an APP0.
609
 * Take appropriate action if it is a JFIF marker.
610
 * datalen is # of bytes at data[], remaining is length of rest of marker data.
611
 */
612
755k
{
613
755k
  JLONG totallen = (JLONG)datalen + remaining;
614
615
755k
  if (datalen >= APP0_DATA_LEN &&
616
710k
      data[0] == 0x4A &&
617
663k
      data[1] == 0x46 &&
618
628k
      data[2] == 0x49 &&
619
507k
      data[3] == 0x46 &&
620
310k
      data[4] == 0) {
621
    /* Found JFIF APP0 marker: save info */
622
251k
    cinfo->saw_JFIF_marker = TRUE;
623
251k
    cinfo->JFIF_major_version = data[5];
624
251k
    cinfo->JFIF_minor_version = data[6];
625
251k
    cinfo->density_unit = data[7];
626
251k
    cinfo->X_density = (data[8] << 8) + data[9];
627
251k
    cinfo->Y_density = (data[10] << 8) + data[11];
628
    /* Check version.
629
     * Major version must be 1, anything else signals an incompatible change.
630
     * (We used to treat this as an error, but now it's a nonfatal warning,
631
     * because some bozo at Hijaak couldn't read the spec.)
632
     * Minor version should be 0..2, but process anyway if newer.
633
     */
634
251k
    if (cinfo->JFIF_major_version != 1)
635
180k
      WARNMS2(cinfo, JWRN_JFIF_MAJOR,
636
251k
              cinfo->JFIF_major_version, cinfo->JFIF_minor_version);
637
    /* Generate trace messages */
638
251k
    TRACEMS5(cinfo, 1, JTRC_JFIF,
639
251k
             cinfo->JFIF_major_version, cinfo->JFIF_minor_version,
640
251k
             cinfo->X_density, cinfo->Y_density, cinfo->density_unit);
641
    /* Validate thumbnail dimensions and issue appropriate messages */
642
251k
    if (data[12] | data[13])
643
114k
      TRACEMS2(cinfo, 1, JTRC_JFIF_THUMBNAIL, data[12], data[13]);
644
251k
    totallen -= APP0_DATA_LEN;
645
251k
    if (totallen != ((JLONG)data[12] * (JLONG)data[13] * (JLONG)3))
646
76.0k
      TRACEMS1(cinfo, 1, JTRC_JFIF_BADTHUMBNAILSIZE, (int)totallen);
647
504k
  } else if (datalen >= 6 &&
648
474k
             data[0] == 0x4A &&
649
423k
             data[1] == 0x46 &&
650
384k
             data[2] == 0x58 &&
651
114k
             data[3] == 0x58 &&
652
46.2k
             data[4] == 0) {
653
    /* Found JFIF "JFXX" extension APP0 marker */
654
    /* The library doesn't actually do anything with these,
655
     * but we try to produce a helpful trace message.
656
     */
657
16.0k
    switch (data[5]) {
658
3.07k
    case 0x10:
659
3.07k
      TRACEMS1(cinfo, 1, JTRC_THUMB_JPEG, (int)totallen);
660
3.07k
      break;
661
2.51k
    case 0x11:
662
2.51k
      TRACEMS1(cinfo, 1, JTRC_THUMB_PALETTE, (int)totallen);
663
2.51k
      break;
664
3.12k
    case 0x13:
665
3.12k
      TRACEMS1(cinfo, 1, JTRC_THUMB_RGB, (int)totallen);
666
3.12k
      break;
667
7.35k
    default:
668
7.35k
      TRACEMS2(cinfo, 1, JTRC_JFIF_EXTENSION, data[5], (int)totallen);
669
7.35k
      break;
670
16.0k
    }
671
488k
  } else {
672
    /* Start of APP0 does not match "JFIF" or "JFXX", or too short */
673
488k
    TRACEMS1(cinfo, 1, JTRC_APP0, (int)totallen);
674
488k
  }
675
755k
}
676
677
678
LOCAL(void)
679
examine_app14(j_decompress_ptr cinfo, JOCTET *data, unsigned int datalen,
680
              JLONG remaining)
681
/* Examine first few bytes from an APP14.
682
 * Take appropriate action if it is an Adobe marker.
683
 * datalen is # of bytes at data[], remaining is length of rest of marker data.
684
 */
685
670k
{
686
670k
  unsigned int version, flags0, flags1, transform;
687
688
670k
  if (datalen >= APP14_DATA_LEN &&
689
655k
      data[0] == 0x41 &&
690
635k
      data[1] == 0x64 &&
691
619k
      data[2] == 0x6F &&
692
604k
      data[3] == 0x62 &&
693
582k
      data[4] == 0x65) {
694
    /* Found Adobe APP14 marker */
695
184k
    version = (data[5] << 8) + data[6];
696
184k
    flags0 = (data[7] << 8) + data[8];
697
184k
    flags1 = (data[9] << 8) + data[10];
698
184k
    transform = data[11];
699
184k
    TRACEMS4(cinfo, 1, JTRC_ADOBE, version, flags0, flags1, transform);
700
184k
    cinfo->saw_Adobe_marker = TRUE;
701
184k
    cinfo->Adobe_transform = (UINT8)transform;
702
485k
  } else {
703
    /* Start of APP14 does not match "Adobe", or too short */
704
485k
    TRACEMS1(cinfo, 1, JTRC_APP14, (int)(datalen + remaining));
705
485k
  }
706
670k
}
707
708
709
METHODDEF(boolean)
710
get_interesting_appn(j_decompress_ptr cinfo)
711
/* Process an APP0 or APP14 marker without saving it */
712
950k
{
713
950k
  JLONG length;
714
950k
  JOCTET b[APPN_DATA_LEN];
715
950k
  unsigned int i, numtoread;
716
950k
  INPUT_VARS(cinfo);
717
718
950k
  INPUT_2BYTES(cinfo, length, return FALSE);
719
950k
  length -= 2;
720
721
  /* get the interesting part of the marker data */
722
950k
  if (length >= APPN_DATA_LEN)
723
706k
    numtoread = APPN_DATA_LEN;
724
244k
  else if (length > 0)
725
219k
    numtoread = (unsigned int)length;
726
25.0k
  else
727
25.0k
    numtoread = 0;
728
13.3M
  for (i = 0; i < numtoread; i++)
729
12.4M
    INPUT_BYTE(cinfo, b[i], return FALSE);
730
950k
  length -= numtoread;
731
732
  /* process it */
733
950k
  switch (cinfo->unread_marker) {
734
576k
  case M_APP0:
735
576k
    examine_app0(cinfo, (JOCTET *)b, numtoread, length);
736
576k
    break;
737
374k
  case M_APP14:
738
374k
    examine_app14(cinfo, (JOCTET *)b, numtoread, length);
739
374k
    break;
740
0
  default:
741
    /* can't get here unless jpeg_save_markers chooses wrong processor */
742
0
    ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
743
0
    break;
744
950k
  }
745
746
  /* skip any remaining data -- could be lots */
747
950k
  INPUT_SYNC(cinfo);
748
950k
  if (length > 0)
749
29.0k
    (*cinfo->src->skip_input_data) (cinfo, (long)length);
750
751
950k
  return TRUE;
752
950k
}
753
754
755
#ifdef SAVE_MARKERS_SUPPORTED
756
757
METHODDEF(boolean)
758
save_marker(j_decompress_ptr cinfo)
759
/* Save an APPn or COM marker into the marker list */
760
3.28M
{
761
3.28M
  my_marker_ptr marker = (my_marker_ptr)cinfo->marker;
762
3.28M
  jpeg_saved_marker_ptr cur_marker = marker->cur_marker;
763
3.28M
  unsigned int bytes_read, data_length;
764
3.28M
  JOCTET *data;
765
3.28M
  JLONG length = 0;
766
3.28M
  INPUT_VARS(cinfo);
767
768
3.28M
  if (cur_marker == NULL) {
769
    /* begin reading a marker */
770
3.28M
    INPUT_2BYTES(cinfo, length, return FALSE);
771
3.28M
    length -= 2;
772
3.28M
    if (length >= 0) {          /* watch out for bogus length word */
773
      /* figure out how much we want to save */
774
2.68M
      unsigned int limit;
775
2.68M
      if (cinfo->unread_marker == (int)M_COM)
776
1.57k
        limit = marker->length_limit_COM;
777
2.68M
      else
778
2.68M
        limit = marker->length_limit_APPn[cinfo->unread_marker - (int)M_APP0];
779
2.68M
      if ((unsigned int)length < limit)
780
2.67M
        limit = (unsigned int)length;
781
      /* allocate and initialize the marker item */
782
2.68M
      cur_marker = (jpeg_saved_marker_ptr)
783
2.68M
        (*cinfo->mem->alloc_large) ((j_common_ptr)cinfo, JPOOL_IMAGE,
784
2.68M
                                    sizeof(struct jpeg_marker_struct) + limit);
785
2.68M
      cur_marker->next = NULL;
786
2.68M
      cur_marker->marker = (UINT8)cinfo->unread_marker;
787
2.68M
      cur_marker->original_length = (unsigned int)length;
788
2.68M
      cur_marker->data_length = limit;
789
      /* data area is just beyond the jpeg_marker_struct */
790
2.68M
      data = cur_marker->data = (JOCTET *)(cur_marker + 1);
791
2.68M
      marker->cur_marker = cur_marker;
792
2.68M
      marker->bytes_read = 0;
793
2.68M
      bytes_read = 0;
794
2.68M
      data_length = limit;
795
2.68M
    } else {
796
      /* deal with bogus length word */
797
606k
      bytes_read = data_length = 0;
798
606k
      data = NULL;
799
606k
    }
800
3.28M
  } else {
801
    /* resume reading a marker */
802
0
    bytes_read = marker->bytes_read;
803
0
    data_length = cur_marker->data_length;
804
0
    data = cur_marker->data + bytes_read;
805
0
  }
806
807
55.8M
  while (bytes_read < data_length) {
808
52.5M
    INPUT_SYNC(cinfo);          /* move the restart point to here */
809
52.5M
    marker->bytes_read = bytes_read;
810
    /* If there's not at least one byte in buffer, suspend */
811
52.5M
    MAKE_BYTE_AVAIL(cinfo, return FALSE);
812
    /* Copy bytes with reasonable rapidity */
813
240M
    while (bytes_read < data_length && bytes_in_buffer > 0) {
814
187M
      *data++ = *next_input_byte++;
815
187M
      bytes_in_buffer--;
816
187M
      bytes_read++;
817
187M
    }
818
52.5M
  }
819
820
  /* Done reading what we want to read */
821
3.28M
  if (cur_marker != NULL) {     /* will be NULL if bogus length word */
822
    /* Add new marker to end of list */
823
2.68M
    if (cinfo->marker_list == NULL || cinfo->master->marker_list_end == NULL) {
824
36.7k
      cinfo->marker_list = cinfo->master->marker_list_end = cur_marker;
825
2.64M
    } else {
826
2.64M
      cinfo->master->marker_list_end->next = cur_marker;
827
2.64M
      cinfo->master->marker_list_end = cur_marker;
828
2.64M
    }
829
    /* Reset pointer & calc remaining data length */
830
2.68M
    data = cur_marker->data;
831
2.68M
    length = cur_marker->original_length - data_length;
832
2.68M
  }
833
  /* Reset to initial state for next marker */
834
3.28M
  marker->cur_marker = NULL;
835
836
  /* Process the marker if interesting; else just make a generic trace msg */
837
3.28M
  switch (cinfo->unread_marker) {
838
178k
  case M_APP0:
839
178k
    examine_app0(cinfo, data, data_length, length);
840
178k
    break;
841
296k
  case M_APP14:
842
296k
    examine_app14(cinfo, data, data_length, length);
843
296k
    break;
844
2.81M
  default:
845
2.81M
    TRACEMS2(cinfo, 1, JTRC_MISC_MARKER, cinfo->unread_marker,
846
2.81M
             (int)(data_length + length));
847
2.81M
    break;
848
3.28M
  }
849
850
  /* skip any remaining data -- could be lots */
851
3.28M
  INPUT_SYNC(cinfo);            /* do before skip_input_data */
852
3.28M
  if (length > 0)
853
3.66k
    (*cinfo->src->skip_input_data) (cinfo, (long)length);
854
855
3.28M
  return TRUE;
856
3.28M
}
857
858
#endif /* SAVE_MARKERS_SUPPORTED */
859
860
861
METHODDEF(boolean)
862
skip_variable(j_decompress_ptr cinfo)
863
/* Skip over an unknown or uninteresting variable-length marker */
864
2.92M
{
865
2.92M
  JLONG length;
866
2.92M
  INPUT_VARS(cinfo);
867
868
2.92M
  INPUT_2BYTES(cinfo, length, return FALSE);
869
2.92M
  length -= 2;
870
871
2.92M
  TRACEMS2(cinfo, 1, JTRC_MISC_MARKER, cinfo->unread_marker, (int)length);
872
873
2.92M
  INPUT_SYNC(cinfo);            /* do before skip_input_data */
874
2.92M
  if (length > 0)
875
125k
    (*cinfo->src->skip_input_data) (cinfo, (long)length);
876
877
2.92M
  return TRUE;
878
2.92M
}
879
880
881
/*
882
 * Find the next JPEG marker, save it in cinfo->unread_marker.
883
 * Returns FALSE if had to suspend before reaching a marker;
884
 * in that case cinfo->unread_marker is unchanged.
885
 *
886
 * Note that the result might not be a valid marker code,
887
 * but it will never be 0 or FF.
888
 */
889
890
LOCAL(boolean)
891
next_marker(j_decompress_ptr cinfo)
892
8.95M
{
893
8.95M
  int c;
894
8.95M
  INPUT_VARS(cinfo);
895
896
9.79M
  for (;;) {
897
9.79M
    INPUT_BYTE(cinfo, c, return FALSE);
898
    /* Skip any non-FF bytes.
899
     * This may look a bit inefficient, but it will not occur in a valid file.
900
     * We sync after each discarded byte so that a suspending data source
901
     * can discard the byte from its buffer.
902
     */
903
133M
    while (c != 0xFF) {
904
123M
      cinfo->marker->discarded_bytes++;
905
123M
      INPUT_SYNC(cinfo);
906
123M
      INPUT_BYTE(cinfo, c, return FALSE);
907
123M
    }
908
    /* This loop swallows any duplicate FF bytes.  Extra FFs are legal as
909
     * pad bytes, so don't count them in discarded_bytes.  We assume there
910
     * will not be so many consecutive FF bytes as to overflow a suspending
911
     * data source's input buffer.
912
     */
913
10.4M
    do {
914
10.4M
      INPUT_BYTE(cinfo, c, return FALSE);
915
10.4M
    } while (c == 0xFF);
916
9.79M
    if (c != 0)
917
8.95M
      break;                    /* found a valid marker, exit loop */
918
    /* Reach here if we found a stuffed-zero data sequence (FF/00).
919
     * Discard it and loop back to try again.
920
     */
921
838k
    cinfo->marker->discarded_bytes += 2;
922
838k
    INPUT_SYNC(cinfo);
923
838k
  }
924
925
8.95M
  if (cinfo->marker->discarded_bytes != 0) {
926
7.62M
    WARNMS2(cinfo, JWRN_EXTRANEOUS_DATA, cinfo->marker->discarded_bytes, c);
927
7.62M
    cinfo->marker->discarded_bytes = 0;
928
7.62M
  }
929
930
8.95M
  cinfo->unread_marker = c;
931
932
8.95M
  INPUT_SYNC(cinfo);
933
8.95M
  return TRUE;
934
8.95M
}
935
936
937
LOCAL(boolean)
938
first_marker(j_decompress_ptr cinfo)
939
/* Like next_marker, but used to obtain the initial SOI marker. */
940
/* For this marker, we do not allow preceding garbage or fill; otherwise,
941
 * we might well scan an entire input file before realizing it ain't JPEG.
942
 * If an application wants to process non-JFIF files, it must seek to the
943
 * SOI before calling the JPEG library.
944
 */
945
265k
{
946
265k
  int c, c2;
947
265k
  INPUT_VARS(cinfo);
948
949
265k
  INPUT_BYTE(cinfo, c, return FALSE);
950
265k
  INPUT_BYTE(cinfo, c2, return FALSE);
951
265k
  if (c != 0xFF || c2 != (int)M_SOI)
952
308
    ERREXIT2(cinfo, JERR_NO_SOI, c, c2);
953
954
265k
  cinfo->unread_marker = c2;
955
956
265k
  INPUT_SYNC(cinfo);
957
265k
  return TRUE;
958
265k
}
959
960
961
/*
962
 * Read markers until SOS or EOI.
963
 *
964
 * Returns same codes as are defined for jpeg_consume_input:
965
 * JPEG_SUSPENDED, JPEG_REACHED_SOS, or JPEG_REACHED_EOI.
966
 */
967
968
METHODDEF(int)
969
read_markers(j_decompress_ptr cinfo)
970
1.19M
{
971
  /* Outer loop repeats once for each marker. */
972
9.95M
  for (;;) {
973
    /* Collect the marker proper, unless we already did. */
974
    /* NB: first_marker() enforces the requirement that SOI appear first. */
975
9.95M
    if (cinfo->unread_marker == 0) {
976
9.10M
      if (!cinfo->marker->saw_SOI) {
977
265k
        if (!first_marker(cinfo))
978
0
          return JPEG_SUSPENDED;
979
8.83M
      } else {
980
8.83M
        if (!next_marker(cinfo))
981
0
          return JPEG_SUSPENDED;
982
8.83M
      }
983
9.10M
    }
984
    /* At this point cinfo->unread_marker contains the marker code and the
985
     * input point is just past the marker proper, but before any parameters.
986
     * A suspension will cause us to return with this state still true.
987
     */
988
9.95M
    switch (cinfo->unread_marker) {
989
267k
    case M_SOI:
990
267k
      if (!get_soi(cinfo))
991
0
        return JPEG_SUSPENDED;
992
267k
      break;
993
994
267k
    case M_SOF0:                /* Baseline */
995
63.4k
    case M_SOF1:                /* Extended sequential, Huffman */
996
63.4k
      if (!get_sof(cinfo, FALSE, FALSE, FALSE))
997
0
        return JPEG_SUSPENDED;
998
63.4k
      break;
999
1000
63.4k
    case M_SOF2:                /* Progressive, Huffman */
1001
44.8k
      if (!get_sof(cinfo, TRUE, FALSE, FALSE))
1002
0
        return JPEG_SUSPENDED;
1003
44.8k
      break;
1004
1005
44.9k
    case M_SOF3:                /* Lossless, Huffman */
1006
44.9k
      if (!get_sof(cinfo, FALSE, TRUE, FALSE))
1007
0
        return JPEG_SUSPENDED;
1008
44.9k
      break;
1009
1010
44.9k
    case M_SOF9:                /* Extended sequential, arithmetic */
1011
35.8k
      if (!get_sof(cinfo, FALSE, FALSE, TRUE))
1012
0
        return JPEG_SUSPENDED;
1013
35.8k
      break;
1014
1015
67.4k
    case M_SOF10:               /* Progressive, arithmetic */
1016
67.4k
      if (!get_sof(cinfo, TRUE, FALSE, TRUE))
1017
0
        return JPEG_SUSPENDED;
1018
67.4k
      break;
1019
1020
67.4k
    case M_SOF11:               /* Lossless, arithmetic */
1021
1.11k
      if (!get_sof(cinfo, FALSE, TRUE, TRUE))
1022
0
        return JPEG_SUSPENDED;
1023
1.11k
      break;
1024
1025
    /* Currently unsupported SOFn types */
1026
1.11k
    case M_SOF5:                /* Differential sequential, Huffman */
1027
261
    case M_SOF6:                /* Differential progressive, Huffman */
1028
393
    case M_SOF7:                /* Differential lossless, Huffman */
1029
508
    case M_JPG:                 /* Reserved for JPEG extensions */
1030
631
    case M_SOF13:               /* Differential sequential, arithmetic */
1031
777
    case M_SOF14:               /* Differential progressive, arithmetic */
1032
907
    case M_SOF15:               /* Differential lossless, arithmetic */
1033
907
      ERREXIT1(cinfo, JERR_SOF_UNSUPPORTED, cinfo->unread_marker);
1034
907
      break;
1035
1036
1.03M
    case M_SOS:
1037
1.03M
      if (!get_sos(cinfo))
1038
0
        return JPEG_SUSPENDED;
1039
1.03M
      cinfo->unread_marker = 0; /* processed the marker */
1040
1.03M
      return JPEG_REACHED_SOS;
1041
1042
116k
    case M_EOI:
1043
116k
      TRACEMS(cinfo, 1, JTRC_EOI);
1044
116k
      cinfo->unread_marker = 0; /* processed the marker */
1045
116k
      return JPEG_REACHED_EOI;
1046
1047
37.8k
    case M_DAC:
1048
37.8k
      if (!get_dac(cinfo))
1049
0
        return JPEG_SUSPENDED;
1050
37.8k
      break;
1051
1052
307k
    case M_DHT:
1053
307k
      if (!get_dht(cinfo))
1054
0
        return JPEG_SUSPENDED;
1055
307k
      break;
1056
1057
307k
    case M_DQT:
1058
301k
      if (!get_dqt(cinfo))
1059
0
        return JPEG_SUSPENDED;
1060
301k
      break;
1061
1062
301k
    case M_DRI:
1063
216k
      if (!get_dri(cinfo))
1064
0
        return JPEG_SUSPENDED;
1065
216k
      break;
1066
1067
755k
    case M_APP0:
1068
5.98M
    case M_APP1:
1069
6.36M
    case M_APP2:
1070
6.40M
    case M_APP3:
1071
6.40M
    case M_APP4:
1072
6.41M
    case M_APP5:
1073
6.42M
    case M_APP6:
1074
6.42M
    case M_APP7:
1075
6.44M
    case M_APP8:
1076
6.45M
    case M_APP9:
1077
6.45M
    case M_APP10:
1078
6.45M
    case M_APP11:
1079
6.47M
    case M_APP12:
1080
6.48M
    case M_APP13:
1081
7.15M
    case M_APP14:
1082
7.15M
    case M_APP15:
1083
7.15M
      if (!(*((my_marker_ptr)cinfo->marker)->process_APPn[
1084
7.15M
               cinfo->unread_marker - (int)M_APP0]) (cinfo))
1085
22.2k
        return JPEG_SUSPENDED;
1086
7.13M
      break;
1087
1088
7.13M
    case M_COM:
1089
16.3k
      if (!(*((my_marker_ptr)cinfo->marker)->process_COM) (cinfo))
1090
0
        return JPEG_SUSPENDED;
1091
16.3k
      break;
1092
1093
24.8k
    case M_RST0:                /* these are all parameterless */
1094
46.8k
    case M_RST1:
1095
63.1k
    case M_RST2:
1096
77.0k
    case M_RST3:
1097
99.1k
    case M_RST4:
1098
109k
    case M_RST5:
1099
120k
    case M_RST6:
1100
182k
    case M_RST7:
1101
213k
    case M_TEM:
1102
213k
      TRACEMS1(cinfo, 1, JTRC_PARMLESS_MARKER, cinfo->unread_marker);
1103
213k
      break;
1104
1105
21.9k
    case M_DNL:                 /* Ignore DNL ... perhaps the wrong thing */
1106
21.9k
      if (!skip_variable(cinfo))
1107
0
        return JPEG_SUSPENDED;
1108
21.9k
      break;
1109
1110
21.9k
    default:                    /* must be DHP, EXP, JPGn, or RESn */
1111
      /* For now, we treat the reserved markers as fatal errors since they are
1112
       * likely to be used to signal incompatible JPEG Part 3 extensions.
1113
       * Once the JPEG 3 version-number marker is well defined, this code
1114
       * ought to change!
1115
       */
1116
8.22k
      ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
1117
8.22k
      break;
1118
9.95M
    }
1119
    /* Successfully processed marker, so reset state variable */
1120
8.75M
    cinfo->unread_marker = 0;
1121
8.75M
  } /* end loop */
1122
1.19M
}
1123
1124
1125
/*
1126
 * Read a restart marker, which is expected to appear next in the datastream;
1127
 * if the marker is not there, take appropriate recovery action.
1128
 * Returns FALSE if suspension is required.
1129
 *
1130
 * This is called by the entropy decoder after it has read an appropriate
1131
 * number of MCUs.  cinfo->unread_marker may be nonzero if the entropy decoder
1132
 * has already read a marker from the data source.  Under normal conditions
1133
 * cinfo->unread_marker will be reset to 0 before returning; if not reset,
1134
 * it holds a marker which the decoder will be unable to read past.
1135
 */
1136
1137
METHODDEF(boolean)
1138
read_restart_marker(j_decompress_ptr cinfo)
1139
298M
{
1140
  /* Obtain a marker unless we already did. */
1141
  /* Note that next_marker will complain if it skips any data. */
1142
298M
  if (cinfo->unread_marker == 0) {
1143
64.2k
    if (!next_marker(cinfo))
1144
0
      return FALSE;
1145
64.2k
  }
1146
1147
298M
  if (cinfo->unread_marker ==
1148
298M
      ((int)M_RST0 + cinfo->marker->next_restart_num)) {
1149
    /* Normal case --- swallow the marker and let entropy decoder continue */
1150
102k
    TRACEMS1(cinfo, 3, JTRC_RST, cinfo->marker->next_restart_num);
1151
102k
    cinfo->unread_marker = 0;
1152
298M
  } else {
1153
    /* Uh-oh, the restart markers have been messed up. */
1154
    /* Let the data source manager determine how to resync. */
1155
298M
    if (!(*cinfo->src->resync_to_restart) (cinfo,
1156
298M
                                           cinfo->marker->next_restart_num))
1157
0
      return FALSE;
1158
298M
  }
1159
1160
  /* Update next-restart state */
1161
298M
  cinfo->marker->next_restart_num = (cinfo->marker->next_restart_num + 1) & 7;
1162
1163
298M
  return TRUE;
1164
298M
}
1165
1166
1167
/*
1168
 * This is the default resync_to_restart method for data source managers
1169
 * to use if they don't have any better approach.  Some data source managers
1170
 * may be able to back up, or may have additional knowledge about the data
1171
 * which permits a more intelligent recovery strategy; such managers would
1172
 * presumably supply their own resync method.
1173
 *
1174
 * read_restart_marker calls resync_to_restart if it finds a marker other than
1175
 * the restart marker it was expecting.  (This code is *not* used unless
1176
 * a nonzero restart interval has been declared.)  cinfo->unread_marker is
1177
 * the marker code actually found (might be anything, except 0 or FF).
1178
 * The desired restart marker number (0..7) is passed as a parameter.
1179
 * This routine is supposed to apply whatever error recovery strategy seems
1180
 * appropriate in order to position the input stream to the next data segment.
1181
 * Note that cinfo->unread_marker is treated as a marker appearing before
1182
 * the current data-source input point; usually it should be reset to zero
1183
 * before returning.
1184
 * Returns FALSE if suspension is required.
1185
 *
1186
 * This implementation is substantially constrained by wanting to treat the
1187
 * input as a data stream; this means we can't back up.  Therefore, we have
1188
 * only the following actions to work with:
1189
 *   1. Simply discard the marker and let the entropy decoder resume at next
1190
 *      byte of file.
1191
 *   2. Read forward until we find another marker, discarding intervening
1192
 *      data.  (In theory we could look ahead within the current bufferload,
1193
 *      without having to discard data if we don't find the desired marker.
1194
 *      This idea is not implemented here, in part because it makes behavior
1195
 *      dependent on buffer size and chance buffer-boundary positions.)
1196
 *   3. Leave the marker unread (by failing to zero cinfo->unread_marker).
1197
 *      This will cause the entropy decoder to process an empty data segment,
1198
 *      inserting dummy zeroes, and then we will reprocess the marker.
1199
 *
1200
 * #2 is appropriate if we think the desired marker lies ahead, while #3 is
1201
 * appropriate if the found marker is a future restart marker (indicating
1202
 * that we have missed the desired restart marker, probably because it got
1203
 * corrupted).
1204
 * We apply #2 or #3 if the found marker is a restart marker no more than
1205
 * two counts behind or ahead of the expected one.  We also apply #2 if the
1206
 * found marker is not a legal JPEG marker code (it's certainly bogus data).
1207
 * If the found marker is a restart marker more than 2 counts away, we do #1
1208
 * (too much risk that the marker is erroneous; with luck we will be able to
1209
 * resync at some future point).
1210
 * For any valid non-restart JPEG marker, we apply #3.  This keeps us from
1211
 * overrunning the end of a scan.  An implementation limited to single-scan
1212
 * files might find it better to apply #2 for markers other than EOI, since
1213
 * any other marker would have to be bogus data in that case.
1214
 */
1215
1216
GLOBAL(boolean)
1217
jpeg_resync_to_restart(j_decompress_ptr cinfo, int desired)
1218
298M
{
1219
298M
  int marker = cinfo->unread_marker;
1220
298M
  int action = 1;
1221
1222
  /* Always put up a warning. */
1223
298M
  WARNMS2(cinfo, JWRN_MUST_RESYNC, marker, desired);
1224
1225
  /* Outer loop handles repeated decision after scanning forward. */
1226
298M
  for (;;) {
1227
298M
    if (marker < (int)M_SOF0)
1228
32.7k
      action = 2;               /* invalid marker */
1229
298M
    else if (marker < (int)M_RST0 || marker > (int)M_RST7)
1230
298M
      action = 3;               /* valid non-restart marker */
1231
181k
    else {
1232
181k
      if (marker == ((int)M_RST0 + ((desired + 1) & 7)) ||
1233
135k
          marker == ((int)M_RST0 + ((desired + 2) & 7)))
1234
80.3k
        action = 3;             /* one of the next two expected restarts */
1235
100k
      else if (marker == ((int)M_RST0 + ((desired - 1) & 7)) ||
1236
90.9k
               marker == ((int)M_RST0 + ((desired - 2) & 7)))
1237
20.6k
        action = 2;             /* a prior restart, so advance */
1238
80.2k
      else
1239
80.2k
        action = 1;             /* desired restart or too far away */
1240
181k
    }
1241
298M
    TRACEMS2(cinfo, 4, JTRC_RECOVERY_ACTION, marker, action);
1242
298M
    switch (action) {
1243
80.2k
    case 1:
1244
      /* Discard marker and let entropy decoder resume processing. */
1245
80.2k
      cinfo->unread_marker = 0;
1246
80.2k
      return TRUE;
1247
53.3k
    case 2:
1248
      /* Scan to the next marker, and repeat the decision loop. */
1249
53.3k
      if (!next_marker(cinfo))
1250
0
        return FALSE;
1251
53.3k
      marker = cinfo->unread_marker;
1252
53.3k
      break;
1253
298M
    case 3:
1254
      /* Return without advancing past this marker. */
1255
      /* Entropy decoder will be forced to process an empty segment. */
1256
298M
      return TRUE;
1257
298M
    }
1258
298M
  } /* end loop */
1259
298M
}
1260
1261
1262
/*
1263
 * Reset marker processing state to begin a fresh datastream.
1264
 */
1265
1266
METHODDEF(void)
1267
reset_marker_reader(j_decompress_ptr cinfo)
1268
333k
{
1269
333k
  my_marker_ptr marker = (my_marker_ptr)cinfo->marker;
1270
1271
333k
  cinfo->comp_info = NULL;              /* until allocated by get_sof */
1272
333k
  cinfo->input_scan_number = 0;         /* no SOS seen yet */
1273
333k
  cinfo->unread_marker = 0;             /* no pending marker */
1274
333k
  marker->pub.saw_SOI = FALSE;          /* set internal state too */
1275
333k
  marker->pub.saw_SOF = FALSE;
1276
333k
  marker->pub.discarded_bytes = 0;
1277
333k
  marker->cur_marker = NULL;
1278
333k
}
1279
1280
1281
/*
1282
 * Initialize the marker reader module.
1283
 * This is called only once, when the decompression object is created.
1284
 */
1285
1286
GLOBAL(void)
1287
jinit_marker_reader(j_decompress_ptr cinfo)
1288
67.5k
{
1289
67.5k
  my_marker_ptr marker;
1290
67.5k
  int i;
1291
1292
  /* Create subobject in permanent pool */
1293
67.5k
  marker = (my_marker_ptr)
1294
67.5k
    (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_PERMANENT,
1295
67.5k
                                sizeof(my_marker_reader));
1296
67.5k
  cinfo->marker = (struct jpeg_marker_reader *)marker;
1297
  /* Initialize public method pointers */
1298
67.5k
  marker->pub.reset_marker_reader = reset_marker_reader;
1299
67.5k
  marker->pub.read_markers = read_markers;
1300
67.5k
  marker->pub.read_restart_marker = read_restart_marker;
1301
  /* Initialize COM/APPn processing.
1302
   * By default, we examine and then discard APP0 and APP14,
1303
   * but simply discard COM and all other APPn.
1304
   */
1305
67.5k
  marker->process_COM = skip_variable;
1306
67.5k
  marker->length_limit_COM = 0;
1307
1.14M
  for (i = 0; i < 16; i++) {
1308
1.08M
    marker->process_APPn[i] = skip_variable;
1309
1.08M
    marker->length_limit_APPn[i] = 0;
1310
1.08M
  }
1311
67.5k
  marker->process_APPn[0] = get_interesting_appn;
1312
67.5k
  marker->process_APPn[14] = get_interesting_appn;
1313
  /* Reset marker processing state */
1314
67.5k
  reset_marker_reader(cinfo);
1315
67.5k
}
1316
1317
1318
/*
1319
 * Control saving of COM and APPn markers into marker_list.
1320
 */
1321
1322
#ifdef SAVE_MARKERS_SUPPORTED
1323
1324
GLOBAL(void)
1325
jpeg_save_markers(j_decompress_ptr cinfo, int marker_code,
1326
                  unsigned int length_limit)
1327
974k
{
1328
974k
  my_marker_ptr marker = (my_marker_ptr)cinfo->marker;
1329
974k
  long maxlength;
1330
974k
  jpeg_marker_parser_method processor;
1331
1332
  /* Length limit mustn't be larger than what we can allocate
1333
   * (should only be a concern in a 16-bit environment).
1334
   */
1335
974k
  maxlength = cinfo->mem->max_alloc_chunk - sizeof(struct jpeg_marker_struct);
1336
974k
  if (((long)length_limit) > maxlength)
1337
0
    length_limit = (unsigned int)maxlength;
1338
1339
  /* Choose processor routine to use.
1340
   * APP0/APP14 have special requirements.
1341
   */
1342
974k
  if (length_limit) {
1343
974k
    processor = save_marker;
1344
    /* If saving APP0/APP14, save at least enough for our internal use. */
1345
974k
    if (marker_code == (int)M_APP0 && length_limit < APP0_DATA_LEN)
1346
0
      length_limit = APP0_DATA_LEN;
1347
974k
    else if (marker_code == (int)M_APP14 && length_limit < APP14_DATA_LEN)
1348
0
      length_limit = APP14_DATA_LEN;
1349
974k
  } else {
1350
0
    processor = skip_variable;
1351
    /* If discarding APP0/APP14, use our regular on-the-fly processor. */
1352
0
    if (marker_code == (int)M_APP0 || marker_code == (int)M_APP14)
1353
0
      processor = get_interesting_appn;
1354
0
  }
1355
1356
974k
  if (marker_code == (int)M_COM) {
1357
22.7k
    marker->process_COM = processor;
1358
22.7k
    marker->length_limit_COM = length_limit;
1359
951k
  } else if (marker_code >= (int)M_APP0 && marker_code <= (int)M_APP15) {
1360
951k
    marker->process_APPn[marker_code - (int)M_APP0] = processor;
1361
951k
    marker->length_limit_APPn[marker_code - (int)M_APP0] = length_limit;
1362
951k
  } else
1363
0
    ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
1364
974k
}
1365
1366
#endif /* SAVE_MARKERS_SUPPORTED */
1367
1368
1369
/*
1370
 * Install a special processing method for COM or APPn markers.
1371
 */
1372
1373
GLOBAL(void)
1374
jpeg_set_marker_processor(j_decompress_ptr cinfo, int marker_code,
1375
                          jpeg_marker_parser_method routine)
1376
36.6k
{
1377
36.6k
  my_marker_ptr marker = (my_marker_ptr)cinfo->marker;
1378
1379
36.6k
  if (marker_code == (int)M_COM)
1380
0
    marker->process_COM = routine;
1381
36.6k
  else if (marker_code >= (int)M_APP0 && marker_code <= (int)M_APP15)
1382
36.6k
    marker->process_APPn[marker_code - (int)M_APP0] = routine;
1383
0
  else
1384
0
    ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
1385
36.6k
}