Coverage Report

Created: 2025-03-04 07:22

/src/serenity/Userland/Libraries/LibGfx/ImageFormats/GIFLoader.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright (c) 2018-2021, Andreas Kling <kling@serenityos.org>
3
 * Copyright (c) 2022, the SerenityOS developers.
4
 *
5
 * SPDX-License-Identifier: BSD-2-Clause
6
 */
7
8
#include <AK/Array.h>
9
#include <AK/BitStream.h>
10
#include <AK/Debug.h>
11
#include <AK/Endian.h>
12
#include <AK/Error.h>
13
#include <AK/IntegralMath.h>
14
#include <AK/Memory.h>
15
#include <AK/MemoryStream.h>
16
#include <AK/Try.h>
17
#include <LibCompress/Lzw.h>
18
#include <LibGfx/ImageFormats/GIFLoader.h>
19
#include <string.h>
20
21
namespace Gfx {
22
23
// Row strides and offsets for each interlace pass.
24
static constexpr Array<int, 4> INTERLACE_ROW_STRIDES = { 8, 8, 4, 2 };
25
static constexpr Array<int, 4> INTERLACE_ROW_OFFSETS = { 0, 4, 2, 1 };
26
27
struct GIFImageDescriptor {
28
    u16 x { 0 };
29
    u16 y { 0 };
30
    u16 width { 0 };
31
    u16 height { 0 };
32
    bool use_global_color_map { true };
33
    bool interlaced { false };
34
    Color color_map[256];
35
    u8 lzw_min_code_size { 0 };
36
    ByteBuffer lzw_encoded_bytes;
37
38
    // Fields from optional graphic control extension block
39
    enum DisposalMethod : u8 {
40
        None = 0,
41
        InPlace = 1,
42
        RestoreBackground = 2,
43
        RestorePrevious = 3,
44
    };
45
    DisposalMethod disposal_method { None };
46
    u8 transparency_index { 0 };
47
    u16 duration { 0 };
48
    bool transparent { false };
49
    bool user_input { false };
50
51
    IntRect rect() const
52
11.9k
    {
53
11.9k
        return { this->x, this->y, this->width, this->height };
54
11.9k
    }
55
};
56
57
struct LogicalScreen {
58
    u16 width;
59
    u16 height;
60
    Color color_map[256];
61
};
62
63
struct GIFLoadingContext {
64
    GIFLoadingContext(FixedMemoryStream stream)
65
867
        : stream(move(stream))
66
867
    {
67
867
    }
68
69
    enum State {
70
        NotDecoded = 0,
71
        FrameDescriptorsLoaded,
72
        FrameComplete,
73
    };
74
    State state { NotDecoded };
75
    enum ErrorState {
76
        NoError = 0,
77
        FailedToDecodeAllFrames,
78
        FailedToDecodeAnyFrame,
79
        FailedToLoadFrameDescriptors,
80
    };
81
    ErrorState error_state { NoError };
82
83
    FixedMemoryStream stream;
84
85
    LogicalScreen logical_screen {};
86
    u8 background_color_index { 0 };
87
    Vector<NonnullOwnPtr<GIFImageDescriptor>> images {};
88
    size_t loops { 1 };
89
    RefPtr<Gfx::Bitmap> frame_buffer;
90
    size_t current_frame { 0 };
91
    RefPtr<Gfx::Bitmap> prev_frame_buffer;
92
};
93
94
enum class GIFFormat {
95
    GIF87a,
96
    GIF89a,
97
};
98
99
static ErrorOr<GIFFormat> decode_gif_header(Stream& stream)
100
867
{
101
867
    static auto valid_header_87 = "GIF87a"sv;
102
867
    static auto valid_header_89 = "GIF89a"sv;
103
104
867
    Array<u8, 6> header;
105
867
    TRY(stream.read_until_filled(header));
106
107
867
    if (header.span() == valid_header_87.bytes())
108
542
        return GIFFormat::GIF87a;
109
325
    if (header.span() == valid_header_89.bytes())
110
311
        return GIFFormat::GIF89a;
111
112
14
    return Error::from_string_literal("GIF header unknown");
113
325
}
114
115
static void copy_frame_buffer(Bitmap& dest, Bitmap const& src)
116
4.02k
{
117
4.02k
    VERIFY(dest.size_in_bytes() == src.size_in_bytes());
118
4.02k
    memcpy(dest.scanline(0), src.scanline(0), dest.size_in_bytes());
119
4.02k
}
120
121
static void clear_rect(Bitmap& bitmap, IntRect const& rect, Color color)
122
11.9k
{
123
11.9k
    auto intersection_rect = rect.intersected(bitmap.rect());
124
11.9k
    if (intersection_rect.is_empty())
125
11.7k
        return;
126
127
249
    ARGB32* dst = bitmap.scanline(intersection_rect.top()) + intersection_rect.left();
128
249
    size_t const dst_skip = bitmap.pitch() / sizeof(ARGB32);
129
130
52.1k
    for (int i = intersection_rect.height() - 1; i >= 0; --i) {
131
51.8k
        fast_u32_fill(dst, color.value(), intersection_rect.width());
132
51.8k
        dst += dst_skip;
133
51.8k
    }
134
249
}
135
136
static ErrorOr<void> decode_frame(GIFLoadingContext& context, size_t frame_index)
137
114k
{
138
114k
    if (frame_index >= context.images.size()) {
139
2
        return Error::from_string_literal("frame_index size too high");
140
2
    }
141
142
114k
    if (context.state >= GIFLoadingContext::State::FrameComplete && frame_index == context.current_frame) {
143
258
        return {};
144
258
    }
145
146
114k
    size_t start_frame = context.current_frame + 1;
147
114k
    if (context.state < GIFLoadingContext::State::FrameComplete) {
148
2.56k
        start_frame = 0;
149
2.56k
        context.frame_buffer = TRY(Bitmap::create(BitmapFormat::BGRA8888, { context.logical_screen.width, context.logical_screen.height }));
150
2.55k
        context.prev_frame_buffer = TRY(Bitmap::create(BitmapFormat::BGRA8888, { context.logical_screen.width, context.logical_screen.height }));
151
152
111k
    } else if (frame_index < context.current_frame) {
153
114
        start_frame = 0;
154
114
    }
155
156
308k
    for (size_t i = start_frame; i <= frame_index; ++i) {
157
194k
        auto& image = context.images.at(i);
158
159
194k
        auto const previous_image_disposal_method = i > 0 ? context.images.at(i - 1)->disposal_method : GIFImageDescriptor::DisposalMethod::None;
160
161
194k
        if (i == 0) {
162
2.67k
            context.frame_buffer->fill(Color::Transparent);
163
192k
        } else if (i > 0 && image->disposal_method == GIFImageDescriptor::DisposalMethod::RestorePrevious
164
192k
            && previous_image_disposal_method != GIFImageDescriptor::DisposalMethod::RestorePrevious) {
165
            // This marks the start of a run of frames that once disposed should be restored to the
166
            // previous underlying image contents. Therefore we make a copy of the current frame
167
            // buffer so that it can be restored later.
168
1.76k
            copy_frame_buffer(*context.prev_frame_buffer, *context.frame_buffer);
169
1.76k
        }
170
171
194k
        if (previous_image_disposal_method == GIFImageDescriptor::DisposalMethod::RestoreBackground) {
172
            // Note: RestoreBackground could be interpreted either as restoring the underlying
173
            // background of the entire image (e.g. container element's background-color), or the
174
            // background color of the GIF itself. It appears that all major browsers and most other
175
            // GIF decoders adhere to the former interpretation, therefore we will do the same by
176
            // clearing the entire frame buffer to transparent.
177
11.9k
            clear_rect(*context.frame_buffer, context.images[i - 1]->rect(), Color::Transparent);
178
182k
        } else if (i > 0 && previous_image_disposal_method == GIFImageDescriptor::DisposalMethod::RestorePrevious) {
179
            // Previous frame indicated that once disposed, it should be restored to *its* previous
180
            // underlying image contents, therefore we restore the saved previous frame buffer.
181
2.26k
            copy_frame_buffer(*context.frame_buffer, *context.prev_frame_buffer);
182
2.26k
        }
183
184
194k
        if (image->lzw_min_code_size > 8)
185
197
            return Error::from_string_literal("LZW minimum code size is greater than 8");
186
187
194k
        auto decoded_stream = TRY(Compress::LzwDecompressor<LittleEndianInputBitStream>::decompress_all(image->lzw_encoded_bytes, image->lzw_min_code_size));
188
189
194k
        auto const& color_map = image->use_global_color_map ? context.logical_screen.color_map : image->color_map;
190
191
194k
        int pixel_index = 0;
192
194k
        int row = 0;
193
194k
        int interlace_pass = 0;
194
195
194k
        if (!image->width)
196
83.8k
            continue;
197
198
240M
        for (auto const& color : decoded_stream.bytes()) {
199
240M
            auto c = color_map[color];
200
201
240M
            int x = pixel_index % image->width + image->x;
202
240M
            int y = row + image->y;
203
204
240M
            if (context.frame_buffer->rect().contains(x, y) && (!image->transparent || color != image->transparency_index)) {
205
27.1k
                context.frame_buffer->set_pixel(x, y, c);
206
27.1k
            }
207
208
240M
            ++pixel_index;
209
240M
            if (pixel_index % image->width == 0) {
210
217M
                if (image->interlaced) {
211
66.9k
                    if (interlace_pass < 4) {
212
63.1k
                        if (row + INTERLACE_ROW_STRIDES[interlace_pass] >= image->height) {
213
2.25k
                            ++interlace_pass;
214
2.25k
                            if (interlace_pass < 4)
215
1.74k
                                row = INTERLACE_ROW_OFFSETS[interlace_pass];
216
60.9k
                        } else {
217
60.9k
                            row += INTERLACE_ROW_STRIDES[interlace_pass];
218
60.9k
                        }
219
63.1k
                    }
220
217M
                } else {
221
217M
                    ++row;
222
217M
                }
223
217M
            }
224
240M
        }
225
226
110k
        context.current_frame = i;
227
110k
        context.state = GIFLoadingContext::State::FrameComplete;
228
110k
    }
229
230
113k
    return {};
231
114k
}
232
233
static ErrorOr<void> load_header_and_logical_screen(GIFLoadingContext& context)
234
867
{
235
1.73k
    if (TRY(context.stream.size()) < 32)
236
0
        return Error::from_string_literal("Size too short for GIF frame descriptors");
237
238
1.72k
    TRY(decode_gif_header(context.stream));
239
240
853
    context.logical_screen.width = TRY(context.stream.read_value<LittleEndian<u16>>());
241
853
    context.logical_screen.height = TRY(context.stream.read_value<LittleEndian<u16>>());
242
243
853
    auto packed_fields = TRY(context.stream.read_value<u8>());
244
853
    context.background_color_index = TRY(context.stream.read_value<u8>());
245
853
    [[maybe_unused]] auto pixel_aspect_ratio = TRY(context.stream.read_value<u8>());
246
247
    // Global Color Table; if the flag is set, the Global Color Table will
248
    // immediately follow the Logical Screen Descriptor.
249
0
    bool global_color_table_flag = packed_fields & 0x80;
250
251
853
    if (global_color_table_flag) {
252
424
        u8 bits_per_pixel = (packed_fields & 7) + 1;
253
424
        size_t color_map_entry_count = 1 << bits_per_pixel;
254
255
5.46k
        for (size_t i = 0; i < color_map_entry_count; ++i) {
256
5.05k
            u8 r = TRY(context.stream.read_value<u8>());
257
5.04k
            u8 g = TRY(context.stream.read_value<u8>());
258
5.04k
            u8 b = TRY(context.stream.read_value<u8>());
259
0
            context.logical_screen.color_map[i] = { r, g, b };
260
5.04k
        }
261
424
    }
262
263
841
    return {};
264
853
}
265
266
static ErrorOr<void> load_gif_frame_descriptors(GIFLoadingContext& context)
267
841
{
268
841
    NonnullOwnPtr<GIFImageDescriptor> current_image = make<GIFImageDescriptor>();
269
785k
    for (;;) {
270
785k
        u8 sentinel = TRY(context.stream.read_value<u8>());
271
272
785k
        if (sentinel == '!') {
273
18.4k
            u8 extension_type = TRY(context.stream.read_value<u8>());
274
275
0
            u8 sub_block_length = 0;
276
277
18.4k
            Vector<u8> sub_block {};
278
103k
            for (;;) {
279
103k
                sub_block_length = TRY(context.stream.read_value<u8>());
280
103k
                if (sub_block_length == 0)
281
18.3k
                    break;
282
283
169k
                TRY(sub_block.try_resize(sub_block.size() + sub_block_length));
284
84.9k
                TRY(context.stream.read_until_filled(sub_block.span().slice_from_end(sub_block_length)));
285
84.8k
            }
286
287
18.3k
            if (extension_type == 0xF9) {
288
16.4k
                if (sub_block.size() != 4) {
289
1.83k
                    dbgln_if(GIF_DEBUG, "Unexpected graphic control size");
290
1.83k
                    continue;
291
1.83k
                }
292
293
14.5k
                u8 disposal_method = (sub_block[0] & 0x1C) >> 2;
294
14.5k
                current_image->disposal_method = (GIFImageDescriptor::DisposalMethod)disposal_method;
295
296
14.5k
                u8 user_input = (sub_block[0] & 0x2) >> 1;
297
14.5k
                current_image->user_input = user_input == 1;
298
299
14.5k
                u8 transparent = sub_block[0] & 1;
300
14.5k
                current_image->transparent = transparent == 1;
301
302
14.5k
                u16 duration = sub_block[1] + ((u16)sub_block[2] << 8);
303
14.5k
                current_image->duration = duration;
304
305
14.5k
                current_image->transparency_index = sub_block[3];
306
307
14.5k
                dbgln_if(GIF_DEBUG, "Graphic control: disposal_method={}, user_input={}, transparent={}, duration={}", (int)current_image->disposal_method, current_image->user_input, current_image->transparent, current_image->duration);
308
14.5k
            }
309
310
16.5k
            if (extension_type == 0xFF) {
311
796
                if (sub_block.size() != 14) {
312
398
                    dbgln_if(GIF_DEBUG, "Unexpected application extension size: {}", sub_block.size());
313
398
                    continue;
314
398
                }
315
316
398
                if (sub_block[11] != 1) {
317
194
                    dbgln_if(GIF_DEBUG, "Unexpected application extension format");
318
194
                    continue;
319
194
                }
320
321
204
                u16 loops = sub_block[12] + (sub_block[13] << 8);
322
204
                context.loops = loops;
323
324
204
                dbgln_if(GIF_DEBUG, "Application extension: loops={}", context.loops);
325
204
            }
326
327
15.9k
            continue;
328
16.5k
        }
329
330
766k
        if (sentinel == ',') {
331
766k
            context.images.append(move(current_image));
332
766k
            auto& image = context.images.last();
333
334
766k
            image->x = TRY(context.stream.read_value<LittleEndian<u16>>());
335
766k
            image->y = TRY(context.stream.read_value<LittleEndian<u16>>());
336
766k
            image->width = TRY(context.stream.read_value<LittleEndian<u16>>());
337
766k
            image->height = TRY(context.stream.read_value<LittleEndian<u16>>());
338
339
766k
            auto packed_fields = TRY(context.stream.read_value<u8>());
340
341
0
            image->use_global_color_map = !(packed_fields & 0x80);
342
766k
            image->interlaced = (packed_fields & 0x40) != 0;
343
344
766k
            dbgln_if(GIF_DEBUG, "Image descriptor: x={}, y={}, width={}, height={}, use_global_color_map={}, local_map_size_exponent={}, interlaced={}", image->x, image->y, image->width, image->height, image->use_global_color_map, (packed_fields & 7) + 1, image->interlaced);
345
346
766k
            if (!image->use_global_color_map) {
347
30.0k
                size_t local_color_table_size = AK::exp2<size_t>((packed_fields & 7) + 1);
348
349
156k
                for (size_t i = 0; i < local_color_table_size; ++i) {
350
126k
                    u8 r = TRY(context.stream.read_value<u8>());
351
126k
                    u8 g = TRY(context.stream.read_value<u8>());
352
126k
                    u8 b = TRY(context.stream.read_value<u8>());
353
0
                    image->color_map[i] = { r, g, b };
354
126k
                }
355
30.0k
            }
356
357
766k
            image->lzw_min_code_size = TRY(context.stream.read_value<u8>());
358
359
1.72M
            for (;;) {
360
1.72M
                auto const lzw_encoded_bytes_expected = TRY(context.stream.read_value<u8>());
361
362
                // Block terminator
363
1.72M
                if (lzw_encoded_bytes_expected == 0)
364
766k
                    break;
365
366
957k
                auto const lzw_subblock = TRY(image->lzw_encoded_bytes.get_bytes_for_writing(lzw_encoded_bytes_expected));
367
957k
                TRY(context.stream.read_until_filled(lzw_subblock));
368
957k
            }
369
370
766k
            current_image = make<GIFImageDescriptor>();
371
766k
            continue;
372
766k
        }
373
374
578
        if (sentinel == ';') {
375
506
            break;
376
506
        }
377
378
72
        return Error::from_string_literal("Unexpected sentinel");
379
578
    }
380
381
506
    context.state = GIFLoadingContext::State::FrameDescriptorsLoaded;
382
506
    return {};
383
841
}
384
385
GIFImageDecoderPlugin::GIFImageDecoderPlugin(FixedMemoryStream stream)
386
867
{
387
867
    m_context = make<GIFLoadingContext>(move(stream));
388
867
}
389
390
867
GIFImageDecoderPlugin::~GIFImageDecoderPlugin() = default;
391
392
IntSize GIFImageDecoderPlugin::size()
393
0
{
394
0
    return { m_context->logical_screen.width, m_context->logical_screen.height };
395
0
}
396
397
bool GIFImageDecoderPlugin::sniff(ReadonlyBytes data)
398
0
{
399
0
    FixedMemoryStream stream { data };
400
0
    return !decode_gif_header(stream).is_error();
401
0
}
402
403
ErrorOr<NonnullOwnPtr<ImageDecoderPlugin>> GIFImageDecoderPlugin::create(ReadonlyBytes data)
404
867
{
405
867
    FixedMemoryStream stream { data };
406
867
    auto plugin = TRY(adopt_nonnull_own_or_enomem(new (nothrow) GIFImageDecoderPlugin(move(stream))));
407
867
    TRY(load_header_and_logical_screen(*plugin->m_context));
408
0
    return plugin;
409
867
}
410
411
bool GIFImageDecoderPlugin::is_animated()
412
0
{
413
0
    if (m_context->error_state != GIFLoadingContext::ErrorState::NoError) {
414
0
        return false;
415
0
    }
416
417
0
    if (m_context->state < GIFLoadingContext::State::FrameDescriptorsLoaded) {
418
0
        if (load_gif_frame_descriptors(*m_context).is_error()) {
419
0
            m_context->error_state = GIFLoadingContext::ErrorState::FailedToLoadFrameDescriptors;
420
0
            return false;
421
0
        }
422
0
    }
423
424
0
    return m_context->images.size() > 1;
425
0
}
426
427
size_t GIFImageDecoderPlugin::loop_count()
428
0
{
429
0
    if (m_context->error_state != GIFLoadingContext::ErrorState::NoError) {
430
0
        return 0;
431
0
    }
432
433
0
    if (m_context->state < GIFLoadingContext::State::FrameDescriptorsLoaded) {
434
0
        if (load_gif_frame_descriptors(*m_context).is_error()) {
435
0
            m_context->error_state = GIFLoadingContext::ErrorState::FailedToLoadFrameDescriptors;
436
0
            return 0;
437
0
        }
438
0
    }
439
440
0
    return m_context->loops;
441
0
}
442
443
size_t GIFImageDecoderPlugin::frame_count()
444
114k
{
445
114k
    if (m_context->error_state != GIFLoadingContext::ErrorState::NoError) {
446
272
        return 1;
447
272
    }
448
449
113k
    if (m_context->state < GIFLoadingContext::State::FrameDescriptorsLoaded) {
450
0
        if (load_gif_frame_descriptors(*m_context).is_error()) {
451
0
            m_context->error_state = GIFLoadingContext::ErrorState::FailedToLoadFrameDescriptors;
452
0
            return 1;
453
0
        }
454
0
    }
455
456
113k
    return m_context->images.size();
457
113k
}
458
459
size_t GIFImageDecoderPlugin::first_animated_frame_index()
460
0
{
461
0
    return 0;
462
0
}
463
464
ErrorOr<ImageFrameDescriptor> GIFImageDecoderPlugin::frame(size_t index, Optional<IntSize>)
465
114k
{
466
114k
    if (m_context->error_state >= GIFLoadingContext::ErrorState::FailedToDecodeAnyFrame) {
467
0
        return Error::from_string_literal("GIFImageDecoderPlugin: Decoding failed");
468
0
    }
469
470
114k
    if (m_context->state < GIFLoadingContext::State::FrameDescriptorsLoaded) {
471
841
        if (auto result = load_gif_frame_descriptors(*m_context); result.is_error()) {
472
335
            m_context->error_state = GIFLoadingContext::ErrorState::FailedToLoadFrameDescriptors;
473
335
            return result.release_error();
474
335
        }
475
841
    }
476
477
114k
    if (m_context->error_state == GIFLoadingContext::ErrorState::NoError) {
478
114k
        if (auto result = decode_frame(*m_context, index); result.is_error()) {
479
409
            if (m_context->state < GIFLoadingContext::State::FrameComplete) {
480
239
                m_context->error_state = GIFLoadingContext::ErrorState::FailedToDecodeAnyFrame;
481
239
                return result.release_error();
482
239
            }
483
170
            if (auto result = decode_frame(*m_context, 0); result.is_error()) {
484
0
                m_context->error_state = GIFLoadingContext::ErrorState::FailedToDecodeAnyFrame;
485
0
                return result.release_error();
486
0
            }
487
170
            m_context->error_state = GIFLoadingContext::ErrorState::FailedToDecodeAllFrames;
488
170
        }
489
114k
    }
490
491
113k
    ImageFrameDescriptor frame {};
492
113k
    frame.image = TRY(m_context->frame_buffer->clone());
493
0
    frame.duration = m_context->images[index]->duration * 10;
494
495
113k
    if (frame.duration <= 10) {
496
102k
        frame.duration = 100;
497
102k
    }
498
499
113k
    return frame;
500
113k
}
501
502
}