Coverage Report

Created: 2024-05-04 12:45

/proc/self/cwd/external/libjpeg_turbo/jdhuff.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * jdhuff.c
3
 *
4
 * This file was part of the Independent JPEG Group's software:
5
 * Copyright (C) 1991-1997, Thomas G. Lane.
6
 * libjpeg-turbo Modifications:
7
 * Copyright (C) 2009-2011, 2016, 2018-2019, D. R. Commander.
8
 * Copyright (C) 2018, Matthias Räncker.
9
 * For conditions of distribution and use, see the accompanying README.ijg
10
 * file.
11
 *
12
 * This file contains Huffman entropy decoding routines.
13
 *
14
 * Much of the complexity here has to do with supporting input suspension.
15
 * If the data source module demands suspension, we want to be able to back
16
 * up to the start of the current MCU.  To do this, we copy state variables
17
 * into local working storage, and update them back to the permanent
18
 * storage only upon successful completion of an MCU.
19
 *
20
 * NOTE: All referenced figures are from
21
 * Recommendation ITU-T T.81 (1992) | ISO/IEC 10918-1:1994.
22
 */
23
24
#define JPEG_INTERNALS
25
#include "jinclude.h"
26
#include "jpeglib.h"
27
#include "jdhuff.h"             /* Declarations shared with jdphuff.c */
28
#include "jpegcomp.h"
29
#include "jstdhuff.c"
30
31
32
/*
33
 * Expanded entropy decoder object for Huffman decoding.
34
 *
35
 * The savable_state subrecord contains fields that change within an MCU,
36
 * but must not be updated permanently until we complete the MCU.
37
 */
38
39
typedef struct {
40
  int last_dc_val[MAX_COMPS_IN_SCAN]; /* last DC coef for each component */
41
} savable_state;
42
43
typedef struct {
44
  struct jpeg_entropy_decoder pub; /* public fields */
45
46
  /* These fields are loaded into local variables at start of each MCU.
47
   * In case of suspension, we exit WITHOUT updating them.
48
   */
49
  bitread_perm_state bitstate;  /* Bit buffer at start of MCU */
50
  savable_state saved;          /* Other state at start of MCU */
51
52
  /* These fields are NOT loaded into local working state. */
53
  unsigned int restarts_to_go;  /* MCUs left in this restart interval */
54
55
  /* Pointers to derived tables (these workspaces have image lifespan) */
56
  d_derived_tbl *dc_derived_tbls[NUM_HUFF_TBLS];
57
  d_derived_tbl *ac_derived_tbls[NUM_HUFF_TBLS];
58
59
  /* Precalculated info set up by start_pass for use in decode_mcu: */
60
61
  /* Pointers to derived tables to be used for each block within an MCU */
62
  d_derived_tbl *dc_cur_tbls[D_MAX_BLOCKS_IN_MCU];
63
  d_derived_tbl *ac_cur_tbls[D_MAX_BLOCKS_IN_MCU];
64
  /* Whether we care about the DC and AC coefficient values for each block */
65
  boolean dc_needed[D_MAX_BLOCKS_IN_MCU];
66
  boolean ac_needed[D_MAX_BLOCKS_IN_MCU];
67
} huff_entropy_decoder;
68
69
typedef huff_entropy_decoder *huff_entropy_ptr;
70
71
72
/*
73
 * Initialize for a Huffman-compressed scan.
74
 */
75
76
METHODDEF(void)
77
start_pass_huff_decoder(j_decompress_ptr cinfo)
78
2.97k
{
79
2.97k
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
80
2.97k
  int ci, blkn, dctbl, actbl;
81
2.97k
  d_derived_tbl **pdtbl;
82
2.97k
  jpeg_component_info *compptr;
83
84
  /* Check that the scan parameters Ss, Se, Ah/Al are OK for sequential JPEG.
85
   * This ought to be an error condition, but we make it a warning because
86
   * there are some baseline files out there with all zeroes in these bytes.
87
   */
88
2.97k
  if (cinfo->Ss != 0 || cinfo->Se != DCTSIZE2 - 1 ||
89
2.97k
      cinfo->Ah != 0 || cinfo->Al != 0)
90
2.92k
    WARNMS(cinfo, JWRN_NOT_SEQUENTIAL);
91
92
7.16k
  for (ci = 0; ci < cinfo->comps_in_scan; ci++) {
93
4.19k
    compptr = cinfo->cur_comp_info[ci];
94
4.19k
    dctbl = compptr->dc_tbl_no;
95
4.19k
    actbl = compptr->ac_tbl_no;
96
    /* Compute derived values for Huffman tables */
97
    /* We may do this more than once for a table, but it's not expensive */
98
4.19k
    pdtbl = (d_derived_tbl **)(entropy->dc_derived_tbls) + dctbl;
99
4.19k
    jpeg_make_d_derived_tbl(cinfo, TRUE, dctbl, pdtbl);
100
4.19k
    pdtbl = (d_derived_tbl **)(entropy->ac_derived_tbls) + actbl;
101
4.19k
    jpeg_make_d_derived_tbl(cinfo, FALSE, actbl, pdtbl);
102
    /* Initialize DC predictions to 0 */
103
4.19k
    entropy->saved.last_dc_val[ci] = 0;
104
4.19k
  }
105
106
  /* Precalculate decoding info for each block in an MCU of this scan */
107
11.8k
  for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
108
8.87k
    ci = cinfo->MCU_membership[blkn];
109
8.87k
    compptr = cinfo->cur_comp_info[ci];
110
    /* Precalculate which table to use for each block */
111
8.87k
    entropy->dc_cur_tbls[blkn] = entropy->dc_derived_tbls[compptr->dc_tbl_no];
112
8.87k
    entropy->ac_cur_tbls[blkn] = entropy->ac_derived_tbls[compptr->ac_tbl_no];
113
    /* Decide whether we really care about the coefficient values */
114
8.87k
    if (compptr->component_needed) {
115
8.87k
      entropy->dc_needed[blkn] = TRUE;
116
      /* we don't need the ACs if producing a 1/8th-size image */
117
8.87k
      entropy->ac_needed[blkn] = (compptr->_DCT_scaled_size > 1);
118
8.87k
    } else {
119
0
      entropy->dc_needed[blkn] = entropy->ac_needed[blkn] = FALSE;
120
0
    }
121
8.87k
  }
122
123
  /* Initialize bitread state variables */
124
2.97k
  entropy->bitstate.bits_left = 0;
125
2.97k
  entropy->bitstate.get_buffer = 0; /* unnecessary, but keeps Purify quiet */
126
2.97k
  entropy->pub.insufficient_data = FALSE;
127
128
  /* Initialize restart counter */
129
2.97k
  entropy->restarts_to_go = cinfo->restart_interval;
130
2.97k
}
131
132
133
/*
134
 * Compute the derived values for a Huffman table.
135
 * This routine also performs some validation checks on the table.
136
 *
137
 * Note this is also used by jdphuff.c.
138
 */
139
140
GLOBAL(void)
141
jpeg_make_d_derived_tbl(j_decompress_ptr cinfo, boolean isDC, int tblno,
142
                        d_derived_tbl **pdtbl)
143
8.38k
{
144
8.38k
  JHUFF_TBL *htbl;
145
8.38k
  d_derived_tbl *dtbl;
146
8.38k
  int p, i, l, si, numsymbols;
147
8.38k
  int lookbits, ctr;
148
8.38k
  char huffsize[257];
149
8.38k
  unsigned int huffcode[257];
150
8.38k
  unsigned int code;
151
152
  /* Note that huffsize[] and huffcode[] are filled in code-length order,
153
   * paralleling the order of the symbols themselves in htbl->huffval[].
154
   */
155
156
  /* Find the input Huffman table */
157
8.38k
  if (tblno < 0 || tblno >= NUM_HUFF_TBLS)
158
0
    ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno);
159
8.38k
  htbl =
160
8.38k
    isDC ? cinfo->dc_huff_tbl_ptrs[tblno] : cinfo->ac_huff_tbl_ptrs[tblno];
161
8.38k
  if (htbl == NULL)
162
1
    ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno);
163
164
  /* Allocate a workspace if we haven't already done so. */
165
8.38k
  if (*pdtbl == NULL)
166
281
    *pdtbl = (d_derived_tbl *)
167
281
      (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
168
281
                                  sizeof(d_derived_tbl));
169
8.38k
  dtbl = *pdtbl;
170
8.38k
  dtbl->pub = htbl;             /* fill in back link */
171
172
  /* Figure C.1: make table of Huffman code length for each symbol */
173
174
8.38k
  p = 0;
175
142k
  for (l = 1; l <= 16; l++) {
176
134k
    i = (int)htbl->bits[l];
177
134k
    if (i < 0 || p + i > 256)   /* protect against table overrun */
178
0
      ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
179
578k
    while (i--)
180
444k
      huffsize[p++] = (char)l;
181
134k
  }
182
8.38k
  huffsize[p] = 0;
183
8.38k
  numsymbols = p;
184
185
  /* Figure C.2: generate the codes themselves */
186
  /* We also validate that the counts represent a legal Huffman code tree. */
187
188
8.38k
  code = 0;
189
8.38k
  si = huffsize[0];
190
8.38k
  p = 0;
191
101k
  while (huffsize[p]) {
192
537k
    while (((int)huffsize[p]) == si) {
193
444k
      huffcode[p++] = code;
194
444k
      code++;
195
444k
    }
196
    /* code is now 1 more than the last code used for codelength si; but
197
     * it must still fit in si bits, since no code is allowed to be all ones.
198
     */
199
92.9k
    if (((JLONG)code) >= (((JLONG)1) << si))
200
0
      ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
201
92.9k
    code <<= 1;
202
92.9k
    si++;
203
92.9k
  }
204
205
  /* Figure F.15: generate decoding tables for bit-sequential decoding */
206
207
8.38k
  p = 0;
208
142k
  for (l = 1; l <= 16; l++) {
209
134k
    if (htbl->bits[l]) {
210
      /* valoffset[l] = huffval[] index of 1st symbol of code length l,
211
       * minus the minimum code of length l
212
       */
213
68.7k
      dtbl->valoffset[l] = (JLONG)p - (JLONG)huffcode[p];
214
68.7k
      p += htbl->bits[l];
215
68.7k
      dtbl->maxcode[l] = huffcode[p - 1]; /* maximum code of length l */
216
68.7k
    } else {
217
65.3k
      dtbl->maxcode[l] = -1;    /* -1 if no codes of this length */
218
65.3k
    }
219
134k
  }
220
8.38k
  dtbl->valoffset[17] = 0;
221
8.38k
  dtbl->maxcode[17] = 0xFFFFFL; /* ensures jpeg_huff_decode terminates */
222
223
  /* Compute lookahead tables to speed up decoding.
224
   * First we set all the table entries to 0, indicating "too long";
225
   * then we iterate through the Huffman codes that are short enough and
226
   * fill in all the entries that correspond to bit sequences starting
227
   * with that code.
228
   */
229
230
2.15M
  for (i = 0; i < (1 << HUFF_LOOKAHEAD); i++)
231
2.14M
    dtbl->lookup[i] = (HUFF_LOOKAHEAD + 1) << HUFF_LOOKAHEAD;
232
233
8.38k
  p = 0;
234
75.4k
  for (l = 1; l <= HUFF_LOOKAHEAD; l++) {
235
167k
    for (i = 1; i <= (int)htbl->bits[l]; i++, p++) {
236
      /* l = current code's length, p = its index in huffcode[] & huffval[]. */
237
      /* Generate left-justified code followed by all possible bit sequences */
238
99.9k
      lookbits = huffcode[p] << (HUFF_LOOKAHEAD - l);
239
2.13M
      for (ctr = 1 << (HUFF_LOOKAHEAD - l); ctr > 0; ctr--) {
240
2.03M
        dtbl->lookup[lookbits] = (l << HUFF_LOOKAHEAD) | htbl->huffval[p];
241
2.03M
        lookbits++;
242
2.03M
      }
243
99.9k
    }
244
67.0k
  }
245
246
  /* Validate symbols as being reasonable.
247
   * For AC tables, we make no check, but accept all byte values 0..255.
248
   * For DC tables, we require the symbols to be in range 0..15.
249
   * (Tighter bounds could be applied depending on the data depth and mode,
250
   * but this is sufficient to ensure safe decoding.)
251
   */
252
8.38k
  if (isDC) {
253
44.3k
    for (i = 0; i < numsymbols; i++) {
254
40.1k
      int sym = htbl->huffval[i];
255
40.1k
      if (sym < 0 || sym > 15)
256
0
        ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
257
40.1k
    }
258
4.19k
  }
259
8.38k
}
260
261
262
/*
263
 * Out-of-line code for bit fetching (shared with jdphuff.c).
264
 * See jdhuff.h for info about usage.
265
 * Note: current values of get_buffer and bits_left are passed as parameters,
266
 * but are returned in the corresponding fields of the state struct.
267
 *
268
 * On most machines MIN_GET_BITS should be 25 to allow the full 32-bit width
269
 * of get_buffer to be used.  (On machines with wider words, an even larger
270
 * buffer could be used.)  However, on some machines 32-bit shifts are
271
 * quite slow and take time proportional to the number of places shifted.
272
 * (This is true with most PC compilers, for instance.)  In this case it may
273
 * be a win to set MIN_GET_BITS to the minimum value of 15.  This reduces the
274
 * average shift distance at the cost of more calls to jpeg_fill_bit_buffer.
275
 */
276
277
#ifdef SLOW_SHIFT_32
278
#define MIN_GET_BITS  15        /* minimum allowable value */
279
#else
280
10.4M
#define MIN_GET_BITS  (BIT_BUF_SIZE - 7)
281
#endif
282
283
284
GLOBAL(boolean)
285
jpeg_fill_bit_buffer(bitread_working_state *state,
286
                     register bit_buf_type get_buffer, register int bits_left,
287
                     int nbits)
288
/* Load up the bit buffer to a depth of at least nbits */
289
1.54M
{
290
  /* Copy heavily used state fields into locals (hopefully registers) */
291
1.54M
  register const JOCTET *next_input_byte = state->next_input_byte;
292
1.54M
  register size_t bytes_in_buffer = state->bytes_in_buffer;
293
1.54M
  j_decompress_ptr cinfo = state->cinfo;
294
295
  /* Attempt to load at least MIN_GET_BITS bits into get_buffer. */
296
  /* (It is assumed that no request will be for more than that many bits.) */
297
  /* We fail to do so only if we hit a marker or are forced to suspend. */
298
299
1.54M
  if (cinfo->unread_marker == 0) {      /* cannot advance past a marker */
300
10.0M
    while (bits_left < MIN_GET_BITS) {
301
8.78M
      register int c;
302
303
      /* Attempt to read a byte */
304
8.78M
      if (bytes_in_buffer == 0) {
305
12
        if (!(*cinfo->src->fill_input_buffer) (cinfo))
306
11
          return FALSE;
307
1
        next_input_byte = cinfo->src->next_input_byte;
308
1
        bytes_in_buffer = cinfo->src->bytes_in_buffer;
309
1
      }
310
8.78M
      bytes_in_buffer--;
311
8.78M
      c = *next_input_byte++;
312
313
      /* If it's 0xFF, check and discard stuffed zero byte */
314
8.78M
      if (c == 0xFF) {
315
        /* Loop here to discard any padding FF's on terminating marker,
316
         * so that we can save a valid unread_marker value.  NOTE: we will
317
         * accept multiple FF's followed by a 0 as meaning a single FF data
318
         * byte.  This data pattern is not valid according to the standard.
319
         */
320
87.4k
        do {
321
87.4k
          if (bytes_in_buffer == 0) {
322
0
            if (!(*cinfo->src->fill_input_buffer) (cinfo))
323
0
              return FALSE;
324
0
            next_input_byte = cinfo->src->next_input_byte;
325
0
            bytes_in_buffer = cinfo->src->bytes_in_buffer;
326
0
          }
327
87.4k
          bytes_in_buffer--;
328
87.4k
          c = *next_input_byte++;
329
87.4k
        } while (c == 0xFF);
330
331
82.3k
        if (c == 0) {
332
          /* Found FF/00, which represents an FF data byte */
333
32.8k
          c = 0xFF;
334
49.5k
        } else {
335
          /* Oops, it's actually a marker indicating end of compressed data.
336
           * Save the marker code for later use.
337
           * Fine point: it might appear that we should save the marker into
338
           * bitread working state, not straight into permanent state.  But
339
           * once we have hit a marker, we cannot need to suspend within the
340
           * current MCU, because we will read no more bytes from the data
341
           * source.  So it is OK to update permanent state right away.
342
           */
343
49.5k
          cinfo->unread_marker = c;
344
          /* See if we need to insert some fake zero bits. */
345
49.5k
          goto no_more_bytes;
346
49.5k
        }
347
82.3k
      }
348
349
      /* OK, load c into get_buffer */
350
8.73M
      get_buffer = (get_buffer << 8) | c;
351
8.73M
      bits_left += 8;
352
8.73M
    } /* end while */
353
1.26M
  } else {
354
336k
no_more_bytes:
355
    /* We get here if we've read the marker that terminates the compressed
356
     * data segment.  There should be enough bits in the buffer register
357
     * to satisfy the request; if so, no problem.
358
     */
359
336k
    if (nbits > bits_left) {
360
      /* Uh-oh.  Report corrupted data to user and stuff zeroes into
361
       * the data stream, so that we can produce some kind of image.
362
       * We use a nonvolatile flag to ensure that only one warning message
363
       * appears per data segment.
364
       */
365
223k
      if (!cinfo->entropy->insufficient_data) {
366
3.54k
        WARNMS(cinfo, JWRN_HIT_MARKER);
367
3.54k
        cinfo->entropy->insufficient_data = TRUE;
368
3.54k
      }
369
      /* Fill the buffer with zero bits */
370
223k
      get_buffer <<= MIN_GET_BITS - bits_left;
371
223k
      bits_left = MIN_GET_BITS;
372
223k
    }
373
336k
  }
374
375
  /* Unload the local registers */
376
1.54M
  state->next_input_byte = next_input_byte;
377
1.54M
  state->bytes_in_buffer = bytes_in_buffer;
378
1.54M
  state->get_buffer = get_buffer;
379
1.54M
  state->bits_left = bits_left;
380
381
1.54M
  return TRUE;
382
1.54M
}
383
384
385
/* Macro version of the above, which performs much better but does not
386
   handle markers.  We have to hand off any blocks with markers to the
387
   slower routines. */
388
389
1.29M
#define GET_BYTE { \
390
1.29M
  register int c0, c1; \
391
1.29M
  c0 = *buffer++; \
392
1.29M
  c1 = *buffer; \
393
1.29M
  /* Pre-execute most common case */ \
394
1.29M
  get_buffer = (get_buffer << 8) | c0; \
395
1.29M
  bits_left += 8; \
396
1.29M
  if (c0 == 0xFF) { \
397
67.4k
    /* Pre-execute case of FF/00, which represents an FF data byte */ \
398
67.4k
    buffer++; \
399
67.4k
    if (c1 != 0) { \
400
58.1k
      /* Oops, it's actually a marker indicating end of compressed data. */ \
401
58.1k
      cinfo->unread_marker = c1; \
402
58.1k
      /* Back out pre-execution and fill the buffer with zero bits */ \
403
58.1k
      buffer -= 2; \
404
58.1k
      get_buffer &= ~0xFF; \
405
58.1k
    } \
406
67.4k
  } \
407
1.29M
}
408
409
#if SIZEOF_SIZE_T == 8 || defined(_WIN64) || (defined(__x86_64__) && defined(__ILP32__))
410
411
/* Pre-fetch 48 bytes, because the holding register is 64-bit */
412
#define FILL_BIT_BUFFER_FAST \
413
3.51M
  if (bits_left <= 16) { \
414
216k
    GET_BYTE GET_BYTE GET_BYTE GET_BYTE GET_BYTE GET_BYTE \
415
216k
  }
416
417
#else
418
419
/* Pre-fetch 16 bytes, because the holding register is 32-bit */
420
#define FILL_BIT_BUFFER_FAST \
421
  if (bits_left <= 16) { \
422
    GET_BYTE GET_BYTE \
423
  }
424
425
#endif
426
427
428
/*
429
 * Out-of-line code for Huffman code decoding.
430
 * See jdhuff.h for info about usage.
431
 */
432
433
GLOBAL(int)
434
jpeg_huff_decode(bitread_working_state *state,
435
                 register bit_buf_type get_buffer, register int bits_left,
436
                 d_derived_tbl *htbl, int min_bits)
437
303k
{
438
303k
  register int l = min_bits;
439
303k
  register JLONG code;
440
441
  /* HUFF_DECODE has determined that the code is at least min_bits */
442
  /* bits long, so fetch that many bits in one swoop. */
443
444
303k
  CHECK_BIT_BUFFER(*state, l, return -1);
445
303k
  code = GET_BITS(l);
446
447
  /* Collect the rest of the Huffman code one bit at a time. */
448
  /* This is per Figure F.16. */
449
450
671k
  while (code > htbl->maxcode[l]) {
451
368k
    code <<= 1;
452
368k
    CHECK_BIT_BUFFER(*state, 1, return -1);
453
368k
    code |= GET_BITS(1);
454
368k
    l++;
455
368k
  }
456
457
  /* Unload the local registers */
458
303k
  state->get_buffer = get_buffer;
459
303k
  state->bits_left = bits_left;
460
461
  /* With garbage input we may reach the sentinel value l = 17. */
462
463
303k
  if (l > 16) {
464
4.05k
    WARNMS(state->cinfo, JWRN_HUFF_BAD_CODE);
465
4.05k
    return 0;                   /* fake a zero as the safest result */
466
4.05k
  }
467
468
299k
  return htbl->pub->huffval[(int)(code + htbl->valoffset[l])];
469
303k
}
470
471
472
/*
473
 * Figure F.12: extend sign bit.
474
 * On some machines, a shift and add will be faster than a table lookup.
475
 */
476
477
#define AVOID_TABLES
478
#ifdef AVOID_TABLES
479
480
13.2M
#define NEG_1  ((unsigned int)-1)
481
#define HUFF_EXTEND(x, s) \
482
13.2M
  ((x) + ((((x) - (1 << ((s) - 1))) >> 31) & (((NEG_1) << (s)) + 1)))
483
484
#else
485
486
#define HUFF_EXTEND(x, s) \
487
  ((x) < extend_test[s] ? (x) + extend_offset[s] : (x))
488
489
static const int extend_test[16] = {   /* entry n is 2**(n-1) */
490
  0, 0x0001, 0x0002, 0x0004, 0x0008, 0x0010, 0x0020, 0x0040, 0x0080,
491
  0x0100, 0x0200, 0x0400, 0x0800, 0x1000, 0x2000, 0x4000
492
};
493
494
static const int extend_offset[16] = { /* entry n is (-1 << n) + 1 */
495
  0, ((-1) << 1) + 1, ((-1) << 2) + 1, ((-1) << 3) + 1, ((-1) << 4) + 1,
496
  ((-1) << 5) + 1, ((-1) << 6) + 1, ((-1) << 7) + 1, ((-1) << 8) + 1,
497
  ((-1) << 9) + 1, ((-1) << 10) + 1, ((-1) << 11) + 1, ((-1) << 12) + 1,
498
  ((-1) << 13) + 1, ((-1) << 14) + 1, ((-1) << 15) + 1
499
};
500
501
#endif /* AVOID_TABLES */
502
503
504
/*
505
 * Check for a restart marker & resynchronize decoder.
506
 * Returns FALSE if must suspend.
507
 */
508
509
LOCAL(boolean)
510
process_restart(j_decompress_ptr cinfo)
511
324k
{
512
324k
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
513
324k
  int ci;
514
515
  /* Throw away any unused bits remaining in bit buffer; */
516
  /* include any full bytes in next_marker's count of discarded bytes */
517
324k
  cinfo->marker->discarded_bytes += entropy->bitstate.bits_left / 8;
518
324k
  entropy->bitstate.bits_left = 0;
519
520
  /* Advance past the RSTn marker */
521
324k
  if (!(*cinfo->marker->read_restart_marker) (cinfo))
522
0
    return FALSE;
523
524
  /* Re-initialize DC predictions to 0 */
525
1.04M
  for (ci = 0; ci < cinfo->comps_in_scan; ci++)
526
718k
    entropy->saved.last_dc_val[ci] = 0;
527
528
  /* Reset restart counter */
529
324k
  entropy->restarts_to_go = cinfo->restart_interval;
530
531
  /* Reset out-of-data flag, unless read_restart_marker left us smack up
532
   * against a marker.  In that case we will end up treating the next data
533
   * segment as empty, and we can avoid producing bogus output pixels by
534
   * leaving the flag set.
535
   */
536
324k
  if (cinfo->unread_marker == 0)
537
47.8k
    entropy->pub.insufficient_data = FALSE;
538
539
324k
  return TRUE;
540
324k
}
541
542
543
#if defined(__has_feature)
544
#if __has_feature(undefined_behavior_sanitizer)
545
__attribute__((no_sanitize("signed-integer-overflow"),
546
               no_sanitize("unsigned-integer-overflow")))
547
#endif
548
#endif
549
LOCAL(boolean)
550
decode_mcu_slow(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
551
251k
{
552
251k
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
553
251k
  BITREAD_STATE_VARS;
554
251k
  int blkn;
555
251k
  savable_state state;
556
  /* Outer loop handles each block in the MCU */
557
558
  /* Load up working state */
559
251k
  BITREAD_LOAD_STATE(cinfo, entropy->bitstate);
560
251k
  state = entropy->saved;
561
562
1.13M
  for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
563
886k
    JBLOCKROW block = MCU_data ? MCU_data[blkn] : NULL;
564
886k
    d_derived_tbl *dctbl = entropy->dc_cur_tbls[blkn];
565
886k
    d_derived_tbl *actbl = entropy->ac_cur_tbls[blkn];
566
886k
    register int s, k, r;
567
568
    /* Decode a single block's worth of coefficients */
569
570
    /* Section F.2.2.1: decode the DC coefficient difference */
571
886k
    HUFF_DECODE(s, br_state, dctbl, return FALSE, label1);
572
886k
    if (s) {
573
786k
      CHECK_BIT_BUFFER(br_state, s, return FALSE);
574
786k
      r = GET_BITS(s);
575
786k
      s = HUFF_EXTEND(r, s);
576
786k
    }
577
578
886k
    if (entropy->dc_needed[blkn]) {
579
      /* Convert DC difference to actual value, update last_dc_val */
580
886k
      int ci = cinfo->MCU_membership[blkn];
581
      /* Certain malformed JPEG images produce repeated DC coefficient
582
       * differences of 2047 or -2047, which causes state.last_dc_val[ci] to
583
       * grow until it overflows or underflows a 32-bit signed integer.  This
584
       * behavior is, to the best of our understanding, innocuous, and it is
585
       * unclear how to work around it without potentially affecting
586
       * performance.  Thus, we (hopefully temporarily) suppress UBSan integer
587
       * overflow errors for this function and decode_mcu_fast().
588
       */
589
886k
      s += state.last_dc_val[ci];
590
886k
      state.last_dc_val[ci] = s;
591
886k
      if (block) {
592
        /* Output the DC coefficient (assumes jpeg_natural_order[0] = 0) */
593
886k
        (*block)[0] = (JCOEF)s;
594
886k
      }
595
886k
    }
596
597
886k
    if (entropy->ac_needed[blkn] && block) {
598
599
      /* Section F.2.2.2: decode the AC coefficients */
600
      /* Since zeroes are skipped, output area must be cleared beforehand */
601
11.6M
      for (k = 1; k < DCTSIZE2; k++) {
602
11.6M
        HUFF_DECODE(s, br_state, actbl, return FALSE, label2);
603
604
11.6M
        r = s >> 4;
605
11.6M
        s &= 15;
606
607
11.6M
        if (s) {
608
10.7M
          k += r;
609
10.7M
          CHECK_BIT_BUFFER(br_state, s, return FALSE);
610
10.7M
          r = GET_BITS(s);
611
10.7M
          s = HUFF_EXTEND(r, s);
612
          /* Output coefficient in natural (dezigzagged) order.
613
           * Note: the extra entries in jpeg_natural_order[] will save us
614
           * if k >= DCTSIZE2, which could happen if the data is corrupted.
615
           */
616
10.7M
          (*block)[jpeg_natural_order[k]] = (JCOEF)s;
617
10.7M
        } else {
618
895k
          if (r != 15)
619
872k
            break;
620
23.1k
          k += 15;
621
23.1k
        }
622
11.6M
      }
623
624
886k
    } else {
625
626
      /* Section F.2.2.2: decode the AC coefficients */
627
      /* In this path we just discard the values */
628
0
      for (k = 1; k < DCTSIZE2; k++) {
629
0
        HUFF_DECODE(s, br_state, actbl, return FALSE, label3);
630
631
0
        r = s >> 4;
632
0
        s &= 15;
633
634
0
        if (s) {
635
0
          k += r;
636
0
          CHECK_BIT_BUFFER(br_state, s, return FALSE);
637
0
          DROP_BITS(s);
638
0
        } else {
639
0
          if (r != 15)
640
0
            break;
641
0
          k += 15;
642
0
        }
643
0
      }
644
0
    }
645
886k
  }
646
647
  /* Completed MCU, so update state */
648
251k
  BITREAD_SAVE_STATE(cinfo, entropy->bitstate);
649
251k
  entropy->saved = state;
650
251k
  return TRUE;
651
251k
}
652
653
654
#if defined(__has_feature)
655
#if __has_feature(undefined_behavior_sanitizer)
656
__attribute__((no_sanitize("signed-integer-overflow"),
657
               no_sanitize("unsigned-integer-overflow")))
658
#endif
659
#endif
660
LOCAL(boolean)
661
decode_mcu_fast(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
662
43.0k
{
663
43.0k
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
664
43.0k
  BITREAD_STATE_VARS;
665
43.0k
  JOCTET *buffer;
666
43.0k
  int blkn;
667
43.0k
  savable_state state;
668
  /* Outer loop handles each block in the MCU */
669
670
  /* Load up working state */
671
43.0k
  BITREAD_LOAD_STATE(cinfo, entropy->bitstate);
672
43.0k
  buffer = (JOCTET *)br_state.next_input_byte;
673
43.0k
  state = entropy->saved;
674
675
153k
  for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
676
110k
    JBLOCKROW block = MCU_data ? MCU_data[blkn] : NULL;
677
110k
    d_derived_tbl *dctbl = entropy->dc_cur_tbls[blkn];
678
110k
    d_derived_tbl *actbl = entropy->ac_cur_tbls[blkn];
679
110k
    register int s, k, r, l;
680
681
110k
    HUFF_DECODE_FAST(s, l, dctbl);
682
110k
    if (s) {
683
91.1k
      FILL_BIT_BUFFER_FAST
684
91.1k
      r = GET_BITS(s);
685
91.1k
      s = HUFF_EXTEND(r, s);
686
91.1k
    }
687
688
110k
    if (entropy->dc_needed[blkn]) {
689
110k
      int ci = cinfo->MCU_membership[blkn];
690
      /* Refer to the comment in decode_mcu_slow() regarding the supression of
691
       * a UBSan integer overflow error in this line of code.
692
       */
693
110k
      s += state.last_dc_val[ci];
694
110k
      state.last_dc_val[ci] = s;
695
110k
      if (block)
696
110k
        (*block)[0] = (JCOEF)s;
697
110k
    }
698
699
110k
    if (entropy->ac_needed[blkn] && block) {
700
701
1.71M
      for (k = 1; k < DCTSIZE2; k++) {
702
1.71M
        HUFF_DECODE_FAST(s, l, actbl);
703
1.71M
        r = s >> 4;
704
1.71M
        s &= 15;
705
706
1.71M
        if (s) {
707
1.60M
          k += r;
708
1.60M
          FILL_BIT_BUFFER_FAST
709
1.60M
          r = GET_BITS(s);
710
1.60M
          s = HUFF_EXTEND(r, s);
711
1.60M
          (*block)[jpeg_natural_order[k]] = (JCOEF)s;
712
1.60M
        } else {
713
105k
          if (r != 15) break;
714
1.68k
          k += 15;
715
1.68k
        }
716
1.71M
      }
717
718
110k
    } else {
719
720
0
      for (k = 1; k < DCTSIZE2; k++) {
721
0
        HUFF_DECODE_FAST(s, l, actbl);
722
0
        r = s >> 4;
723
0
        s &= 15;
724
725
0
        if (s) {
726
0
          k += r;
727
0
          FILL_BIT_BUFFER_FAST
728
0
          DROP_BITS(s);
729
0
        } else {
730
0
          if (r != 15) break;
731
0
          k += 15;
732
0
        }
733
0
      }
734
0
    }
735
110k
  }
736
737
43.0k
  if (cinfo->unread_marker != 0) {
738
2.85k
    cinfo->unread_marker = 0;
739
2.85k
    return FALSE;
740
2.85k
  }
741
742
40.2k
  br_state.bytes_in_buffer -= (buffer - br_state.next_input_byte);
743
40.2k
  br_state.next_input_byte = buffer;
744
40.2k
  BITREAD_SAVE_STATE(cinfo, entropy->bitstate);
745
40.2k
  entropy->saved = state;
746
40.2k
  return TRUE;
747
43.0k
}
748
749
750
/*
751
 * Decode and return one MCU's worth of Huffman-compressed coefficients.
752
 * The coefficients are reordered from zigzag order into natural array order,
753
 * but are not dequantized.
754
 *
755
 * The i'th block of the MCU is stored into the block pointed to by
756
 * MCU_data[i].  WE ASSUME THIS AREA HAS BEEN ZEROED BY THE CALLER.
757
 * (Wholesale zeroing is usually a little faster than retail...)
758
 *
759
 * Returns FALSE if data source requested suspension.  In that case no
760
 * changes have been made to permanent state.  (Exception: some output
761
 * coefficients may already have been assigned.  This is harmless for
762
 * this module, since we'll just re-assign them on the next call.)
763
 */
764
765
30.9M
#define BUFSIZE  (DCTSIZE2 * 8)
766
767
METHODDEF(boolean)
768
decode_mcu(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
769
30.9M
{
770
30.9M
  huff_entropy_ptr entropy = (huff_entropy_ptr)cinfo->entropy;
771
30.9M
  int usefast = 1;
772
773
  /* Process restart marker if needed; may have to suspend */
774
30.9M
  if (cinfo->restart_interval) {
775
13.1M
    if (entropy->restarts_to_go == 0)
776
324k
      if (!process_restart(cinfo))
777
0
        return FALSE;
778
13.1M
    usefast = 0;
779
13.1M
  }
780
781
30.9M
  if (cinfo->src->bytes_in_buffer < BUFSIZE * (size_t)cinfo->blocks_in_MCU ||
782
30.9M
      cinfo->unread_marker != 0)
783
30.6M
    usefast = 0;
784
785
  /* If we've run out of data, just leave the MCU set to zeroes.
786
   * This way, we return uniform gray for the remainder of the segment.
787
   */
788
30.9M
  if (!entropy->pub.insufficient_data) {
789
790
291k
    if (usefast) {
791
43.0k
      if (!decode_mcu_fast(cinfo, MCU_data)) goto use_slow;
792
248k
    } else {
793
251k
use_slow:
794
251k
      if (!decode_mcu_slow(cinfo, MCU_data)) return FALSE;
795
251k
    }
796
797
291k
  }
798
799
  /* Account for restart interval (no-op if not using restarts) */
800
30.9M
  if (cinfo->restart_interval)
801
13.1M
    entropy->restarts_to_go--;
802
803
30.9M
  return TRUE;
804
30.9M
}
805
806
807
/*
808
 * Module initialization routine for Huffman entropy decoding.
809
 */
810
811
GLOBAL(void)
812
jinit_huff_decoder(j_decompress_ptr cinfo)
813
106
{
814
106
  huff_entropy_ptr entropy;
815
106
  int i;
816
817
  /* Motion JPEG frames typically do not include the Huffman tables if they
818
     are the default tables.  Thus, if the tables are not set by the time
819
     the Huffman decoder is initialized (usually within the body of
820
     jpeg_start_decompress()), we set them to default values. */
821
106
  std_huff_tables((j_common_ptr)cinfo);
822
823
106
  entropy = (huff_entropy_ptr)
824
106
    (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
825
106
                                sizeof(huff_entropy_decoder));
826
106
  cinfo->entropy = (struct jpeg_entropy_decoder *)entropy;
827
106
  entropy->pub.start_pass = start_pass_huff_decoder;
828
106
  entropy->pub.decode_mcu = decode_mcu;
829
830
  /* Mark tables unallocated */
831
530
  for (i = 0; i < NUM_HUFF_TBLS; i++) {
832
424
    entropy->dc_derived_tbls[i] = entropy->ac_derived_tbls[i] = NULL;
833
424
  }
834
106
}