1 /*
2  * rdtarga.c
3  *
4  * This file was part of the Independent JPEG Group's software:
5  * Copyright (C) 1991-1996, Thomas G. Lane.
6  * Modified 2017 by Guido Vollbeding.
7  * libjpeg-turbo Modifications:
8  * Copyright (C) 2018, 2021, D. R. Commander.
9  * For conditions of distribution and use, see the accompanying README.ijg
10  * file.
11  *
12  * This file contains routines to read input images in Targa format.
13  *
14  * These routines may need modification for non-Unix environments or
15  * specialized applications.  As they stand, they assume input from
16  * an ordinary stdio stream.  They further assume that reading begins
17  * at the start of the file; start_input may need work if the
18  * user interface has already read some data (e.g., to determine that
19  * the file is indeed Targa format).
20  *
21  * Based on code contributed by Lee Daniel Crocker.
22  */
23 
24 #include "cdjpeg.h"             /* Common decls for cjpeg/djpeg applications */
25 
26 #ifdef TARGA_SUPPORTED
27 
28 
29 /* Macros to deal with unsigned chars as efficiently as compiler allows */
30 
31 typedef unsigned char U_CHAR;
32 #define UCH(x)  ((int)(x))
33 
34 
35 #define ReadOK(file, buffer, len) \
36   (JFREAD(file, buffer, len) == ((size_t)(len)))
37 
38 
39 /* Private version of data source object */
40 
41 typedef struct _tga_source_struct *tga_source_ptr;
42 
43 typedef struct _tga_source_struct {
44   struct cjpeg_source_struct pub; /* public fields */
45 
46   j_compress_ptr cinfo;         /* back link saves passing separate parm */
47 
48   JSAMPARRAY colormap;          /* Targa colormap (converted to my format) */
49 
50   jvirt_sarray_ptr whole_image; /* Needed if funny input row order */
51   JDIMENSION current_row;       /* Current logical row number to read */
52 
53   /* Pointer to routine to extract next Targa pixel from input file */
54   void (*read_pixel) (tga_source_ptr sinfo);
55 
56   /* Result of read_pixel is delivered here: */
57   U_CHAR tga_pixel[4];
58 
59   int pixel_size;               /* Bytes per Targa pixel (1 to 4) */
60   int cmap_length;              /* colormap length */
61 
62   /* State info for reading RLE-coded pixels; both counts must be init to 0 */
63   int block_count;              /* # of pixels remaining in RLE block */
64   int dup_pixel_count;          /* # of times to duplicate previous pixel */
65 
66   /* This saves the correct pixel-row-expansion method for preload_image */
67   JDIMENSION (*get_pixel_rows) (j_compress_ptr cinfo, cjpeg_source_ptr sinfo);
68 } tga_source_struct;
69 
70 
71 /* For expanding 5-bit pixel values to 8-bit with best rounding */
72 
73 static const UINT8 c5to8bits[32] = {
74     0,   8,  16,  25,  33,  41,  49,  58,
75    66,  74,  82,  90,  99, 107, 115, 123,
76   132, 140, 148, 156, 165, 173, 181, 189,
77   197, 206, 214, 222, 230, 239, 247, 255
78 };
79 
80 
81 
82 LOCAL(int)
read_byte(tga_source_ptr sinfo)83 read_byte(tga_source_ptr sinfo)
84 /* Read next byte from Targa file */
85 {
86   register FILE *infile = sinfo->pub.input_file;
87   register int c;
88 
89   if ((c = getc(infile)) == EOF)
90     ERREXIT(sinfo->cinfo, JERR_INPUT_EOF);
91   return c;
92 }
93 
94 
95 LOCAL(void)
read_colormap(tga_source_ptr sinfo,int cmaplen,int mapentrysize)96 read_colormap(tga_source_ptr sinfo, int cmaplen, int mapentrysize)
97 /* Read the colormap from a Targa file */
98 {
99   int i;
100 
101   /* Presently only handles 24-bit BGR format */
102   if (mapentrysize != 24)
103     ERREXIT(sinfo->cinfo, JERR_TGA_BADCMAP);
104 
105   for (i = 0; i < cmaplen; i++) {
106     sinfo->colormap[2][i] = (JSAMPLE)read_byte(sinfo);
107     sinfo->colormap[1][i] = (JSAMPLE)read_byte(sinfo);
108     sinfo->colormap[0][i] = (JSAMPLE)read_byte(sinfo);
109   }
110 }
111 
112 
113 /*
114  * read_pixel methods: get a single pixel from Targa file into tga_pixel[]
115  */
116 
117 METHODDEF(void)
read_non_rle_pixel(tga_source_ptr sinfo)118 read_non_rle_pixel(tga_source_ptr sinfo)
119 /* Read one Targa pixel from the input file; no RLE expansion */
120 {
121   register int i;
122 
123   for (i = 0; i < sinfo->pixel_size; i++) {
124     sinfo->tga_pixel[i] = (U_CHAR)read_byte(sinfo);
125   }
126 }
127 
128 
129 METHODDEF(void)
read_rle_pixel(tga_source_ptr sinfo)130 read_rle_pixel(tga_source_ptr sinfo)
131 /* Read one Targa pixel from the input file, expanding RLE data as needed */
132 {
133   register int i;
134 
135   /* Duplicate previously read pixel? */
136   if (sinfo->dup_pixel_count > 0) {
137     sinfo->dup_pixel_count--;
138     return;
139   }
140 
141   /* Time to read RLE block header? */
142   if (--sinfo->block_count < 0) { /* decrement pixels remaining in block */
143     i = read_byte(sinfo);
144     if (i & 0x80) {             /* Start of duplicate-pixel block? */
145       sinfo->dup_pixel_count = i & 0x7F; /* number of dups after this one */
146       sinfo->block_count = 0;   /* then read new block header */
147     } else {
148       sinfo->block_count = i & 0x7F; /* number of pixels after this one */
149     }
150   }
151 
152   /* Read next pixel */
153   for (i = 0; i < sinfo->pixel_size; i++) {
154     sinfo->tga_pixel[i] = (U_CHAR)read_byte(sinfo);
155   }
156 }
157 
158 
159 /*
160  * Read one row of pixels.
161  *
162  * We provide several different versions depending on input file format.
163  */
164 
165 
166 METHODDEF(JDIMENSION)
get_8bit_gray_row(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)167 get_8bit_gray_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
168 /* This version is for reading 8-bit grayscale pixels */
169 {
170   tga_source_ptr source = (tga_source_ptr)sinfo;
171   register JSAMPROW ptr;
172   register JDIMENSION col;
173 
174   ptr = source->pub.buffer[0];
175   for (col = cinfo->image_width; col > 0; col--) {
176     (*source->read_pixel) (source); /* Load next pixel into tga_pixel */
177     *ptr++ = (JSAMPLE)UCH(source->tga_pixel[0]);
178   }
179   return 1;
180 }
181 
182 METHODDEF(JDIMENSION)
get_8bit_row(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)183 get_8bit_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
184 /* This version is for reading 8-bit colormap indexes */
185 {
186   tga_source_ptr source = (tga_source_ptr)sinfo;
187   register int t;
188   register JSAMPROW ptr;
189   register JDIMENSION col;
190   register JSAMPARRAY colormap = source->colormap;
191   int cmaplen = source->cmap_length;
192 
193   ptr = source->pub.buffer[0];
194   for (col = cinfo->image_width; col > 0; col--) {
195     (*source->read_pixel) (source); /* Load next pixel into tga_pixel */
196     t = UCH(source->tga_pixel[0]);
197     if (t >= cmaplen)
198       ERREXIT(cinfo, JERR_TGA_BADPARMS);
199     *ptr++ = colormap[0][t];
200     *ptr++ = colormap[1][t];
201     *ptr++ = colormap[2][t];
202   }
203   return 1;
204 }
205 
206 METHODDEF(JDIMENSION)
get_16bit_row(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)207 get_16bit_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
208 /* This version is for reading 16-bit pixels */
209 {
210   tga_source_ptr source = (tga_source_ptr)sinfo;
211   register int t;
212   register JSAMPROW ptr;
213   register JDIMENSION col;
214 
215   ptr = source->pub.buffer[0];
216   for (col = cinfo->image_width; col > 0; col--) {
217     (*source->read_pixel) (source); /* Load next pixel into tga_pixel */
218     t = UCH(source->tga_pixel[0]);
219     t += UCH(source->tga_pixel[1]) << 8;
220     /* We expand 5 bit data to 8 bit sample width.
221      * The format of the 16-bit (LSB first) input word is
222      *     xRRRRRGGGGGBBBBB
223      */
224     ptr[2] = (JSAMPLE)c5to8bits[t & 0x1F];
225     t >>= 5;
226     ptr[1] = (JSAMPLE)c5to8bits[t & 0x1F];
227     t >>= 5;
228     ptr[0] = (JSAMPLE)c5to8bits[t & 0x1F];
229     ptr += 3;
230   }
231   return 1;
232 }
233 
234 METHODDEF(JDIMENSION)
get_24bit_row(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)235 get_24bit_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
236 /* This version is for reading 24-bit pixels */
237 {
238   tga_source_ptr source = (tga_source_ptr)sinfo;
239   register JSAMPROW ptr;
240   register JDIMENSION col;
241 
242   ptr = source->pub.buffer[0];
243   for (col = cinfo->image_width; col > 0; col--) {
244     (*source->read_pixel) (source); /* Load next pixel into tga_pixel */
245     *ptr++ = (JSAMPLE)UCH(source->tga_pixel[2]); /* change BGR to RGB order */
246     *ptr++ = (JSAMPLE)UCH(source->tga_pixel[1]);
247     *ptr++ = (JSAMPLE)UCH(source->tga_pixel[0]);
248   }
249   return 1;
250 }
251 
252 /*
253  * Targa also defines a 32-bit pixel format with order B,G,R,A.
254  * We presently ignore the attribute byte, so the code for reading
255  * these pixels is identical to the 24-bit routine above.
256  * This works because the actual pixel length is only known to read_pixel.
257  */
258 
259 #define get_32bit_row  get_24bit_row
260 
261 
262 /*
263  * This method is for re-reading the input data in standard top-down
264  * row order.  The entire image has already been read into whole_image
265  * with proper conversion of pixel format, but it's in a funny row order.
266  */
267 
268 METHODDEF(JDIMENSION)
get_memory_row(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)269 get_memory_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
270 {
271   tga_source_ptr source = (tga_source_ptr)sinfo;
272   JDIMENSION source_row;
273 
274   /* Compute row of source that maps to current_row of normal order */
275   /* For now, assume image is bottom-up and not interlaced. */
276   /* NEEDS WORK to support interlaced images! */
277   source_row = cinfo->image_height - source->current_row - 1;
278 
279   /* Fetch that row from virtual array */
280   source->pub.buffer = (*cinfo->mem->access_virt_sarray)
281     ((j_common_ptr)cinfo, source->whole_image,
282      source_row, (JDIMENSION)1, FALSE);
283 
284   source->current_row++;
285   return 1;
286 }
287 
288 
289 /*
290  * This method loads the image into whole_image during the first call on
291  * get_pixel_rows.  The get_pixel_rows pointer is then adjusted to call
292  * get_memory_row on subsequent calls.
293  */
294 
295 METHODDEF(JDIMENSION)
preload_image(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)296 preload_image(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
297 {
298   tga_source_ptr source = (tga_source_ptr)sinfo;
299   JDIMENSION row;
300   cd_progress_ptr progress = (cd_progress_ptr)cinfo->progress;
301 
302   /* Read the data into a virtual array in input-file row order. */
303   for (row = 0; row < cinfo->image_height; row++) {
304     if (progress != NULL) {
305       progress->pub.pass_counter = (long)row;
306       progress->pub.pass_limit = (long)cinfo->image_height;
307       (*progress->pub.progress_monitor) ((j_common_ptr)cinfo);
308     }
309     source->pub.buffer = (*cinfo->mem->access_virt_sarray)
310       ((j_common_ptr)cinfo, source->whole_image, row, (JDIMENSION)1, TRUE);
311     (*source->get_pixel_rows) (cinfo, sinfo);
312   }
313   if (progress != NULL)
314     progress->completed_extra_passes++;
315 
316   /* Set up to read from the virtual array in unscrambled order */
317   source->pub.get_pixel_rows = get_memory_row;
318   source->current_row = 0;
319   /* And read the first row */
320   return get_memory_row(cinfo, sinfo);
321 }
322 
323 
324 /*
325  * Read the file header; return image size and component count.
326  */
327 
328 METHODDEF(void)
start_input_tga(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)329 start_input_tga(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
330 {
331   tga_source_ptr source = (tga_source_ptr)sinfo;
332   U_CHAR targaheader[18];
333   int idlen, cmaptype, subtype, flags, interlace_type, components;
334   unsigned int width, height, maplen;
335   boolean is_bottom_up;
336 
337 #define GET_2B(offset) \
338   ((unsigned int)UCH(targaheader[offset]) + \
339    (((unsigned int)UCH(targaheader[offset + 1])) << 8))
340 
341   if (!ReadOK(source->pub.input_file, targaheader, 18))
342     ERREXIT(cinfo, JERR_INPUT_EOF);
343 
344   /* Pretend "15-bit" pixels are 16-bit --- we ignore attribute bit anyway */
345   if (targaheader[16] == 15)
346     targaheader[16] = 16;
347 
348   idlen = UCH(targaheader[0]);
349   cmaptype = UCH(targaheader[1]);
350   subtype = UCH(targaheader[2]);
351   maplen = GET_2B(5);
352   width = GET_2B(12);
353   height = GET_2B(14);
354   source->pixel_size = UCH(targaheader[16]) >> 3;
355   flags = UCH(targaheader[17]); /* Image Descriptor byte */
356 
357   is_bottom_up = ((flags & 0x20) == 0); /* bit 5 set => top-down */
358   interlace_type = flags >> 6;  /* bits 6/7 are interlace code */
359 
360   if (cmaptype > 1 ||           /* cmaptype must be 0 or 1 */
361       source->pixel_size < 1 || source->pixel_size > 4 ||
362       (UCH(targaheader[16]) & 7) != 0 || /* bits/pixel must be multiple of 8 */
363       interlace_type != 0 ||      /* currently don't allow interlaced image */
364       width == 0 || height == 0)  /* image width/height must be non-zero */
365     ERREXIT(cinfo, JERR_TGA_BADPARMS);
366 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
367   if (sinfo->max_pixels &&
368       (unsigned long long)width * height > sinfo->max_pixels)
369     ERREXIT(cinfo, JERR_WIDTH_OVERFLOW);
370 #endif
371 
372   if (subtype > 8) {
373     /* It's an RLE-coded file */
374     source->read_pixel = read_rle_pixel;
375     source->block_count = source->dup_pixel_count = 0;
376     subtype -= 8;
377   } else {
378     /* Non-RLE file */
379     source->read_pixel = read_non_rle_pixel;
380   }
381 
382   /* Now should have subtype 1, 2, or 3 */
383   components = 3;               /* until proven different */
384   cinfo->in_color_space = JCS_RGB;
385 
386   switch (subtype) {
387   case 1:                       /* Colormapped image */
388     if (source->pixel_size == 1 && cmaptype == 1)
389       source->get_pixel_rows = get_8bit_row;
390     else
391       ERREXIT(cinfo, JERR_TGA_BADPARMS);
392     TRACEMS2(cinfo, 1, JTRC_TGA_MAPPED, width, height);
393     break;
394   case 2:                       /* RGB image */
395     switch (source->pixel_size) {
396     case 2:
397       source->get_pixel_rows = get_16bit_row;
398       break;
399     case 3:
400       source->get_pixel_rows = get_24bit_row;
401       break;
402     case 4:
403       source->get_pixel_rows = get_32bit_row;
404       break;
405     default:
406       ERREXIT(cinfo, JERR_TGA_BADPARMS);
407       break;
408     }
409     TRACEMS2(cinfo, 1, JTRC_TGA, width, height);
410     break;
411   case 3:                       /* Grayscale image */
412     components = 1;
413     cinfo->in_color_space = JCS_GRAYSCALE;
414     if (source->pixel_size == 1)
415       source->get_pixel_rows = get_8bit_gray_row;
416     else
417       ERREXIT(cinfo, JERR_TGA_BADPARMS);
418     TRACEMS2(cinfo, 1, JTRC_TGA_GRAY, width, height);
419     break;
420   default:
421     ERREXIT(cinfo, JERR_TGA_BADPARMS);
422     break;
423   }
424 
425   if (is_bottom_up) {
426     /* Create a virtual array to buffer the upside-down image. */
427     source->whole_image = (*cinfo->mem->request_virt_sarray)
428       ((j_common_ptr)cinfo, JPOOL_IMAGE, FALSE,
429        (JDIMENSION)width * components, (JDIMENSION)height, (JDIMENSION)1);
430     if (cinfo->progress != NULL) {
431       cd_progress_ptr progress = (cd_progress_ptr)cinfo->progress;
432       progress->total_extra_passes++; /* count file input as separate pass */
433     }
434     /* source->pub.buffer will point to the virtual array. */
435     source->pub.buffer_height = 1; /* in case anyone looks at it */
436     source->pub.get_pixel_rows = preload_image;
437   } else {
438     /* Don't need a virtual array, but do need a one-row input buffer. */
439     source->whole_image = NULL;
440     source->pub.buffer = (*cinfo->mem->alloc_sarray)
441       ((j_common_ptr)cinfo, JPOOL_IMAGE,
442        (JDIMENSION)width * components, (JDIMENSION)1);
443     source->pub.buffer_height = 1;
444     source->pub.get_pixel_rows = source->get_pixel_rows;
445   }
446 
447   while (idlen--)               /* Throw away ID field */
448     (void)read_byte(source);
449 
450   if (maplen > 0) {
451     if (maplen > 256 || GET_2B(3) != 0)
452       ERREXIT(cinfo, JERR_TGA_BADCMAP);
453     /* Allocate space to store the colormap */
454     source->colormap = (*cinfo->mem->alloc_sarray)
455       ((j_common_ptr)cinfo, JPOOL_IMAGE, (JDIMENSION)maplen, (JDIMENSION)3);
456     source->cmap_length = (int)maplen;
457     /* and read it from the file */
458     read_colormap(source, (int)maplen, UCH(targaheader[7]));
459   } else {
460     if (cmaptype)               /* but you promised a cmap! */
461       ERREXIT(cinfo, JERR_TGA_BADPARMS);
462     source->colormap = NULL;
463     source->cmap_length = 0;
464   }
465 
466   cinfo->input_components = components;
467   cinfo->data_precision = 8;
468   cinfo->image_width = width;
469   cinfo->image_height = height;
470 }
471 
472 
473 /*
474  * Finish up at the end of the file.
475  */
476 
477 METHODDEF(void)
finish_input_tga(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)478 finish_input_tga(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
479 {
480   /* no work */
481 }
482 
483 
484 /*
485  * The module selection routine for Targa format input.
486  */
487 
488 GLOBAL(cjpeg_source_ptr)
jinit_read_targa(j_compress_ptr cinfo)489 jinit_read_targa(j_compress_ptr cinfo)
490 {
491   tga_source_ptr source;
492 
493   /* Create module interface object */
494   source = (tga_source_ptr)
495     (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
496                                 sizeof(tga_source_struct));
497   source->cinfo = cinfo;        /* make back link for subroutines */
498   /* Fill in method ptrs, except get_pixel_rows which start_input sets */
499   source->pub.start_input = start_input_tga;
500   source->pub.finish_input = finish_input_tga;
501 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
502   source->pub.max_pixels = 0;
503 #endif
504 
505   return (cjpeg_source_ptr)source;
506 }
507 
508 #endif /* TARGA_SUPPORTED */
509