Coverage Report

Created: 2026-09-28 07:00

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libjxl/lib/jxl/box_content_decoder.cc
Line
Count
Source
1
// Copyright (c) the JPEG XL Project Authors. All rights reserved.
2
//
3
// Use of this source code is governed by a BSD-style
4
// license that can be found in the LICENSE file.
5
6
#include "lib/jxl/box_content_decoder.h"
7
8
#include <brotli/decode.h>
9
#include <jxl/decode.h>
10
11
#include <algorithm>
12
#include <cstddef>
13
#include <cstdint>
14
#include <cstring>
15
16
#include "lib/jxl/base/sanitizers.h"
17
18
namespace jxl {
19
20
76.6k
JxlBoxContentDecoder::JxlBoxContentDecoder() = default;
21
22
76.6k
JxlBoxContentDecoder::~JxlBoxContentDecoder() {
23
76.6k
  if (brotli_dec) {
24
5.03k
    BrotliDecoderDestroyInstance(brotli_dec);
25
5.03k
  }
26
76.6k
}
27
28
void JxlBoxContentDecoder::StartBox(bool brob_decode, bool box_until_eof,
29
24.7k
                                    size_t contents_size) {
30
24.7k
  if (brotli_dec) {
31
179
    BrotliDecoderDestroyInstance(brotli_dec);
32
179
    brotli_dec = nullptr;
33
179
  }
34
24.7k
  header_done_ = false;
35
24.7k
  brob_decode_ = brob_decode;
36
24.7k
  box_until_eof_ = box_until_eof;
37
24.7k
  remaining_ = box_until_eof ? 0 : contents_size;
38
24.7k
  pos_ = 0;
39
24.7k
}
40
41
JxlDecoderStatus JxlBoxContentDecoder::Process(const uint8_t* next_in,
42
                                               size_t avail_in, size_t box_pos,
43
                                               uint8_t** next_out,
44
164k
                                               size_t* avail_out) {
45
  // The caller provides `box_pos` as the current position (in bytes) within
46
  // the box contents corresponding to `next_in`. Our internal `pos_` tracks
47
  // how many bytes of box contents have been consumed/processed so far.
48
  // If `box_pos` ever exceeds `pos_`, adjusting by `pos_ - box_pos` would
49
  // underflow and cause out-of-bounds reads.
50
164k
  if (box_pos > pos_) return JXL_DEC_ERROR;
51
164k
  const size_t offset = pos_ - box_pos;
52
164k
  if (offset > avail_in) return JXL_DEC_ERROR;
53
164k
  next_in += offset;
54
164k
  avail_in -= offset;
55
56
164k
  if (brob_decode_) {
57
125k
    if (!header_done_) {
58
5.21k
      if (avail_in < 4) return JXL_DEC_NEED_MORE_INPUT;
59
5.21k
      if (!box_until_eof_) {
60
4.95k
        if (remaining_ < 4) return JXL_DEC_ERROR;
61
4.95k
        remaining_ -= 4;
62
4.95k
      }
63
5.21k
      next_in += 4;
64
5.21k
      avail_in -= 4;
65
5.21k
      pos_ += 4;
66
5.21k
      header_done_ = true;
67
5.21k
    }
68
69
125k
    if (!brotli_dec) {
70
5.21k
      brotli_dec = BrotliDecoderCreateInstance(nullptr, nullptr, nullptr);
71
5.21k
    }
72
73
125k
    size_t avail_in_brotli = avail_in;
74
125k
    if (!box_until_eof_) avail_in_brotli = std::min<size_t>(avail_in_brotli, remaining_);
75
125k
    const uint8_t* next_in_before = next_in;
76
125k
    uint8_t* next_out_before = *next_out;
77
125k
    msan::MemoryIsInitialized(next_in, avail_in_brotli);
78
125k
    BrotliDecoderResult res = BrotliDecoderDecompressStream(
79
125k
        brotli_dec, &avail_in_brotli, &next_in, avail_out, next_out, nullptr);
80
125k
    size_t consumed = next_in - next_in_before;
81
125k
    size_t produced = *next_out - next_out_before;
82
125k
    if (res == BROTLI_DECODER_RESULT_ERROR) {
83
1.29k
      return JXL_DEC_ERROR;
84
1.29k
    }
85
123k
    msan::UnpoisonMemory(next_out_before, produced);
86
123k
    pos_ += consumed;
87
123k
    if (!box_until_eof_) {
88
118k
      remaining_ -= consumed;
89
118k
      if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT && remaining_ == 0) {
90
12
        return JXL_DEC_ERROR;
91
12
      }
92
118k
    }
93
123k
    if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT) {
94
92.3k
      return JXL_DEC_NEED_MORE_INPUT;
95
92.3k
    }
96
31.3k
    if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT) {
97
31.0k
      return JXL_DEC_BOX_NEED_MORE_OUTPUT;
98
31.0k
    }
99
278
    if (res == BROTLI_DECODER_RESULT_SUCCESS) {
100
278
      if (!box_until_eof_ && remaining_ != 0) return JXL_DEC_ERROR;
101
226
      return JXL_DEC_BOX_COMPLETE;
102
278
    }
103
    // unknown Brotli result
104
0
    return JXL_DEC_ERROR;
105
39.2k
  } else {
106
    // remaining box bytes as seen from dec->file_pos
107
39.2k
    size_t can_read = avail_in;
108
39.2k
    if (!box_until_eof_) can_read = std::min<size_t>(can_read, remaining_);
109
39.2k
    size_t to_write = std::min<size_t>(can_read, *avail_out);
110
39.2k
    memcpy(*next_out, next_in, to_write);
111
112
39.2k
    *next_out += to_write;
113
39.2k
    *avail_out -= to_write;
114
39.2k
    if (!box_until_eof_) remaining_ -= to_write;
115
39.2k
    pos_ += to_write;
116
117
39.2k
    if (to_write < can_read) return JXL_DEC_BOX_NEED_MORE_OUTPUT;
118
119
38.2k
    if (!box_until_eof_ && remaining_ > 0) return JXL_DEC_NEED_MORE_INPUT;
120
121
16.4k
    return JXL_DEC_BOX_COMPLETE;
122
38.2k
  }
123
164k
}
124
}  // namespace jxl