1 /* Copyright (C) 2008, 2009 Vincent Penquerc'h.
2    This file is part of the Kate codec library.
3    Written by Vincent Penquerc'h.
4 
5    Use, distribution and reproduction of this library is governed
6    by a BSD style source license included with this source in the
7    file 'COPYING'. Please read these terms before distributing. */
8 
9 
10 #define KATE_INTERNAL
11 #include "kate_internal.h"
12 
13 #ifdef HAVE_STDLIB_H
14 #include <stdlib.h>
15 #endif
16 #ifdef HAVE_STRING_H
17 #include <string.h>
18 #endif
19 #include "kate/kate.h"
20 #include "kate_decode_state.h"
21 #include "kate_fp.h"
22 #include "kate_rle.h"
23 
24 typedef struct kate_memory_guard {
25   size_t size;
26   void **pointers;
27 } kate_memory_guard;
28 
kate_memory_guard_malloc(kate_memory_guard * kmg,size_t size)29 static void *kate_memory_guard_malloc(kate_memory_guard *kmg,size_t size)
30 {
31   void **new_pointers;
32   void *ptr;
33   int ret;
34 
35   ret=kate_check_add_overflow(kmg->size,1,NULL);
36   if (ret<0) return NULL;
37 
38   ptr=kate_malloc(size);
39   if (!ptr) return NULL;
40   new_pointers=(void**)kate_checked_realloc(kmg->pointers,(kmg->size+1),sizeof(void*));
41   if (!new_pointers) {
42     kate_free(ptr);
43     return NULL;
44   }
45   kmg->pointers=new_pointers;
46   kmg->pointers[kmg->size++]=ptr;
47   return ptr;
48 }
49 
kate_memory_guard_checked_malloc(kate_memory_guard * kmg,size_t size1,size_t size2)50 static void *kate_memory_guard_checked_malloc(kate_memory_guard *kmg,size_t size1,size_t size2)
51 {
52   size_t size;
53   int ret=kate_check_mul_overflow(size1,size2,&size);
54   if (ret<0) return NULL;
55   return kate_memory_guard_malloc(kmg,size);
56 }
57 
kate_memory_guard_flush(kate_memory_guard * kmg,int free_pointers)58 static void kate_memory_guard_flush(kate_memory_guard *kmg,int free_pointers)
59 {
60   size_t n;
61   if (free_pointers) {
62     for (n=0;n<kmg->size;++n) kate_free(kmg->pointers[n]);
63   }
64   kmg->size=0;
65 }
66 
kate_memory_guard_destroy(kate_memory_guard * kmg,int free_pointers)67 static void kate_memory_guard_destroy(kate_memory_guard *kmg,int free_pointers)
68 {
69   kate_memory_guard_flush(kmg,free_pointers);
70   if (kmg->pointers) kate_free(kmg->pointers);
71 }
72 
kate_memory_guard_merge(kate_memory_guard * kmg,kate_memory_guard * parent_kmg)73 static int kate_memory_guard_merge(kate_memory_guard *kmg,kate_memory_guard *parent_kmg)
74 {
75   void **new_pointers;
76   int ret;
77   size_t new_size;
78 
79   ret=kate_check_add_overflow(parent_kmg->size,kmg->size,&new_size);
80   if (ret<0) return ret;
81 
82   new_pointers=(void**)kate_checked_realloc(parent_kmg->pointers,new_size,sizeof(void*));
83   if (!new_pointers) {
84     kate_memory_guard_destroy(kmg,1);
85     return KATE_E_OUT_OF_MEMORY;
86   }
87   parent_kmg->pointers=new_pointers;
88   memcpy(parent_kmg->pointers+parent_kmg->size,kmg->pointers,kmg->size*sizeof(void*));
89   parent_kmg->size=new_size;
90   kate_memory_guard_destroy(kmg,0);
91   return 0;
92 }
93 
94 #define KMG_GUARD() kate_memory_guard kmg={0,NULL}
95 #define KMG_MALLOC(size) kate_memory_guard_malloc(&kmg,size)
96 #define KMG_CHECKED_MALLOC(size1,size2) kate_memory_guard_checked_malloc(&kmg,size1,size2)
97 #define KMG_MERGE(parent_kmg) kate_memory_guard_merge(&kmg,parent_kmg)
98 #define KMG_ERROR(ret) (kate_memory_guard_destroy(&kmg,1),ret)
99 #define KMG_OK() (kate_memory_guard_destroy(&kmg,0),0)
100 #define KMG_FLUSH(free_pointers) kate_memory_guard_flush(&kmg,free_pointers)
101 
102 
103 
kate_readbuf(kate_pack_buffer * kpb,char * s,int len)104 static int kate_readbuf(kate_pack_buffer *kpb,char *s,int len)
105 {
106   if (len<0) return KATE_E_INVALID_PARAMETER;
107   if ((kate_pack_readable_bits(kpb)+7)/8<len) return KATE_E_BAD_PACKET;
108   while (len--) *s++=kate_pack_read(kpb,8);
109   return 0;
110 }
111 
kate_read32(kate_pack_buffer * kpb)112 static kate_int32_t kate_read32(kate_pack_buffer *kpb)
113 {
114   kate_int32_t v=0;
115   v|=kate_pack_read(kpb,8);
116   v|=(kate_pack_read(kpb,8)<<8);
117   v|=(kate_pack_read(kpb,8)<<16);
118   v|=(kate_pack_read(kpb,8)<<24);
119   return v;
120 }
121 
kate_read32v(kate_pack_buffer * kpb)122 static kate_int32_t kate_read32v(kate_pack_buffer *kpb)
123 {
124   /* an error (negative) will be returned as negative, propagating the error
125      to the caller even though the expected range for 4 bits is 0-15 */
126   int smallv=kate_pack_read(kpb,4);
127   if (smallv==15) {
128     int sign=kate_pack_read1(kpb);
129     int bits=kate_pack_read(kpb,5)+1;
130     kate_int32_t v=kate_pack_read(kpb,bits);
131     if (sign) v=-v;
132     return v;
133   }
134   else return smallv;
135 }
136 
kate_read64(kate_pack_buffer * kpb)137 static kate_int64_t kate_read64(kate_pack_buffer *kpb)
138 {
139   kate_int32_t vl=kate_read32(kpb);
140   kate_int32_t vh=kate_read32(kpb);
141   return (0xffffffff&(kate_int64_t)vl)|(((kate_int64_t)vh)<<32);
142 }
143 
kate_overread(kate_pack_buffer * kpb)144 static int kate_overread(kate_pack_buffer *kpb)
145 {
146   return kate_pack_look(kpb,0)<0;
147 }
148 
kate_warp(kate_pack_buffer * kpb)149 static int kate_warp(kate_pack_buffer *kpb)
150 {
151   while (1) {
152     kate_int32_t bits=kate_read32v(kpb);
153     if (!bits) break;
154     if (bits<0) return KATE_E_BAD_PACKET;
155     kate_pack_adv(kpb,bits);
156   }
157   return 0;
158 }
159 
kate_read_metadata(kate_pack_buffer * kpb,kate_meta ** km)160 static int kate_read_metadata(kate_pack_buffer *kpb,kate_meta **km)
161 {
162   KMG_GUARD();
163   kate_meta *tmp;
164   size_t n,nmeta;
165   char *tag,*value;
166   int len;
167   int ret;
168 
169   *km=NULL;
170   if (!kate_pack_read1(kpb)) return 0;
171 
172   ret=kate_meta_create(&tmp);
173   if (ret<0) return ret;
174   nmeta=kate_read32v(kpb);
175   for (n=0;n<nmeta;++n) {
176     len=kate_read32v(kpb);
177     if (len<=0) goto error_bad_packet;
178     tag=(char*)KMG_MALLOC(len+1);
179     if (!tag) goto error_out_of_memory;
180     kate_readbuf(kpb,tag,len);
181     tag[len]=0;
182 
183     len=kate_read32v(kpb);
184     if (len<=0) goto error_bad_packet;
185     value=(char*)KMG_MALLOC(len+1);
186     if (!value) goto error_out_of_memory;
187     kate_readbuf(kpb,value,len);
188     value[len]=0;
189 
190     kate_warp(kpb);
191 
192     ret=kate_meta_add(tmp,tag,value,len);
193     if (ret<0) goto error;
194 
195     KMG_FLUSH(1); /* TODO: unnecessary temporary allocations */
196   }
197 
198   kate_warp(kpb);
199 
200   *km=tmp;
201   return KMG_OK();
202 
203 error_bad_packet:
204   ret=KATE_E_BAD_PACKET;
205   goto error;
206 
207 error_out_of_memory:
208   ret=KATE_E_OUT_OF_MEMORY;
209   goto error;
210 
211 error:
212   kate_meta_destroy(tmp);
213   return KMG_ERROR(ret);
214 }
215 
kate_decode_check_magic(kate_pack_buffer * kpb)216 static int kate_decode_check_magic(kate_pack_buffer *kpb)
217 {
218   char magic[8];
219   int ret;
220 
221   if (!kpb) return KATE_E_INVALID_PARAMETER;
222 
223   ret=kate_readbuf(kpb,magic,7);
224   if (ret<0) return KATE_E_NOT_KATE;
225   if (memcmp(magic,"kate\0\0\0",7)) return KATE_E_NOT_KATE;
226 
227   return 0;
228 }
229 
230 /**
231   \ingroup decoding
232   Checks if a packet is a Kate ID header
233   \param kp the packet to inspect
234   \returns 0 the packet is not an ID header
235   \returns !=0 the packet is an ID header
236   */
kate_decode_is_idheader(const kate_packet * kp)237 int kate_decode_is_idheader(const kate_packet *kp)
238 {
239   kate_pack_buffer kpb;
240   unsigned char headerid;
241 
242   if (!kp) return 0;
243 
244   kate_pack_readinit(&kpb,kp->data,kp->nbytes);
245   headerid=kate_pack_read(&kpb,8);
246   if (headerid!=0x80) return 0;
247 
248   return !kate_decode_check_magic(&kpb);
249 }
250 
kate_check_eop(kate_pack_buffer * kpb)251 static int kate_check_eop(kate_pack_buffer *kpb)
252 {
253   int bits;
254 
255   if (!kpb) return KATE_E_INVALID_PARAMETER;
256 
257   /* ensure any remaining bits in the current byte are zero (reading 0 bytes yields zero) */
258   bits=7&(8-(kate_pack_bits(kpb)&7));
259   if (bits>0) {
260     if (kate_pack_read(kpb,bits)) return KATE_E_BAD_PACKET;
261   }
262   if (kate_pack_look1(kpb)>=0) return KATE_E_BAD_PACKET; /* no more data expected */
263 
264   return 0;
265 }
266 
kate_decode_read_canvas_size(kate_pack_buffer * kpb)267 static int kate_decode_read_canvas_size(kate_pack_buffer *kpb)
268 {
269   size_t base,shift;
270 
271   if (!kpb) return KATE_E_INVALID_PARAMETER;
272 
273   shift=kate_pack_read(kpb,4);
274   base=kate_pack_read(kpb,4);
275   base|=(kate_pack_read(kpb,8)<<4);
276 
277   return base<<shift;
278 }
279 
280 #define KATE_IS_BITSTREAM_LOE(major,minor) (major)
281 
kate_decode_info_header(kate_info * ki,kate_pack_buffer * kpb)282 static int kate_decode_info_header(kate_info *ki,kate_pack_buffer *kpb)
283 {
284   KMG_GUARD();
285   int len;
286   int ret;
287   char *language,*category;
288   int reserved;
289 
290   if (!ki || !kpb) return KMG_ERROR(KATE_E_INVALID_PARAMETER);
291 
292   ki->bitstream_version_major=kate_pack_read(kpb,8);
293   ki->bitstream_version_minor=kate_pack_read(kpb,8);
294   if (ki->bitstream_version_major>KATE_BITSTREAM_VERSION_MAJOR) return KMG_ERROR(KATE_E_VERSION);
295 
296   ki->num_headers=kate_pack_read(kpb,8);
297   if (ki->num_headers<1) return KMG_ERROR(KATE_E_BAD_PACKET);
298   ki->text_encoding=kate_pack_read(kpb,8);
299   ki->text_directionality=kate_pack_read(kpb,8);
300   reserved=kate_pack_read(kpb,8);
301   if (ki->bitstream_version_major==0 && ki->bitstream_version_minor<3) {
302     if (reserved!=0) return KMG_ERROR(KATE_E_BAD_PACKET); /* reserved - 0 */
303   }
304   ki->granule_shift=kate_pack_read(kpb,8);
305 
306   ret=kate_decode_read_canvas_size(kpb);
307   if (ret<0) return KMG_ERROR(KATE_E_BAD_PACKET);
308   ki->original_canvas_width=ret;
309   ret=kate_decode_read_canvas_size(kpb);
310   if (ret<0) return KMG_ERROR(KATE_E_BAD_PACKET);
311   ki->original_canvas_height=ret;
312 
313   reserved=kate_read32(kpb);
314   if (ki->bitstream_version_major==0 && ki->bitstream_version_minor<3) {
315     if (reserved!=0) return KMG_ERROR(KATE_E_BAD_PACKET); /* reserved - 0 */
316   }
317 
318   ki->gps_numerator=kate_read32(kpb);
319   ki->gps_denominator=kate_read32(kpb);
320 
321   if (ki->granule_shift>=64) return KMG_ERROR(KATE_E_BAD_PACKET);
322   if (ki->gps_numerator==0) return KMG_ERROR(KATE_E_BAD_PACKET);
323   if (ki->gps_denominator==0) return KMG_ERROR(KATE_E_BAD_PACKET);
324   /*
325   should not be needed anymore, calculations on these should be ok with full 32 bit range
326   if ((ki->gps_numerator^ki->gps_denominator)<0) return KMG_ERROR(KATE_E_BAD_PACKET);
327   */
328 
329   len=16;
330   language=(char*)KMG_MALLOC(len);
331   if (!language) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
332   ret=kate_readbuf(kpb,language,len); /* a terminating null is included */
333   if (ret<0) return KMG_ERROR(ret);
334   if (language[len-1]) return KMG_ERROR(KATE_E_BAD_PACKET); /* but do check it to be sure */
335 
336   len=16;
337   category=(char*)KMG_MALLOC(len);
338   if (!category) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
339   ret=kate_readbuf(kpb,category,len); /* a terminating null is included */
340   if (ret<0) return KMG_ERROR(ret);
341   if (category[len-1]) return KMG_ERROR(KATE_E_BAD_PACKET); /* but do check it to be sure */
342 
343   ret=kate_check_eop(kpb);
344   if (ret<0) return KMG_ERROR(ret);
345 
346   ki->language=language;
347   ki->category=category;
348 
349   return KMG_OK();
350 }
351 
kate_decode_comment_packet(const kate_info * ki,kate_comment * kc,kate_pack_buffer * kpb)352 static int kate_decode_comment_packet(const kate_info *ki,kate_comment *kc,kate_pack_buffer *kpb)
353 {
354   KMG_GUARD();
355   int ret,len,nc;
356   char **user_comments,*vendor;
357   int comments,*comment_lengths;
358 
359   if (!ki || !kc || !kpb) return KMG_ERROR(KATE_E_INVALID_PARAMETER);
360 
361   len=kate_read32(kpb);
362   if (len<0) return KMG_ERROR(KATE_E_BAD_PACKET);
363   if (!ki->no_limits && len>KATE_LIMIT_COMMENT_LENGTH) return KMG_ERROR(KATE_E_LIMIT);
364   vendor=(char*)KMG_MALLOC(len+1);
365   if (!vendor) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
366   ret=kate_readbuf(kpb,vendor,len);
367   if (ret<0) return KMG_ERROR(ret);
368   vendor[len]=0;
369 
370   comments=kate_read32(kpb);
371   if (comments<0) return KMG_ERROR(KATE_E_BAD_PACKET);
372   if (!ki->no_limits && len>KATE_LIMIT_COMMENTS) return KMG_ERROR(KATE_E_LIMIT);
373   user_comments=(char**)KMG_CHECKED_MALLOC(comments,sizeof(char*));
374   comment_lengths=(int*)KMG_CHECKED_MALLOC(comments,sizeof(int));
375   if (!user_comments || !comment_lengths) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
376 
377   for (nc=0;nc<comments;++nc) user_comments[nc]=NULL;
378   for (nc=0;nc<comments;++nc) {
379     len=kate_read32(kpb);
380     if (len<0) return KMG_ERROR(KATE_E_BAD_PACKET);
381     if (!ki->no_limits && len>KATE_LIMIT_COMMENT_LENGTH) return KMG_ERROR(KATE_E_LIMIT);
382     user_comments[nc]=(char*)KMG_MALLOC(len+1);
383     if (!user_comments[nc]) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
384     if (len) {
385       ret=kate_readbuf(kpb,user_comments[nc],len);
386       if (ret<0) return KMG_ERROR(ret);
387     }
388     user_comments[nc][len]=0;
389     comment_lengths[nc]=len;
390   }
391 
392   ret=kate_check_eop(kpb);
393   if (ret<0) return KMG_ERROR(ret);
394 
395   kc->user_comments=user_comments;
396   kc->comment_lengths=comment_lengths;
397   kc->comments=comments;
398   kc->vendor=vendor;
399 
400   return KMG_OK();
401 }
402 
kate_decode_region(const kate_info * ki,kate_region * kr,kate_pack_buffer * kpb)403 static int kate_decode_region(const kate_info *ki,kate_region *kr,kate_pack_buffer *kpb)
404 {
405   int ret;
406 
407   if (!kr || !kpb) return KATE_E_INVALID_PARAMETER;
408 
409   kr->metric=kate_pack_read(kpb,8);
410   kr->x=kate_read32v(kpb);
411   kr->y=kate_read32v(kpb);
412   kr->w=kate_read32v(kpb);
413   kr->h=kate_read32v(kpb);
414   kr->style=kate_read32v(kpb);
415 
416   if (((ki->bitstream_version_major<<8)|ki->bitstream_version_minor)>=0x0002) {
417     /* 0.2 adds a warp for clip */
418     kate_read32v(kpb); /* the size of the warp */
419     kr->clip=kate_pack_read1(kpb);
420   }
421   else {
422     kr->clip=0;
423   }
424 
425   if (((ki->bitstream_version_major<<8)|ki->bitstream_version_minor)>=0x0006) {
426     /* 0.6 adds a warp for metadata */
427     kate_read32v(kpb); /* the size of the warp */
428     ret=kate_read_metadata(kpb,&kr->meta);
429     if (ret<0) return ret;
430   }
431   else {
432     kr->meta=NULL;
433   }
434 
435   return kate_warp(kpb);
436 }
437 
kate_decode_regions_packet(kate_info * ki,kate_pack_buffer * kpb)438 static int kate_decode_regions_packet(kate_info *ki,kate_pack_buffer *kpb)
439 {
440   KMG_GUARD();
441   int ret,n,nregions;
442   kate_region **regions;
443 
444   if (!ki || !kpb) return KMG_ERROR(KATE_E_INVALID_PARAMETER);
445 
446   nregions=kate_read32v(kpb);
447   if (nregions<0) return KMG_ERROR(KATE_E_BAD_PACKET);
448   if (!ki->no_limits && nregions>KATE_LIMIT_REGIONS) return KMG_ERROR(KATE_E_LIMIT);
449   regions=(kate_region**)KMG_CHECKED_MALLOC(nregions,sizeof(kate_region*));
450   if (!regions) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
451   for (n=0;n<nregions;++n) {
452     regions[n]=(kate_region*)KMG_MALLOC(sizeof(kate_region));
453     if (!regions[n]) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
454     ret=kate_decode_region(ki,regions[n],kpb);
455     if (kate_overread(kpb)) return KMG_ERROR(KATE_E_BAD_PACKET);
456     if (ret<0) return KMG_ERROR(ret);
457   }
458 
459   ret=kate_warp(kpb);
460   if (ret<0) return KMG_ERROR(ret);
461 
462   ret=kate_check_eop(kpb);
463   if (ret<0) return KMG_ERROR(ret);
464 
465   ki->nregions=nregions;
466   ki->regions=regions;
467 
468   return KMG_OK();
469 }
470 
kate_decode_color(kate_color * kc,kate_pack_buffer * kpb)471 static int kate_decode_color(kate_color *kc,kate_pack_buffer *kpb)
472 {
473   if (!kc || !kpb) return KATE_E_INVALID_PARAMETER;
474   kc->r=kate_pack_read(kpb,8);
475   kc->g=kate_pack_read(kpb,8);
476   kc->b=kate_pack_read(kpb,8);
477   kc->a=kate_pack_read(kpb,8);
478   return 0;
479 }
480 
kate_decode_style(const kate_info * ki,kate_style * ks,kate_pack_buffer * kpb,kate_memory_guard * parent_kmg)481 static int kate_decode_style(const kate_info *ki,kate_style *ks,kate_pack_buffer *kpb,kate_memory_guard *parent_kmg)
482 {
483   KMG_GUARD();
484   int ret;
485   kate_float d[8];
486   size_t idx;
487   int len;
488 
489   if (!ks || !kpb) return KMG_ERROR(KATE_E_INVALID_PARAMETER);
490 
491   ret=kate_fp_decode_kate_float(sizeof(d)/sizeof(d[0]),d,1,kpb);
492   if (ret<0) return KMG_ERROR(ret);
493 
494   idx=0;
495   ks->halign=d[idx++];
496   ks->valign=d[idx++];
497   ks->font_width=d[idx++];
498   ks->font_height=d[idx++];
499   ks->left_margin=d[idx++];
500   ks->top_margin=d[idx++];
501   ks->right_margin=d[idx++];
502   ks->bottom_margin=d[idx++];
503   ret=kate_decode_color(&ks->text_color,kpb);
504   if (ret<0) return KMG_ERROR(ret);
505   ret=kate_decode_color(&ks->background_color,kpb);
506   if (ret<0) return KMG_ERROR(ret);
507   ret=kate_decode_color(&ks->draw_color,kpb);
508   if (ret<0) return KMG_ERROR(ret);
509   ks->font_metric=kate_pack_read(kpb,8);
510   ks->margin_metric=kate_pack_read(kpb,8);
511   ks->bold=kate_pack_read1(kpb);
512   ks->italics=kate_pack_read1(kpb);
513   ks->underline=kate_pack_read1(kpb);
514   ks->strike=kate_pack_read1(kpb);
515 
516   if (((ki->bitstream_version_major<<8)|ki->bitstream_version_minor)>=0x0002) {
517     /* 0.2 adds a warp for justify and font */
518     kate_read32v(kpb); /* the size of the warp */
519     ks->justify=kate_pack_read1(kpb);
520     len=kate_read32v(kpb);
521     if (len<0) {
522       return KMG_ERROR(KATE_E_BAD_PACKET);
523     }
524     else if (len>0) {
525       ks->font=(char*)KMG_MALLOC(len+1);
526       if (!ks->font) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
527       ret=kate_readbuf(kpb,ks->font,len);
528       if (ret<0) return KMG_ERROR(ret);
529       ks->font[len]=0;
530     }
531     else {
532       ks->font=NULL;
533     }
534   }
535   else {
536     ks->justify=0;
537     ks->font=NULL;
538   }
539 
540   if (((ki->bitstream_version_major<<8)|ki->bitstream_version_minor)>=0x0004) {
541     /* 0.4 adds a warp for wrap mode */
542     kate_read32v(kpb); /* the size of the warp */
543     ks->wrap_mode=kate_read32v(kpb);
544   }
545   else {
546     ks->wrap_mode=kate_wrap_word;
547   }
548 
549   if (((ki->bitstream_version_major<<8)|ki->bitstream_version_minor)>=0x0006) {
550     /* 0.6 adds a warp for metadata */
551     kate_read32v(kpb); /* the size of the warp */
552     ret=kate_read_metadata(kpb,&ks->meta);
553     if (ret<0) return KMG_ERROR(ret);
554   }
555   else {
556     ks->meta=NULL;
557   }
558 
559   ret=kate_warp(kpb);
560   if (ret<0) return KMG_ERROR(ret);
561 
562   return KMG_MERGE(parent_kmg);
563 }
564 
kate_decode_styles_packet(kate_info * ki,kate_pack_buffer * kpb)565 static int kate_decode_styles_packet(kate_info *ki,kate_pack_buffer *kpb)
566 {
567   KMG_GUARD();
568   int ret,n,nstyles;
569   kate_style **styles;
570 
571   if (!ki || !kpb) return KMG_ERROR(KATE_E_INVALID_PARAMETER);
572 
573   nstyles=kate_read32v(kpb);
574   if (nstyles<0) return KMG_ERROR(KATE_E_BAD_PACKET);
575   if (!ki->no_limits && nstyles>KATE_LIMIT_STYLES) return KMG_ERROR(KATE_E_LIMIT);
576   styles=(kate_style**)KMG_CHECKED_MALLOC(nstyles,sizeof(kate_style*));
577   if (!styles) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
578   for (n=0;n<nstyles;++n) {
579     styles[n]=(kate_style*)KMG_MALLOC(sizeof(kate_style));
580     if (!styles[n]) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
581     ret=kate_decode_style(ki,styles[n],kpb,&kmg);
582     if (kate_overread(kpb)) return KMG_ERROR(KATE_E_BAD_PACKET);
583     if (ret<0) return KMG_ERROR(ret);
584   }
585 
586   ret=kate_warp(kpb);
587   if (ret<0) return KMG_ERROR(ret);
588 
589   ret=kate_check_eop(kpb);
590   if (ret<0) return KMG_ERROR(ret);
591 
592   ki->nstyles=nstyles;
593   ki->styles=styles;
594 
595   return KMG_OK();
596 }
597 
kate_decode_curve(const kate_info * ki,kate_curve * kc,kate_pack_buffer * kpb,kate_memory_guard * parent_kmg)598 static int kate_decode_curve(const kate_info *ki,kate_curve *kc,kate_pack_buffer *kpb,kate_memory_guard *parent_kmg)
599 {
600   KMG_GUARD();
601   int ret;
602 
603   if (!ki || !kc || !kpb) return KMG_ERROR(KATE_E_INVALID_PARAMETER);
604 
605   kc->type=kate_pack_read(kpb,8);
606   kc->npts=kate_read32v(kpb);
607   ret=kate_warp(kpb);
608   if (ret<0) return KMG_ERROR(ret);
609   if (!ki->no_limits && kc->npts>KATE_LIMIT_CURVE_POINTS) return KMG_ERROR(KATE_E_LIMIT);
610   kc->pts=(kate_float*)KMG_CHECKED_MALLOC(kc->npts,2*sizeof(kate_float));
611   if (!kc->pts) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
612 
613   ret=kate_fp_decode_kate_float(kc->npts,kc->pts,2,kpb);
614   if (ret<0) return KMG_ERROR(ret);
615 
616   /* on success, add our memory to the parent guard */
617   return KMG_MERGE(parent_kmg);
618 }
619 
kate_decode_curves_packet(kate_info * ki,kate_pack_buffer * kpb)620 static int kate_decode_curves_packet(kate_info *ki,kate_pack_buffer *kpb)
621 {
622   KMG_GUARD();
623   int ret,n,ncurves;
624   kate_curve **curves=NULL;
625 
626   if (!ki || !kpb) return KMG_ERROR(KATE_E_INVALID_PARAMETER);
627 
628   ncurves=kate_read32v(kpb);
629   if (ncurves<0) return KMG_ERROR(KATE_E_BAD_PACKET);
630   if (!ki->no_limits && ncurves>KATE_LIMIT_CURVES) return KMG_ERROR(KATE_E_LIMIT);
631 
632   if (ncurves>0) {
633     curves=(kate_curve**)KMG_CHECKED_MALLOC(ncurves,sizeof(kate_curve*));
634     if (!curves) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
635     for (n=0;n<ncurves;++n) {
636       curves[n]=(kate_curve*)KMG_MALLOC(sizeof(kate_curve));
637       if (!curves[n]) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
638       ret=kate_decode_curve(ki,curves[n],kpb,&kmg);
639       if (kate_overread(kpb)) return KMG_ERROR(KATE_E_BAD_PACKET);
640       if (ret<0) return KMG_ERROR(ret);
641     }
642   }
643 
644   ret=kate_warp(kpb);
645   if (ret<0) return KMG_ERROR(ret);
646 
647   ret=kate_check_eop(kpb);
648   if (ret<0) return KMG_ERROR(ret);
649 
650   ki->ncurves=ncurves;
651   ki->curves=curves;
652 
653   return KMG_OK();
654 }
655 
kate_decode_motion(const kate_info * ki,kate_motion * km,kate_pack_buffer * kpb,kate_memory_guard * parent_kmg)656 static int kate_decode_motion(const kate_info *ki,kate_motion *km,kate_pack_buffer *kpb,kate_memory_guard *parent_kmg)
657 {
658   KMG_GUARD();
659   size_t n;
660   int ret;
661 
662   if (!ki || !km || !kpb) return KMG_ERROR(KATE_E_INVALID_PARAMETER);
663 
664   km->ncurves=kate_read32v(kpb);
665   if (!ki->no_limits && km->ncurves>KATE_LIMIT_MOTION_CURVES) return KMG_ERROR(KATE_E_LIMIT);
666   km->curves=(kate_curve**)KMG_CHECKED_MALLOC(km->ncurves,sizeof(kate_curve*));
667   if (!km->curves) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
668   km->durations=(kate_float*)KMG_CHECKED_MALLOC(km->ncurves,sizeof(kate_float));
669   if (!km->durations) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
670 
671   for (n=0;n<km->ncurves;++n) {
672     if (kate_pack_read1(kpb)) {
673       size_t idx=kate_read32v(kpb);
674       if (idx>=ki->ncurves) return KMG_ERROR(KATE_E_BAD_PACKET);
675       km->curves[n]=ki->curves[idx];
676     }
677     else {
678       km->curves[n]=(kate_curve*)KMG_MALLOC(sizeof(kate_curve));
679       if (!km->curves[n]) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
680       ret=kate_decode_curve(ki,km->curves[n],kpb,&kmg);
681       if (kate_overread(kpb)) return KMG_ERROR(KATE_E_BAD_PACKET);
682       if (ret<0) return KMG_ERROR(ret);
683     }
684   }
685   ret=kate_fp_decode_kate_float(km->ncurves,km->durations,1,kpb);
686   if (ret<0) return KMG_ERROR(ret);
687   km->x_mapping=kate_pack_read(kpb,8);
688   km->y_mapping=kate_pack_read(kpb,8);
689   km->semantics=kate_pack_read(kpb,8);
690   km->periodic=kate_pack_read1(kpb);
691 
692   if (((ki->bitstream_version_major<<8)|ki->bitstream_version_minor)>=0x0006) {
693     /* 0.6 adds a warp for metadata */
694     kate_read32v(kpb); /* the size of the warp */
695     ret=kate_read_metadata(kpb,&km->meta);
696     if (ret<0) return KMG_ERROR(ret);
697   }
698   else {
699     km->meta=NULL;
700   }
701 
702   ret=kate_warp(kpb);
703   if (ret<0) return KMG_ERROR(ret);
704 
705   return KMG_MERGE(parent_kmg);
706 }
707 
kate_decode_motions_packet(kate_info * ki,kate_pack_buffer * kpb)708 static int kate_decode_motions_packet(kate_info *ki,kate_pack_buffer *kpb)
709 {
710   KMG_GUARD();
711   int ret,n,nmotions;
712   kate_motion **motions=NULL;
713 
714   if (!ki || !kpb) return KMG_ERROR(KATE_E_INVALID_PARAMETER);
715 
716   nmotions=kate_read32v(kpb);
717   if (nmotions<0) return KMG_ERROR(KATE_E_BAD_PACKET);
718   if (!ki->no_limits && nmotions>KATE_LIMIT_MOTIONS) return KMG_ERROR(KATE_E_LIMIT);
719 
720   if (nmotions>0) {
721     motions=(kate_motion**)KMG_CHECKED_MALLOC(nmotions,sizeof(kate_motion*));
722     if (!motions) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
723     for (n=0;n<nmotions;++n) {
724       motions[n]=(kate_motion*)KMG_MALLOC(sizeof(kate_motion));
725       if (!motions[n]) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
726       ret=kate_decode_motion(ki,motions[n],kpb,&kmg);
727       if (kate_overread(kpb)) return KMG_ERROR(KATE_E_BAD_PACKET);
728       if (ret<0) return KMG_ERROR(ret);
729     }
730   }
731 
732   ret=kate_warp(kpb);
733   if (ret<0) return KMG_ERROR(ret);
734 
735   ret=kate_check_eop(kpb);
736   if (ret<0) return KMG_ERROR(ret);
737 
738   ki->nmotions=nmotions;
739   ki->motions=motions;
740 
741   return KMG_OK();
742 }
743 
kate_decode_palette(const kate_info * ki,kate_palette * kp,kate_pack_buffer * kpb)744 static int kate_decode_palette(const kate_info *ki,kate_palette *kp,kate_pack_buffer *kpb)
745 {
746   kate_color *colors;
747   size_t n;
748   int ret;
749 
750   if (!ki || !kp || !kpb) return KATE_E_INVALID_PARAMETER;
751 
752   kp->ncolors=kate_pack_read(kpb,8)+1;
753 
754   colors=(kate_color*)kate_checked_malloc(kp->ncolors,sizeof(kate_color));
755   if (!colors) return KATE_E_OUT_OF_MEMORY;
756 
757   for (n=0;n<kp->ncolors;++n) {
758     ret=kate_decode_color(colors+n,kpb);
759     if (kate_overread(kpb)) {
760       kate_free(colors);
761       return ret;
762     }
763     if (ret<0) {
764       kate_free(colors);
765       return ret;
766     }
767   }
768 
769   if (((ki->bitstream_version_major<<8)|ki->bitstream_version_minor)>=0x0006) {
770     /* 0.6 adds a warp for metadata */
771     kate_read32v(kpb); /* the size of the warp */
772     ret=kate_read_metadata(kpb,&kp->meta);
773     if (ret<0) return ret;
774   }
775   else {
776     kp->meta=NULL;
777   }
778 
779   ret=kate_warp(kpb);
780   if (ret<0) return ret;
781 
782   kp->colors=colors;
783 
784   return 0;
785 }
786 
kate_decode_palettes_packet(kate_info * ki,kate_pack_buffer * kpb)787 static int kate_decode_palettes_packet(kate_info *ki,kate_pack_buffer *kpb)
788 {
789   KMG_GUARD();
790   int ret,n,npalettes;
791   kate_palette **palettes=NULL;
792 
793   if (!ki || !kpb) return KMG_ERROR(KATE_E_INVALID_PARAMETER);
794 
795   npalettes=kate_read32v(kpb);
796   if (npalettes<0) return KMG_ERROR(KATE_E_BAD_PACKET);
797   if (!ki->no_limits && npalettes>KATE_LIMIT_PALETTES) return KMG_ERROR(KATE_E_LIMIT);
798 
799   if (npalettes>0) {
800     palettes=(kate_palette**)KMG_CHECKED_MALLOC(npalettes,sizeof(kate_palette*));
801     if (!palettes) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
802     for (n=0;n<npalettes;++n) {
803       palettes[n]=(kate_palette*)KMG_MALLOC(sizeof(kate_palette));
804       if (!palettes[n]) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
805       ret=kate_decode_palette(ki,palettes[n],kpb);
806       if (kate_overread(kpb)) return KMG_ERROR(ret);
807       if (ret<0) return KMG_ERROR(ret);
808     }
809   }
810 
811   ret=kate_warp(kpb);
812   if (ret<0) return KMG_ERROR(ret);
813 
814   ret=kate_check_eop(kpb);
815   if (ret<0) return KMG_ERROR(ret);
816 
817   ki->npalettes=npalettes;
818   ki->palettes=palettes;
819 
820   return KMG_OK();
821 }
822 
kate_decode_bitmap(const kate_info * ki,kate_bitmap * kb,kate_pack_buffer * kpb)823 static int kate_decode_bitmap(const kate_info *ki,kate_bitmap *kb,kate_pack_buffer *kpb)
824 {
825   size_t n,npixels;
826   unsigned char *pixels;
827   int ret,encoding;
828 
829   if (!ki || !kb || !kpb) return KATE_E_INVALID_PARAMETER;
830 
831   kb->width=kate_read32v(kpb);
832   kb->height=kate_read32v(kpb);
833   kb->bpp=kate_pack_read(kpb,8);
834   if (kb->width<=0 || kb->height<=0 || kb->bpp>8) return KATE_E_BAD_PACKET;
835   if (!ki->no_limits && (kb->width>KATE_LIMIT_BITMAP_SIZE || kb->height>KATE_LIMIT_BITMAP_SIZE)) return KATE_E_LIMIT;
836 
837   if (kb->bpp==0) {
838     /* raw bitmap */
839     kb->type=kate_pack_read(kpb,8);
840     kb->palette=-1;
841     switch (kb->type) {
842       case kate_bitmap_type_paletted:
843         encoding=kate_pack_read(kpb,8);
844         switch (encoding) {
845           case 1: /* RLE encoded */
846             kb->bpp=kate_read32v(kpb);
847             kb->palette=kate_read32v(kpb);
848             pixels=(unsigned char*)kate_checked_malloc(kb->width,kb->height);
849             if (!pixels) return KATE_E_OUT_OF_MEMORY;
850             ret=kate_rle_decode(kb->width,kb->height,pixels,kb->bpp,kpb);
851             if (ret<0) return ret;
852             break;
853           default:
854             return KATE_E_BAD_PACKET;
855         }
856         break;
857       case kate_bitmap_type_png:
858         kb->size=kate_read32(kpb);
859         if (!ki->no_limits && kb->size>KATE_LIMIT_BITMAP_RAW_SIZE) return KATE_E_LIMIT;
860         pixels=(unsigned char*)kate_malloc(kb->size);
861         if (!pixels) return KATE_E_OUT_OF_MEMORY;
862         ret=kate_readbuf(kpb,(char*)pixels,kb->size);
863         if (ret<0) {
864           kate_free(pixels);
865           return ret;
866         }
867         break;
868       default:
869         return KATE_E_BAD_PACKET;
870     }
871   }
872   else {
873     /* paletted bitmap */
874     kb->type=kate_bitmap_type_paletted;
875     kb->palette=kate_read32v(kpb);
876 
877     ret=kate_check_mul_overflow(kb->width,kb->height,&npixels);
878     if (ret<0) return ret;
879     pixels=(unsigned char*)kate_malloc(npixels);
880     if (!pixels) return KATE_E_OUT_OF_MEMORY;
881     if ((size_t)kate_pack_bits(kpb)<npixels*kb->bpp) {
882       kate_free(pixels);
883       return KATE_E_BAD_PACKET;
884     }
885 
886     for (n=0;n<npixels;++n) {
887       pixels[n]=kate_pack_read(kpb,kb->bpp);
888     }
889     if (kate_overread(kpb)) {
890       kate_free(pixels);
891       return KATE_E_BAD_PACKET;
892     }
893   }
894 
895   if (((ki->bitstream_version_major<<8)|ki->bitstream_version_minor)>=0x0004) {
896     /* 0.4 adds a warp for x/y offset */
897     kate_read32v(kpb); /* the size of the warp */
898     kb->x_offset=kate_read32v(kpb);
899     kb->y_offset=kate_read32v(kpb);
900   }
901   else {
902     kb->x_offset=0;
903     kb->y_offset=0;
904   }
905 
906   if (((ki->bitstream_version_major<<8)|ki->bitstream_version_minor)>=0x0006) {
907     /* 0.6 adds a warp for metadata */
908     kate_read32v(kpb); /* the size of the warp */
909     ret=kate_read_metadata(kpb,&kb->meta);
910     if (ret<0) return ret;
911   }
912   else {
913     kb->meta=NULL;
914   }
915   kb->internal=1;
916 
917   ret=kate_warp(kpb);
918   if (ret<0) return ret;
919 
920   kb->pixels=pixels;
921 
922   return 0;
923 }
924 
kate_decode_bitmaps_packet(kate_info * ki,kate_pack_buffer * kpb)925 static int kate_decode_bitmaps_packet(kate_info *ki,kate_pack_buffer *kpb)
926 {
927   KMG_GUARD();
928   int ret,n,nbitmaps;
929   kate_bitmap **bitmaps=NULL;
930 
931   if (!ki || !kpb) return KMG_ERROR(KATE_E_INVALID_PARAMETER);
932 
933   nbitmaps=kate_read32v(kpb);
934   if (nbitmaps<0) return KMG_ERROR(KATE_E_BAD_PACKET);
935   if (!ki->no_limits && nbitmaps>KATE_LIMIT_BITMAPS) return KMG_ERROR(KATE_E_LIMIT);
936 
937   if (nbitmaps>0) {
938     bitmaps=(kate_bitmap**)KMG_CHECKED_MALLOC(nbitmaps,sizeof(kate_bitmap*));
939     if (!bitmaps) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
940     for (n=0;n<nbitmaps;++n) {
941       bitmaps[n]=(kate_bitmap*)KMG_MALLOC(sizeof(kate_bitmap));
942       if (!bitmaps[n]) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
943       ret=kate_decode_bitmap(ki,bitmaps[n],kpb);
944       if (kate_overread(kpb)) return KMG_ERROR(KATE_E_BAD_PACKET);
945       if (ret<0) return KMG_ERROR(ret);
946     }
947   }
948 
949   ret=kate_warp(kpb);
950   if (ret<0) return KMG_ERROR(ret);
951 
952   ret=kate_check_eop(kpb);
953   if (ret<0) return KMG_ERROR(ret);
954 
955   ki->nbitmaps=nbitmaps;
956   ki->bitmaps=bitmaps;
957 
958   return KMG_OK();
959 }
960 
kate_decode_font_range(const kate_info * ki,kate_font_range * kfr,kate_pack_buffer * kpb)961 static int kate_decode_font_range(const kate_info *ki,kate_font_range *kfr,kate_pack_buffer *kpb)
962 {
963   if (!ki || !kfr || !kpb) return KATE_E_INVALID_PARAMETER;
964 
965   kfr->first_code_point=kate_read32v(kpb);
966   kfr->last_code_point=kate_read32v(kpb);
967   kfr->first_bitmap=kate_read32v(kpb);
968 
969   return kate_warp(kpb);
970 }
971 
kate_decode_font_ranges_packet(kate_info * ki,kate_pack_buffer * kpb)972 static int kate_decode_font_ranges_packet(kate_info *ki,kate_pack_buffer *kpb)
973 {
974   KMG_GUARD();
975   int l,n,ret;
976   int nfont_ranges,nfont_mappings;
977   kate_font_range **font_ranges=NULL;
978   kate_font_mapping **font_mappings=NULL;
979 
980   if (!ki || !kpb) return KMG_ERROR(KATE_E_INVALID_PARAMETER);
981 
982   nfont_ranges=kate_read32v(kpb);
983   if (nfont_ranges<0) return KMG_ERROR(KATE_E_BAD_PACKET);
984   if (!ki->no_limits && nfont_ranges>KATE_LIMIT_FONT_RANGES) return KMG_ERROR(KATE_E_LIMIT);
985 
986   if (nfont_ranges>0) {
987     font_ranges=(kate_font_range**)KMG_CHECKED_MALLOC(nfont_ranges,sizeof(kate_font_range*));
988     if (!font_ranges) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
989     for (n=0;n<nfont_ranges;++n) {
990       font_ranges[n]=(kate_font_range*)KMG_MALLOC(sizeof(kate_font_range));
991       if (!font_ranges[n]) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
992       ret=kate_decode_font_range(ki,font_ranges[n],kpb);
993       if (kate_overread(kpb)) return KMG_ERROR(KATE_E_BAD_PACKET);
994       if (ret<0) return KMG_ERROR(ret);
995     }
996   }
997 
998   /* these may now be used by the mappings */
999   ki->nfont_ranges=nfont_ranges;
1000   ki->font_ranges=font_ranges;
1001 
1002   /* now, the mappings */
1003   nfont_mappings=kate_read32v(kpb);
1004   if (nfont_mappings<0) return KMG_ERROR(KATE_E_BAD_PACKET);
1005   if (!ki->no_limits && nfont_mappings>KATE_LIMIT_FONT_MAPPINGS) return KMG_ERROR(KATE_E_LIMIT);
1006 
1007   if (nfont_mappings>0) {
1008     font_mappings=(kate_font_mapping**)KMG_CHECKED_MALLOC(nfont_mappings,sizeof(kate_font_mapping*));
1009     if (!font_mappings) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
1010     for (n=0;n<nfont_mappings;++n) {
1011       font_mappings[n]=(kate_font_mapping*)KMG_MALLOC(sizeof(kate_font_mapping));
1012       if (!font_mappings[n]) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
1013 
1014       nfont_ranges=kate_read32v(kpb);
1015       if (nfont_ranges<0) return KMG_ERROR(KATE_E_BAD_PACKET);
1016       if (!ki->no_limits && nfont_ranges>KATE_LIMIT_FONT_MAPPING_RANGES) return KMG_ERROR(KATE_E_LIMIT);
1017 
1018       if (nfont_ranges>0) {
1019         font_ranges=(kate_font_range**)KMG_CHECKED_MALLOC(nfont_ranges,sizeof(kate_font_range*));
1020         if (!font_ranges) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
1021 
1022         for (l=0;l<nfont_ranges;++l) {
1023           if (kate_pack_read1(kpb)) {
1024             size_t idx=kate_read32v(kpb);
1025             if (idx>=ki->nfont_ranges) return KMG_ERROR(KATE_E_BAD_PACKET);
1026             font_ranges[l]=ki->font_ranges[idx];
1027           }
1028           else {
1029             font_ranges[l]=(kate_font_range*)KMG_MALLOC(sizeof(kate_font_range));
1030             if (!font_ranges[l]) return KMG_ERROR(KATE_E_OUT_OF_MEMORY);
1031             ret=kate_decode_font_range(ki,font_ranges[l],kpb);
1032             if (kate_overread(kpb)) return KMG_ERROR(KATE_E_BAD_PACKET);
1033             if (ret<0) return KMG_ERROR(ret);
1034           }
1035         }
1036         font_mappings[n]->nranges=nfont_ranges;
1037         font_mappings[n]->ranges=font_ranges;
1038       }
1039       else {
1040         font_mappings[n]->nranges=0;
1041         font_mappings[n]->ranges=NULL;
1042       }
1043     }
1044   }
1045 
1046   ret=kate_warp(kpb);
1047   if (ret<0) return KMG_ERROR(ret);
1048 
1049   ret=kate_check_eop(kpb);
1050   if (ret<0) return KMG_ERROR(ret);
1051 
1052   ki->nfont_mappings=nfont_mappings;
1053   ki->font_mappings=font_mappings;
1054 
1055   return KMG_OK();
1056 }
1057 
1058 /**
1059   \ingroup decoding
1060   Decodes a header packet, and updates the kate_info and kate_comment structures
1061   from the decoded data.
1062   \param ki the kate_info structure to update
1063   \param kc the kate_comment structure to update
1064   \param kp the packet to decode
1065   \returns 0 success
1066   \returns 1 success, and all headers have been decoded
1067   \returns KATE_E_* error
1068   */
kate_decode_headerin(kate_info * ki,kate_comment * kc,kate_packet * kp)1069 int kate_decode_headerin(kate_info *ki,kate_comment *kc,kate_packet *kp)
1070 {
1071   kate_pack_buffer kpb;
1072   unsigned char headerid;
1073   int ret;
1074   int packetno;
1075 
1076   if (!ki || !kc || !kp) return KATE_E_INVALID_PARAMETER;
1077 
1078   kate_pack_readinit(&kpb,kp->data,kp->nbytes);
1079   headerid=kate_pack_read(&kpb,8);
1080 
1081   ret=kate_decode_check_magic(&kpb);
1082   if (ret<0) return ret;
1083 
1084   if (!(headerid&0x80)) return KATE_E_BAD_PACKET;
1085   packetno=headerid&~0x80;
1086   if (packetno<ki->num_headers) {
1087     if (ki->probe!=packetno) return KATE_E_BAD_PACKET;
1088   }
1089 
1090   /* starting with 0.1.4 (bitstream version 0.2, unchanged), there
1091      was a change in the interpretation of the Kate magic, at the
1092      request of Xiph, to limit signature length to 8 bytes. So the
1093      signature (from byte offset 1, after the packet type byte) is
1094      now only 7 bytes rather than 8, but all headers packets have
1095      a reserved 0 byte after the signature, so the actual bitstream
1096      format is left unchanged */
1097   if (kate_pack_read(&kpb,8)!=0) return KATE_E_BAD_PACKET;
1098 
1099   switch (packetno) {
1100     case 0: /* this is the info packet */
1101       ret=kate_decode_info_header(ki,&kpb);
1102       break;
1103 
1104     case 1: /* this is the comments packet */
1105       ret=kate_decode_comment_packet(ki,kc,&kpb);
1106       break;
1107 
1108     case 2: /* this is the region list packet */
1109       ret=kate_decode_regions_packet(ki,&kpb);
1110       break;
1111 
1112     case 3: /* this is the style list packet */
1113       ret=kate_decode_styles_packet(ki,&kpb);
1114       break;
1115 
1116     case 4: /* this is the curve list packet */
1117       ret=kate_decode_curves_packet(ki,&kpb);
1118       break;
1119 
1120     case 5: /* this is the motion list packet */
1121       ret=kate_decode_motions_packet(ki,&kpb);
1122       break;
1123 
1124     case 6: /* this is the palette list packet */
1125       ret=kate_decode_palettes_packet(ki,&kpb);
1126       break;
1127 
1128     case 7: /* this is the bitmap list packet */
1129       ret=kate_decode_bitmaps_packet(ki,&kpb);
1130       break;
1131 
1132     case 8: /* this is the font ranges list packet */
1133       ret=kate_decode_font_ranges_packet(ki,&kpb);
1134       if (ret==0) ret=1; /* we're done, we know of no more headers to come */
1135       break;
1136 
1137     default:
1138       /* we ignore extra header packets for future proofing */
1139       ret=0;
1140       break;
1141   }
1142 
1143   if (ret>=0) {
1144     /* if the header was parsed successfully, we're ready for the next one */
1145     ki->probe++;
1146   }
1147 
1148   return ret;
1149 }
1150 
1151 /**
1152   \ingroup decoding
1153   Initializes a kate_state structure for decoding using the supplied kate_info structure.
1154   When done, the kate_state should be cleared using kate_clear.
1155   \param k the kate_state to initialize for decoding
1156   \param ki the kate_info structure initialized from the decoded headers
1157   \returns 0 success
1158   \returns KATE_E_* error
1159   */
kate_decode_init(kate_state * k,kate_info * ki)1160 int kate_decode_init(kate_state *k,kate_info *ki)
1161 {
1162   if (!k || !ki) return KATE_E_INVALID_PARAMETER;
1163 
1164   k->ki=ki;
1165   k->kes=NULL;
1166   k->kds=kate_decode_state_create();
1167   if (!k->kds) return KATE_E_OUT_OF_MEMORY;
1168 
1169   return 0;
1170 }
1171 
1172 #define READ_OVERRIDE(read) \
1173   do { \
1174     if (kate_pack_read1(kpb)) { read; } \
1175   } while(0)
1176 
1177 #if 0 && defined DEBUG
1178 #include <unistd.h>
1179 #include <sys/types.h>
1180 #include <time.h>
1181 #include <stdlib.h>
1182 #define RNDERR(label) \
1183   do { \
1184     static int seed=0; \
1185     if (!seed) { \
1186       const char *env=getenv("KATE_RAND_SEED"); \
1187       if (env) srand(atoi(env)); else srand(time(NULL)^getpid()); \
1188       seed=1; \
1189     } \
1190     if (((rand()>>8)&0xff)==0) { \
1191       ret=KATE_E_OUT_OF_MEMORY; \
1192       goto label; \
1193     } \
1194   } while(0)
1195 #else
1196 #define RNDERR(label) ((void)0)
1197 #endif
1198 
kate_decode_text_packet(kate_state * k,kate_pack_buffer * kpb,int repeat)1199 static int kate_decode_text_packet(kate_state *k,kate_pack_buffer *kpb,int repeat)
1200 {
1201   KMG_GUARD();
1202   int ret,n;
1203   int len;
1204   char *text;
1205   kate_decode_state *kds;
1206   kate_event *ev;
1207 
1208   if (!k || !kpb) return KATE_E_INVALID_PARAMETER;
1209   if (!k->kds) return KATE_E_INIT;
1210 
1211   ret=kate_decode_state_clear(k->kds,k->ki,1);
1212   if (ret<0) return ret;
1213 
1214   kds=k->kds;
1215   ev=kds->event;
1216 
1217   ev->start=kate_read64(kpb);
1218   ev->duration=kate_read64(kpb);
1219   ev->backlink=kate_read64(kpb);
1220   if (ev->start<0 || ev->duration<0) goto error_bad_packet;
1221   if (ev->backlink<0 || ev->backlink>ev->start) goto error_bad_packet;
1222   RNDERR(error_bad_packet);
1223 
1224   ev->start_time=kate_granule_duration(k->ki,ev->start);
1225   ev->end_time=ev->start_time+kate_granule_duration(k->ki,ev->duration);
1226 
1227   len=kate_read32(kpb);
1228   if (len<0) goto error_bad_packet;
1229   RNDERR(error_bad_packet);
1230   if (!k->ki->no_limits && len>KATE_LIMIT_TEXT_LENGTH) goto error_limit;
1231   RNDERR(error_limit);
1232 
1233   /* read the text, and null terminate it - 4 characters for UTF-32 */
1234   if (kate_check_add_overflow(len,4,NULL)) goto error_out_of_memory;
1235   text=(char*)KMG_MALLOC(len+4);
1236   if (!text) goto error_out_of_memory;
1237   RNDERR(error_out_of_memory);
1238   ret=kate_readbuf(kpb,text,len);
1239   if (ret<0) goto error_bad_packet;
1240   text[len]=0;
1241   text[len+1]=0;
1242   text[len+2]=0;
1243   text[len+3]=0;
1244   /* we can't validate the text yet, as we don't know whether there's a text encoding override later,
1245      so we delay validatation till we've read the overrides */
1246 
1247   ev->text=text;
1248   ev->len=len;
1249   ev->len0=len+4;
1250 
1251   if (kate_pack_read1(kpb)) {
1252     ev->id=kate_read32v(kpb);
1253   }
1254 
1255   if (repeat && ev->id>=0) {
1256     /* if this is a repeat, check if we have this event already */
1257     ret=kate_decode_state_find_event(k->kds,ev->id);
1258     if (ret<0 && ret!=KATE_E_NOT_FOUND) goto error;
1259     if (ret>=0) goto ignore;
1260   }
1261 
1262   if (kate_pack_read1(kpb)) {
1263     kate_motion **motions=NULL;
1264     size_t nmotions=0;
1265 
1266     len=kate_read32v(kpb);
1267     if (len<=0) goto error_bad_packet; /* if the flag was set, there's at least one */
1268     if (!k->ki->no_limits && len>KATE_LIMIT_TEXT_MOTIONS) goto error_limit;
1269     RNDERR(error_limit);
1270     motions=(kate_motion**)KMG_CHECKED_MALLOC(len,sizeof(kate_motion*));
1271     if (!motions) goto error_out_of_memory;
1272     RNDERR(error_out_of_memory);
1273     nmotions=0;
1274     for (n=0;n<len;++n) {
1275       if (kate_pack_read1(kpb)) {
1276         size_t idx=kate_read32v(kpb);
1277         if (idx>=k->ki->nmotions) goto error_bad_packet;
1278         RNDERR(error_bad_packet);
1279         motions[n]=k->ki->motions[idx];
1280       }
1281       else {
1282         motions[n]=KMG_MALLOC(sizeof(kate_motion));
1283         if (!motions[n]) goto error_out_of_memory;
1284         RNDERR(error_out_of_memory);
1285         ret=kate_decode_motion(k->ki,motions[n],kpb,&kmg);
1286         if (kate_overread(kpb)) goto error_bad_packet;
1287         if (ret<0) goto error;
1288         RNDERR(error);
1289       }
1290       ++nmotions;
1291     }
1292 
1293     ev->motions=motions;
1294     ev->nmotions=nmotions;
1295   }
1296 
1297   if (kate_pack_read1(kpb)) {
1298     READ_OVERRIDE(ev->text_encoding=kate_pack_read(kpb,8));
1299     READ_OVERRIDE(ev->text_directionality=kate_pack_read(kpb,8));
1300     READ_OVERRIDE(
1301       do {
1302         len=kate_read32v(kpb);
1303         if (len<0) goto error_bad_packet;
1304         RNDERR(error_bad_packet);
1305         if (!k->ki->no_limits && len>KATE_LIMIT_LANGUAGE_LENGTH) goto error_limit;
1306         RNDERR(error_limit);
1307         if (len>0) {
1308           ev->language=(char*)KMG_MALLOC(len+1);
1309           if (!ev->language) goto error_out_of_memory;
1310         RNDERR(error_out_of_memory);
1311           ret=kate_readbuf(kpb,ev->language,len);
1312           if (ret<0) goto error_bad_packet;
1313           ev->language[len]=0;
1314         }
1315       } while(0)
1316     );
1317     READ_OVERRIDE(
1318       size_t idx=kate_read32v(kpb);
1319       if (idx>=k->ki->nregions) goto error_bad_packet;
1320       RNDERR(error_bad_packet);
1321       ev->region=k->ki->regions[idx];
1322     );
1323     READ_OVERRIDE(
1324       ev->region=KMG_MALLOC(sizeof(kate_region));
1325       if (!ev->region) goto error_out_of_memory;
1326       RNDERR(error_out_of_memory);
1327       ret=kate_decode_region(k->ki,ev->region,kpb);
1328       if (ret<0) goto error;
1329     );
1330     READ_OVERRIDE(
1331       size_t idx=kate_read32v(kpb);
1332       if (idx>=k->ki->nstyles) goto error_bad_packet;
1333       RNDERR(error_bad_packet);
1334       ev->style=k->ki->styles[idx]
1335     );
1336     READ_OVERRIDE(
1337       ev->style=KMG_MALLOC(sizeof(kate_style));
1338       if (!ev->style) goto error_out_of_memory;
1339       RNDERR(error_out_of_memory);
1340       ret=kate_decode_style(k->ki,ev->style,kpb,&kmg);
1341       if (ret<0) goto error;
1342     );
1343     READ_OVERRIDE(
1344       size_t idx=kate_read32v(kpb);
1345       if (idx>=k->ki->nstyles) goto error_bad_packet;
1346       RNDERR(error_bad_packet);
1347       ev->secondary_style=k->ki->styles[idx]
1348     );
1349     READ_OVERRIDE(
1350       ev->secondary_style=KMG_MALLOC(sizeof(kate_style));
1351       if (!ev->secondary_style) goto error_out_of_memory;
1352       RNDERR(error_out_of_memory);
1353       ret=kate_decode_style(k->ki,ev->secondary_style,kpb,&kmg);
1354       if (ret<0) goto error;
1355       RNDERR(error);
1356     );
1357     READ_OVERRIDE(
1358       size_t idx=kate_read32v(kpb);
1359       if (idx>=k->ki->nfont_mappings) goto error_bad_packet;
1360       RNDERR(error_bad_packet);
1361       ev->font_mapping=k->ki->font_mappings[idx]
1362     );
1363   }
1364 
1365   if (((k->ki->bitstream_version_major<<8)|k->ki->bitstream_version_minor)>=0x0002) {
1366     /* 0.2 adds a warp for palette, bitmap, markup type */
1367     kate_read32v(kpb); /* the size of the warp */
1368     if (kate_pack_read1(kpb)) {
1369       READ_OVERRIDE(
1370         size_t idx=kate_read32v(kpb);
1371         if (idx>=k->ki->npalettes) goto error_bad_packet;
1372         RNDERR(error_bad_packet);
1373         ev->palette=k->ki->palettes[idx];
1374       );
1375       READ_OVERRIDE(
1376         ev->palette=KMG_MALLOC(sizeof(kate_palette));
1377         if (!ev->palette) goto error_out_of_memory;
1378         ret=kate_decode_palette(k->ki,ev->palette,kpb);
1379         if (ret<0) goto error;
1380         RNDERR(error);
1381       );
1382       READ_OVERRIDE(
1383         size_t idx=kate_read32v(kpb);
1384         if (idx>=k->ki->nbitmaps) goto error_bad_packet;
1385         ev->bitmap=k->ki->bitmaps[idx];
1386       );
1387       READ_OVERRIDE(
1388         ev->bitmap=KMG_MALLOC(sizeof(kate_bitmap));
1389         if (!ev->bitmap) goto error_out_of_memory;
1390         RNDERR(error_out_of_memory);
1391         ret=kate_decode_bitmap(k->ki,ev->bitmap,kpb);
1392         if (ret<0) goto error;
1393         RNDERR(error);
1394       );
1395       READ_OVERRIDE(ev->text_markup_type=kate_pack_read(kpb,8));
1396     }
1397   }
1398 
1399   if (((k->ki->bitstream_version_major<<8)|k->ki->bitstream_version_minor)>=0x0004) {
1400     /* 0.4 adds a warp for bitmaps */
1401     kate_bitmap **bitmaps=NULL;
1402     size_t nbitmaps=0;
1403 
1404     kate_read32v(kpb); /* the size of the warp */
1405 
1406     len=kate_read32v(kpb);
1407     if (len<0) goto error_bad_packet;
1408     RNDERR(error_bad_packet);
1409     if (len>0) {
1410       if (!k->ki->no_limits && len>KATE_LIMIT_BITMAPS) goto error_limit;
1411       bitmaps=(kate_bitmap**)KMG_CHECKED_MALLOC(len,sizeof(kate_bitmap*));
1412       if (!bitmaps) goto error_out_of_memory;
1413       RNDERR(error_out_of_memory);
1414       nbitmaps=0;
1415       for (n=0;n<len;++n) {
1416         if (kate_pack_read1(kpb)) {
1417           size_t idx=kate_read32v(kpb);
1418           if (idx>=k->ki->nbitmaps) goto error_bad_packet;
1419           RNDERR(error_bad_packet);
1420           bitmaps[n]=k->ki->bitmaps[idx];
1421         }
1422         else {
1423           bitmaps[n]=KMG_MALLOC(sizeof(kate_bitmap));
1424           if (!bitmaps[n]) goto error_out_of_memory;
1425           RNDERR(error_out_of_memory);
1426           ret=kate_decode_bitmap(k->ki,bitmaps[n],kpb);
1427           if (kate_overread(kpb)) goto error_bad_packet;
1428           if (ret<0) goto error;
1429         }
1430         ++nbitmaps;
1431       }
1432     }
1433 
1434     ev->bitmaps=bitmaps;
1435     ev->nbitmaps=nbitmaps;
1436   }
1437   else {
1438     ev->bitmaps=NULL;
1439     ev->nbitmaps=0;
1440   }
1441 
1442   if (((k->ki->bitstream_version_major<<8)|k->ki->bitstream_version_minor)>=0x0006) {
1443     /* 0.6 adds a warp for metadata */
1444     kate_read32v(kpb); /* the size of the warp */
1445 
1446     ret=kate_read_metadata(kpb,&ev->meta);
1447     if (ret<0) goto error;
1448   }
1449 
1450   ret=kate_warp(kpb);
1451   if (ret<0) goto error;
1452   RNDERR(error);
1453 
1454   /* validate text, and reject invalid encodings */
1455   ret=kate_text_validate(ev->text_encoding,ev->text,ev->len0);
1456   RNDERR(error);
1457   if (ret<0) goto error;
1458 
1459   if (ev->text_markup_type!=kate_markup_none && k->ki->remove_markup) {
1460     size_t zero_size=ev->len0-ev->len;
1461     ret=kate_text_remove_markup(ev->text_encoding,ev->text,&ev->len0);
1462     if (ret<0) goto error;
1463     if (ev->len0<zero_size) goto error_bad_packet; /* can't happen, but let's be safe */
1464     ev->len=ev->len0-zero_size;
1465     RNDERR(error);
1466     ev->text_markup_type=kate_markup_none;
1467   }
1468 
1469   /* if no style, use the region (if any) default style */
1470   if (!ev->style && ev->region) {
1471     if (ev->region->style>=0) {
1472       size_t idx=ev->region->style;
1473       if (idx<k->ki->nstyles) {
1474         ev->style=k->ki->styles[idx];
1475       }
1476     }
1477   }
1478 
1479   if (ev->id>=0) {
1480     /* register the event as active */
1481     ret=kate_decode_state_add_event(k->kds,ev);
1482     RNDERR(error);
1483     if (ret<0) goto error;
1484   }
1485 
1486   ret=kate_decode_state_flush_events(k->kds,ev->start);
1487   RNDERR(error);
1488   if (ret<0) goto error;
1489 
1490   return KMG_OK();
1491 
1492 error_limit:
1493   ret=KATE_E_LIMIT;
1494   goto error;
1495 
1496 error_bad_packet:
1497   ret=KATE_E_BAD_PACKET;
1498   goto error;
1499 
1500 error_out_of_memory:
1501   ret=KATE_E_OUT_OF_MEMORY;
1502   goto error;
1503 
1504 ignore:
1505   /* special case where we need to destroy the event as we're not interested in it,
1506      but we do not want an error to be raised */
1507   ret=0;
1508   goto error;
1509 
1510 error:
1511   /* all the memory allocated for the event should be freed by the kate_memory_guard,
1512      so we just unlink and jettison it */
1513   kate_free(kds->event);
1514   kds->event=NULL;
1515   return KMG_ERROR(ret);
1516 }
1517 
kate_decode_repeat_packet(kate_state * k,kate_pack_buffer * kpb)1518 static int kate_decode_repeat_packet(kate_state *k,kate_pack_buffer *kpb)
1519 {
1520   return kate_decode_text_packet(k,kpb,1);
1521 }
1522 
kate_decode_keepalive_packet(kate_state * k,kate_pack_buffer * kpb)1523 static int kate_decode_keepalive_packet(kate_state *k,kate_pack_buffer *kpb)
1524 {
1525   if (!k || !kpb) return KATE_E_INVALID_PARAMETER;
1526   if (!k->kds) return KATE_E_INIT;
1527 
1528   return 0;
1529 }
1530 
kate_decode_end_packet(kate_state * k,kate_pack_buffer * kpb)1531 static int kate_decode_end_packet(kate_state *k,kate_pack_buffer *kpb)
1532 {
1533   if (!k || !kpb) return KATE_E_INVALID_PARAMETER;
1534   if (!k->kds) return KATE_E_INIT;
1535 
1536   return 1;
1537 }
1538 
1539 /**
1540   \ingroup decoding
1541   Decodes a data packet.
1542   \param k the kate_state to decode to
1543   \param kp the packet to decode
1544   \returns 0 success
1545   \returns 1 success, and we're at end of stream
1546   \returns KATE_E_* error
1547   */
kate_decode_packetin(kate_state * k,kate_packet * kp)1548 int kate_decode_packetin(kate_state *k,kate_packet *kp)
1549 {
1550   kate_pack_buffer kpb;
1551   int ret,id;
1552 
1553   if (!k || !kp) return KATE_E_INVALID_PARAMETER;
1554   if (!k->ki) return KATE_E_INIT;
1555   if (!k->kds) return KATE_E_INIT;
1556 
1557   ret=kate_decode_state_clear(k->kds,k->ki,0);
1558   if (ret<0) return ret;
1559 
1560   kate_pack_readinit(&kpb,kp->data,kp->nbytes);
1561   id=kate_pack_read(&kpb,8);
1562   if (id&0x80) {
1563     /* we have a header - we'll ignore it
1564        it may have happened either because we seeked to the beginning of the stream
1565        or because we're parsing a stream that has more headers than we know about */
1566     return 0;
1567   }
1568 
1569   switch (id) {
1570     case 0x00: return kate_decode_text_packet(k,&kpb,0);
1571     case 0x01: return kate_decode_keepalive_packet(k,&kpb);
1572     case 0x02: return kate_decode_repeat_packet(k,&kpb);
1573     case 0x7f: return kate_decode_end_packet(k,&kpb);
1574     default: return 0; /* unknown data packets are ignored, for future proofing */
1575   }
1576 
1577   return 0;
1578 }
1579 
1580 /**
1581   \ingroup decoding
1582   Requests a pointer to the event decoded by the last packet, if there is one.
1583   \param k the kate_state to get the event from
1584   \param event a pointer to where to place the pointer to the event, if any
1585   \returns 0 success, an event was returned
1586   \returns 1 success, but there was no event to return
1587   \returns KATE_E_* error
1588   */
kate_decode_eventout(kate_state * k,kate_const kate_event ** event)1589 int kate_decode_eventout(kate_state *k,kate_const kate_event **event)
1590 {
1591   if (!k) return KATE_E_INVALID_PARAMETER;
1592   if (!k->kds) return KATE_E_INIT;
1593 
1594   if (!k->kds->event) return 1;
1595 
1596   if (event) *event=k->kds->event;
1597 
1598   return 0;
1599 }
1600 
1601 /**
1602   \ingroup decoding
1603   Informs the Kate decoder that seeking has occured.
1604   This will cause the decoder to use any future repeat packets to recover
1605   data from past events which are still active, but which original packets
1606   were before the seek point, and therefore unavailable.
1607   \param k the kate_state for which a seek occured
1608   \returns 0 success
1609   \returns KATE_E_* error
1610   */
kate_decode_seek(kate_state * k)1611 int kate_decode_seek(kate_state *k)
1612 {
1613   if (!k) return KATE_E_INVALID_PARAMETER;
1614   if (!k->kds) return KATE_E_INIT;
1615 
1616   return kate_decode_state_flush_events(k->kds,-1);
1617 }
1618 
1619