1 /*
2  * OpenEXR (.exr) image decoder
3  * Copyright (c) 2006 Industrial Light & Magic, a division of Lucas Digital Ltd. LLC
4  * Copyright (c) 2009 Jimmy Christensen
5  *
6  * B44/B44A, Tile, UINT32 added by Jokyo Images support by CNC - French National Center for Cinema
7  *
8  * This file is part of FFmpeg.
9  *
10  * FFmpeg is free software; you can redistribute it and/or
11  * modify it under the terms of the GNU Lesser General Public
12  * License as published by the Free Software Foundation; either
13  * version 2.1 of the License, or (at your option) any later version.
14  *
15  * FFmpeg is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
18  * Lesser General Public License for more details.
19  *
20  * You should have received a copy of the GNU Lesser General Public
21  * License along with FFmpeg; if not, write to the Free Software
22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
23  */
24 
25 /**
26  * @file
27  * OpenEXR decoder
28  * @author Jimmy Christensen
29  *
30  * For more information on the OpenEXR format, visit:
31  *  http://openexr.com/
32  */
33 
34 #include <float.h>
35 #include <zlib.h>
36 
37 #include "libavutil/avassert.h"
38 #include "libavutil/common.h"
39 #include "libavutil/imgutils.h"
40 #include "libavutil/intfloat.h"
41 #include "libavutil/avstring.h"
42 #include "libavutil/opt.h"
43 #include "libavutil/color_utils.h"
44 
45 #include "avcodec.h"
46 #include "bytestream.h"
47 
48 #if HAVE_BIGENDIAN
49 #include "bswapdsp.h"
50 #endif
51 
52 #include "exrdsp.h"
53 #include "get_bits.h"
54 #include "internal.h"
55 #include "half2float.h"
56 #include "mathops.h"
57 #include "thread.h"
58 
59 enum ExrCompr {
60     EXR_RAW,
61     EXR_RLE,
62     EXR_ZIP1,
63     EXR_ZIP16,
64     EXR_PIZ,
65     EXR_PXR24,
66     EXR_B44,
67     EXR_B44A,
68     EXR_DWAA,
69     EXR_DWAB,
70     EXR_UNKN,
71 };
72 
73 enum ExrPixelType {
74     EXR_UINT,
75     EXR_HALF,
76     EXR_FLOAT,
77     EXR_UNKNOWN,
78 };
79 
80 enum ExrTileLevelMode {
81     EXR_TILE_LEVEL_ONE,
82     EXR_TILE_LEVEL_MIPMAP,
83     EXR_TILE_LEVEL_RIPMAP,
84     EXR_TILE_LEVEL_UNKNOWN,
85 };
86 
87 enum ExrTileLevelRound {
88     EXR_TILE_ROUND_UP,
89     EXR_TILE_ROUND_DOWN,
90     EXR_TILE_ROUND_UNKNOWN,
91 };
92 
93 typedef struct HuffEntry {
94     uint8_t  len;
95     uint16_t sym;
96     uint32_t code;
97 } HuffEntry;
98 
99 typedef struct EXRChannel {
100     int xsub, ysub;
101     enum ExrPixelType pixel_type;
102 } EXRChannel;
103 
104 typedef struct EXRTileAttribute {
105     int32_t xSize;
106     int32_t ySize;
107     enum ExrTileLevelMode level_mode;
108     enum ExrTileLevelRound level_round;
109 } EXRTileAttribute;
110 
111 typedef struct EXRThreadData {
112     uint8_t *uncompressed_data;
113     int uncompressed_size;
114 
115     uint8_t *tmp;
116     int tmp_size;
117 
118     uint8_t *bitmap;
119     uint16_t *lut;
120 
121     uint8_t *ac_data;
122     unsigned ac_size;
123 
124     uint8_t *dc_data;
125     unsigned dc_size;
126 
127     uint8_t *rle_data;
128     unsigned rle_size;
129 
130     uint8_t *rle_raw_data;
131     unsigned rle_raw_size;
132 
133     float block[3][64];
134 
135     int ysize, xsize;
136 
137     int channel_line_size;
138 
139     int run_sym;
140     HuffEntry *he;
141     uint64_t *freq;
142     VLC vlc;
143 } EXRThreadData;
144 
145 typedef struct EXRContext {
146     AVClass *class;
147     AVFrame *picture;
148     AVCodecContext *avctx;
149     ExrDSPContext dsp;
150 
151 #if HAVE_BIGENDIAN
152     BswapDSPContext bbdsp;
153 #endif
154 
155     enum ExrCompr compression;
156     enum ExrPixelType pixel_type;
157     int channel_offsets[4]; // 0 = red, 1 = green, 2 = blue and 3 = alpha
158     const AVPixFmtDescriptor *desc;
159 
160     int w, h;
161     uint32_t sar;
162     int32_t xmax, xmin;
163     int32_t ymax, ymin;
164     uint32_t xdelta, ydelta;
165 
166     int scan_lines_per_block;
167 
168     EXRTileAttribute tile_attr; /* header data attribute of tile */
169     int is_tile; /* 0 if scanline, 1 if tile */
170     int is_multipart;
171     int current_part;
172 
173     int is_luma;/* 1 if there is an Y plane */
174 
175     GetByteContext gb;
176     const uint8_t *buf;
177     int buf_size;
178 
179     EXRChannel *channels;
180     int nb_channels;
181     int current_channel_offset;
182     uint32_t chunk_count;
183 
184     EXRThreadData *thread_data;
185 
186     const char *layer;
187     int selected_part;
188 
189     enum AVColorTransferCharacteristic apply_trc_type;
190     float gamma;
191     union av_intfloat32 gamma_table[65536];
192 
193     uint32_t mantissatable[2048];
194     uint32_t exponenttable[64];
195     uint16_t offsettable[64];
196 } EXRContext;
197 
zip_uncompress(EXRContext * s,const uint8_t * src,int compressed_size,int uncompressed_size,EXRThreadData * td)198 static int zip_uncompress(EXRContext *s, const uint8_t *src, int compressed_size,
199                           int uncompressed_size, EXRThreadData *td)
200 {
201     unsigned long dest_len = uncompressed_size;
202 
203     if (uncompress(td->tmp, &dest_len, src, compressed_size) != Z_OK ||
204         dest_len != uncompressed_size)
205         return AVERROR_INVALIDDATA;
206 
207     av_assert1(uncompressed_size % 2 == 0);
208 
209     s->dsp.predictor(td->tmp, uncompressed_size);
210     s->dsp.reorder_pixels(td->uncompressed_data, td->tmp, uncompressed_size);
211 
212     return 0;
213 }
214 
rle(uint8_t * dst,const uint8_t * src,int compressed_size,int uncompressed_size)215 static int rle(uint8_t *dst, const uint8_t *src,
216                int compressed_size, int uncompressed_size)
217 {
218     uint8_t *d      = dst;
219     const int8_t *s = src;
220     int ssize       = compressed_size;
221     int dsize       = uncompressed_size;
222     uint8_t *dend   = d + dsize;
223     int count;
224 
225     while (ssize > 0) {
226         count = *s++;
227 
228         if (count < 0) {
229             count = -count;
230 
231             if ((dsize -= count) < 0 ||
232                 (ssize -= count + 1) < 0)
233                 return AVERROR_INVALIDDATA;
234 
235             while (count--)
236                 *d++ = *s++;
237         } else {
238             count++;
239 
240             if ((dsize -= count) < 0 ||
241                 (ssize -= 2) < 0)
242                 return AVERROR_INVALIDDATA;
243 
244             while (count--)
245                 *d++ = *s;
246 
247             s++;
248         }
249     }
250 
251     if (dend != d)
252         return AVERROR_INVALIDDATA;
253 
254     return 0;
255 }
256 
rle_uncompress(EXRContext * ctx,const uint8_t * src,int compressed_size,int uncompressed_size,EXRThreadData * td)257 static int rle_uncompress(EXRContext *ctx, const uint8_t *src, int compressed_size,
258                           int uncompressed_size, EXRThreadData *td)
259 {
260     rle(td->tmp, src, compressed_size, uncompressed_size);
261 
262     av_assert1(uncompressed_size % 2 == 0);
263 
264     ctx->dsp.predictor(td->tmp, uncompressed_size);
265     ctx->dsp.reorder_pixels(td->uncompressed_data, td->tmp, uncompressed_size);
266 
267     return 0;
268 }
269 
270 #define USHORT_RANGE (1 << 16)
271 #define BITMAP_SIZE  (1 << 13)
272 
reverse_lut(const uint8_t * bitmap,uint16_t * lut)273 static uint16_t reverse_lut(const uint8_t *bitmap, uint16_t *lut)
274 {
275     int i, k = 0;
276 
277     for (i = 0; i < USHORT_RANGE; i++)
278         if ((i == 0) || (bitmap[i >> 3] & (1 << (i & 7))))
279             lut[k++] = i;
280 
281     i = k - 1;
282 
283     memset(lut + k, 0, (USHORT_RANGE - k) * 2);
284 
285     return i;
286 }
287 
apply_lut(const uint16_t * lut,uint16_t * dst,int dsize)288 static void apply_lut(const uint16_t *lut, uint16_t *dst, int dsize)
289 {
290     int i;
291 
292     for (i = 0; i < dsize; ++i)
293         dst[i] = lut[dst[i]];
294 }
295 
296 #define HUF_ENCBITS 16  // literal (value) bit length
297 #define HUF_ENCSIZE ((1 << HUF_ENCBITS) + 1)  // encoding table size
298 
huf_canonical_code_table(uint64_t * freq)299 static void huf_canonical_code_table(uint64_t *freq)
300 {
301     uint64_t c, n[59] = { 0 };
302     int i;
303 
304     for (i = 0; i < HUF_ENCSIZE; i++)
305         n[freq[i]] += 1;
306 
307     c = 0;
308     for (i = 58; i > 0; --i) {
309         uint64_t nc = ((c + n[i]) >> 1);
310         n[i] = c;
311         c    = nc;
312     }
313 
314     for (i = 0; i < HUF_ENCSIZE; ++i) {
315         int l = freq[i];
316 
317         if (l > 0)
318             freq[i] = l | (n[l]++ << 6);
319     }
320 }
321 
322 #define SHORT_ZEROCODE_RUN  59
323 #define LONG_ZEROCODE_RUN   63
324 #define SHORTEST_LONG_RUN   (2 + LONG_ZEROCODE_RUN - SHORT_ZEROCODE_RUN)
325 #define LONGEST_LONG_RUN    (255 + SHORTEST_LONG_RUN)
326 
huf_unpack_enc_table(GetByteContext * gb,int32_t im,int32_t iM,uint64_t * freq)327 static int huf_unpack_enc_table(GetByteContext *gb,
328                                 int32_t im, int32_t iM, uint64_t *freq)
329 {
330     GetBitContext gbit;
331     int ret = init_get_bits8(&gbit, gb->buffer, bytestream2_get_bytes_left(gb));
332     if (ret < 0)
333         return ret;
334 
335     for (; im <= iM; im++) {
336         uint64_t l = freq[im] = get_bits(&gbit, 6);
337 
338         if (l == LONG_ZEROCODE_RUN) {
339             int zerun = get_bits(&gbit, 8) + SHORTEST_LONG_RUN;
340 
341             if (im + zerun > iM + 1)
342                 return AVERROR_INVALIDDATA;
343 
344             while (zerun--)
345                 freq[im++] = 0;
346 
347             im--;
348         } else if (l >= SHORT_ZEROCODE_RUN) {
349             int zerun = l - SHORT_ZEROCODE_RUN + 2;
350 
351             if (im + zerun > iM + 1)
352                 return AVERROR_INVALIDDATA;
353 
354             while (zerun--)
355                 freq[im++] = 0;
356 
357             im--;
358         }
359     }
360 
361     bytestream2_skip(gb, (get_bits_count(&gbit) + 7) / 8);
362     huf_canonical_code_table(freq);
363 
364     return 0;
365 }
366 
huf_build_dec_table(EXRContext * s,EXRThreadData * td,int im,int iM)367 static int huf_build_dec_table(EXRContext *s,
368                                EXRThreadData *td, int im, int iM)
369 {
370     int j = 0;
371 
372     td->run_sym = -1;
373     for (int i = im; i < iM; i++) {
374         td->he[j].sym = i;
375         td->he[j].len = td->freq[i] & 63;
376         td->he[j].code = td->freq[i] >> 6;
377         if (td->he[j].len > 32) {
378             avpriv_request_sample(s->avctx, "Too big code length");
379             return AVERROR_PATCHWELCOME;
380         }
381         if (td->he[j].len > 0)
382             j++;
383         else
384             td->run_sym = i;
385     }
386 
387     if (im > 0)
388         td->run_sym = 0;
389     else if (iM < 65535)
390         td->run_sym = 65535;
391 
392     if (td->run_sym == -1) {
393         avpriv_request_sample(s->avctx, "No place for run symbol");
394         return AVERROR_PATCHWELCOME;
395     }
396 
397     td->he[j].sym = td->run_sym;
398     td->he[j].len = td->freq[iM] & 63;
399     if (td->he[j].len > 32) {
400         avpriv_request_sample(s->avctx, "Too big code length");
401         return AVERROR_PATCHWELCOME;
402     }
403     td->he[j].code = td->freq[iM] >> 6;
404     j++;
405 
406     ff_free_vlc(&td->vlc);
407     return ff_init_vlc_sparse(&td->vlc, 12, j,
408                               &td->he[0].len, sizeof(td->he[0]), sizeof(td->he[0].len),
409                               &td->he[0].code, sizeof(td->he[0]), sizeof(td->he[0].code),
410                               &td->he[0].sym, sizeof(td->he[0]), sizeof(td->he[0].sym), 0);
411 }
412 
huf_decode(VLC * vlc,GetByteContext * gb,int nbits,int run_sym,int no,uint16_t * out)413 static int huf_decode(VLC *vlc, GetByteContext *gb, int nbits, int run_sym,
414                       int no, uint16_t *out)
415 {
416     GetBitContext gbit;
417     int oe = 0;
418 
419     init_get_bits(&gbit, gb->buffer, nbits);
420     while (get_bits_left(&gbit) > 0 && oe < no) {
421         uint16_t x = get_vlc2(&gbit, vlc->table, 12, 3);
422 
423         if (x == run_sym) {
424             int run = get_bits(&gbit, 8);
425             uint16_t fill;
426 
427             if (oe == 0 || oe + run > no)
428                 return AVERROR_INVALIDDATA;
429 
430             fill = out[oe - 1];
431 
432             while (run-- > 0)
433                 out[oe++] = fill;
434         } else {
435             out[oe++] = x;
436         }
437     }
438 
439     return 0;
440 }
441 
huf_uncompress(EXRContext * s,EXRThreadData * td,GetByteContext * gb,uint16_t * dst,int dst_size)442 static int huf_uncompress(EXRContext *s,
443                           EXRThreadData *td,
444                           GetByteContext *gb,
445                           uint16_t *dst, int dst_size)
446 {
447     int32_t im, iM;
448     uint32_t nBits;
449     int ret;
450 
451     im       = bytestream2_get_le32(gb);
452     iM       = bytestream2_get_le32(gb);
453     bytestream2_skip(gb, 4);
454     nBits = bytestream2_get_le32(gb);
455     if (im < 0 || im >= HUF_ENCSIZE ||
456         iM < 0 || iM >= HUF_ENCSIZE)
457         return AVERROR_INVALIDDATA;
458 
459     bytestream2_skip(gb, 4);
460 
461     if (!td->freq)
462         td->freq = av_malloc_array(HUF_ENCSIZE, sizeof(*td->freq));
463     if (!td->he)
464         td->he = av_calloc(HUF_ENCSIZE, sizeof(*td->he));
465     if (!td->freq || !td->he) {
466         ret = AVERROR(ENOMEM);
467         return ret;
468     }
469 
470     memset(td->freq, 0, sizeof(*td->freq) * HUF_ENCSIZE);
471     if ((ret = huf_unpack_enc_table(gb, im, iM, td->freq)) < 0)
472         return ret;
473 
474     if (nBits > 8 * bytestream2_get_bytes_left(gb)) {
475         ret = AVERROR_INVALIDDATA;
476         return ret;
477     }
478 
479     if ((ret = huf_build_dec_table(s, td, im, iM)) < 0)
480         return ret;
481     return huf_decode(&td->vlc, gb, nBits, td->run_sym, dst_size, dst);
482 }
483 
wdec14(uint16_t l,uint16_t h,uint16_t * a,uint16_t * b)484 static inline void wdec14(uint16_t l, uint16_t h, uint16_t *a, uint16_t *b)
485 {
486     int16_t ls = l;
487     int16_t hs = h;
488     int hi     = hs;
489     int ai     = ls + (hi & 1) + (hi >> 1);
490     int16_t as = ai;
491     int16_t bs = ai - hi;
492 
493     *a = as;
494     *b = bs;
495 }
496 
497 #define NBITS      16
498 #define A_OFFSET  (1 << (NBITS - 1))
499 #define MOD_MASK  ((1 << NBITS) - 1)
500 
wdec16(uint16_t l,uint16_t h,uint16_t * a,uint16_t * b)501 static inline void wdec16(uint16_t l, uint16_t h, uint16_t *a, uint16_t *b)
502 {
503     int m  = l;
504     int d  = h;
505     int bb = (m - (d >> 1)) & MOD_MASK;
506     int aa = (d + bb - A_OFFSET) & MOD_MASK;
507     *b = bb;
508     *a = aa;
509 }
510 
wav_decode(uint16_t * in,int nx,int ox,int ny,int oy,uint16_t mx)511 static void wav_decode(uint16_t *in, int nx, int ox,
512                        int ny, int oy, uint16_t mx)
513 {
514     int w14 = (mx < (1 << 14));
515     int n   = (nx > ny) ? ny : nx;
516     int p   = 1;
517     int p2;
518 
519     while (p <= n)
520         p <<= 1;
521 
522     p >>= 1;
523     p2  = p;
524     p >>= 1;
525 
526     while (p >= 1) {
527         uint16_t *py = in;
528         uint16_t *ey = in + oy * (ny - p2);
529         uint16_t i00, i01, i10, i11;
530         int oy1 = oy * p;
531         int oy2 = oy * p2;
532         int ox1 = ox * p;
533         int ox2 = ox * p2;
534 
535         for (; py <= ey; py += oy2) {
536             uint16_t *px = py;
537             uint16_t *ex = py + ox * (nx - p2);
538 
539             for (; px <= ex; px += ox2) {
540                 uint16_t *p01 = px + ox1;
541                 uint16_t *p10 = px + oy1;
542                 uint16_t *p11 = p10 + ox1;
543 
544                 if (w14) {
545                     wdec14(*px, *p10, &i00, &i10);
546                     wdec14(*p01, *p11, &i01, &i11);
547                     wdec14(i00, i01, px, p01);
548                     wdec14(i10, i11, p10, p11);
549                 } else {
550                     wdec16(*px, *p10, &i00, &i10);
551                     wdec16(*p01, *p11, &i01, &i11);
552                     wdec16(i00, i01, px, p01);
553                     wdec16(i10, i11, p10, p11);
554                 }
555             }
556 
557             if (nx & p) {
558                 uint16_t *p10 = px + oy1;
559 
560                 if (w14)
561                     wdec14(*px, *p10, &i00, p10);
562                 else
563                     wdec16(*px, *p10, &i00, p10);
564 
565                 *px = i00;
566             }
567         }
568 
569         if (ny & p) {
570             uint16_t *px = py;
571             uint16_t *ex = py + ox * (nx - p2);
572 
573             for (; px <= ex; px += ox2) {
574                 uint16_t *p01 = px + ox1;
575 
576                 if (w14)
577                     wdec14(*px, *p01, &i00, p01);
578                 else
579                     wdec16(*px, *p01, &i00, p01);
580 
581                 *px = i00;
582             }
583         }
584 
585         p2  = p;
586         p >>= 1;
587     }
588 }
589 
piz_uncompress(EXRContext * s,const uint8_t * src,int ssize,int dsize,EXRThreadData * td)590 static int piz_uncompress(EXRContext *s, const uint8_t *src, int ssize,
591                           int dsize, EXRThreadData *td)
592 {
593     GetByteContext gb;
594     uint16_t maxval, min_non_zero, max_non_zero;
595     uint16_t *ptr;
596     uint16_t *tmp = (uint16_t *)td->tmp;
597     uint16_t *out;
598     uint16_t *in;
599     int ret, i, j;
600     int pixel_half_size;/* 1 for half, 2 for float and uint32 */
601     EXRChannel *channel;
602     int tmp_offset;
603 
604     if (!td->bitmap)
605         td->bitmap = av_malloc(BITMAP_SIZE);
606     if (!td->lut)
607         td->lut = av_malloc(1 << 17);
608     if (!td->bitmap || !td->lut) {
609         av_freep(&td->bitmap);
610         av_freep(&td->lut);
611         return AVERROR(ENOMEM);
612     }
613 
614     bytestream2_init(&gb, src, ssize);
615     min_non_zero = bytestream2_get_le16(&gb);
616     max_non_zero = bytestream2_get_le16(&gb);
617 
618     if (max_non_zero >= BITMAP_SIZE)
619         return AVERROR_INVALIDDATA;
620 
621     memset(td->bitmap, 0, FFMIN(min_non_zero, BITMAP_SIZE));
622     if (min_non_zero <= max_non_zero)
623         bytestream2_get_buffer(&gb, td->bitmap + min_non_zero,
624                                max_non_zero - min_non_zero + 1);
625     memset(td->bitmap + max_non_zero + 1, 0, BITMAP_SIZE - max_non_zero - 1);
626 
627     maxval = reverse_lut(td->bitmap, td->lut);
628 
629     bytestream2_skip(&gb, 4);
630     ret = huf_uncompress(s, td, &gb, tmp, dsize / sizeof(uint16_t));
631     if (ret)
632         return ret;
633 
634     ptr = tmp;
635     for (i = 0; i < s->nb_channels; i++) {
636         channel = &s->channels[i];
637 
638         if (channel->pixel_type == EXR_HALF)
639             pixel_half_size = 1;
640         else
641             pixel_half_size = 2;
642 
643         for (j = 0; j < pixel_half_size; j++)
644             wav_decode(ptr + j, td->xsize, pixel_half_size, td->ysize,
645                        td->xsize * pixel_half_size, maxval);
646         ptr += td->xsize * td->ysize * pixel_half_size;
647     }
648 
649     apply_lut(td->lut, tmp, dsize / sizeof(uint16_t));
650 
651     out = (uint16_t *)td->uncompressed_data;
652     for (i = 0; i < td->ysize; i++) {
653         tmp_offset = 0;
654         for (j = 0; j < s->nb_channels; j++) {
655             channel = &s->channels[j];
656             if (channel->pixel_type == EXR_HALF)
657                 pixel_half_size = 1;
658             else
659                 pixel_half_size = 2;
660 
661             in = tmp + tmp_offset * td->xsize * td->ysize + i * td->xsize * pixel_half_size;
662             tmp_offset += pixel_half_size;
663 
664 #if HAVE_BIGENDIAN
665             s->bbdsp.bswap16_buf(out, in, td->xsize * pixel_half_size);
666 #else
667             memcpy(out, in, td->xsize * 2 * pixel_half_size);
668 #endif
669             out += td->xsize * pixel_half_size;
670         }
671     }
672 
673     return 0;
674 }
675 
pxr24_uncompress(EXRContext * s,const uint8_t * src,int compressed_size,int uncompressed_size,EXRThreadData * td)676 static int pxr24_uncompress(EXRContext *s, const uint8_t *src,
677                             int compressed_size, int uncompressed_size,
678                             EXRThreadData *td)
679 {
680     unsigned long dest_len, expected_len = 0;
681     const uint8_t *in = td->tmp;
682     uint8_t *out;
683     int c, i, j;
684 
685     for (i = 0; i < s->nb_channels; i++) {
686         if (s->channels[i].pixel_type == EXR_FLOAT) {
687             expected_len += (td->xsize * td->ysize * 3);/* PRX 24 store float in 24 bit instead of 32 */
688         } else if (s->channels[i].pixel_type == EXR_HALF) {
689             expected_len += (td->xsize * td->ysize * 2);
690         } else {//UINT 32
691             expected_len += (td->xsize * td->ysize * 4);
692         }
693     }
694 
695     dest_len = expected_len;
696 
697     if (uncompress(td->tmp, &dest_len, src, compressed_size) != Z_OK) {
698         return AVERROR_INVALIDDATA;
699     } else if (dest_len != expected_len) {
700         return AVERROR_INVALIDDATA;
701     }
702 
703     out = td->uncompressed_data;
704     for (i = 0; i < td->ysize; i++)
705         for (c = 0; c < s->nb_channels; c++) {
706             EXRChannel *channel = &s->channels[c];
707             const uint8_t *ptr[4];
708             uint32_t pixel = 0;
709 
710             switch (channel->pixel_type) {
711             case EXR_FLOAT:
712                 ptr[0] = in;
713                 ptr[1] = ptr[0] + td->xsize;
714                 ptr[2] = ptr[1] + td->xsize;
715                 in     = ptr[2] + td->xsize;
716 
717                 for (j = 0; j < td->xsize; ++j) {
718                     uint32_t diff = ((unsigned)*(ptr[0]++) << 24) |
719                                     (*(ptr[1]++) << 16) |
720                                     (*(ptr[2]++) << 8);
721                     pixel += diff;
722                     bytestream_put_le32(&out, pixel);
723                 }
724                 break;
725             case EXR_HALF:
726                 ptr[0] = in;
727                 ptr[1] = ptr[0] + td->xsize;
728                 in     = ptr[1] + td->xsize;
729                 for (j = 0; j < td->xsize; j++) {
730                     uint32_t diff = (*(ptr[0]++) << 8) | *(ptr[1]++);
731 
732                     pixel += diff;
733                     bytestream_put_le16(&out, pixel);
734                 }
735                 break;
736             case EXR_UINT:
737                 ptr[0] = in;
738                 ptr[1] = ptr[0] + s->xdelta;
739                 ptr[2] = ptr[1] + s->xdelta;
740                 ptr[3] = ptr[2] + s->xdelta;
741                 in     = ptr[3] + s->xdelta;
742 
743                 for (j = 0; j < s->xdelta; ++j) {
744                     uint32_t diff = ((uint32_t)*(ptr[0]++) << 24) |
745                     (*(ptr[1]++) << 16) |
746                     (*(ptr[2]++) << 8 ) |
747                     (*(ptr[3]++));
748                     pixel += diff;
749                     bytestream_put_le32(&out, pixel);
750                 }
751                 break;
752             default:
753                 return AVERROR_INVALIDDATA;
754             }
755         }
756 
757     return 0;
758 }
759 
unpack_14(const uint8_t b[14],uint16_t s[16])760 static void unpack_14(const uint8_t b[14], uint16_t s[16])
761 {
762     unsigned short shift = (b[ 2] >> 2) & 15;
763     unsigned short bias = (0x20 << shift);
764     int i;
765 
766     s[ 0] = (b[0] << 8) | b[1];
767 
768     s[ 4] = s[ 0] + ((((b[ 2] << 4) | (b[ 3] >> 4)) & 0x3f) << shift) - bias;
769     s[ 8] = s[ 4] + ((((b[ 3] << 2) | (b[ 4] >> 6)) & 0x3f) << shift) - bias;
770     s[12] = s[ 8] +   ((b[ 4]                       & 0x3f) << shift) - bias;
771 
772     s[ 1] = s[ 0] +   ((b[ 5] >> 2)                         << shift) - bias;
773     s[ 5] = s[ 4] + ((((b[ 5] << 4) | (b[ 6] >> 4)) & 0x3f) << shift) - bias;
774     s[ 9] = s[ 8] + ((((b[ 6] << 2) | (b[ 7] >> 6)) & 0x3f) << shift) - bias;
775     s[13] = s[12] +   ((b[ 7]                       & 0x3f) << shift) - bias;
776 
777     s[ 2] = s[ 1] +   ((b[ 8] >> 2)                         << shift) - bias;
778     s[ 6] = s[ 5] + ((((b[ 8] << 4) | (b[ 9] >> 4)) & 0x3f) << shift) - bias;
779     s[10] = s[ 9] + ((((b[ 9] << 2) | (b[10] >> 6)) & 0x3f) << shift) - bias;
780     s[14] = s[13] +   ((b[10]                       & 0x3f) << shift) - bias;
781 
782     s[ 3] = s[ 2] +   ((b[11] >> 2)                         << shift) - bias;
783     s[ 7] = s[ 6] + ((((b[11] << 4) | (b[12] >> 4)) & 0x3f) << shift) - bias;
784     s[11] = s[10] + ((((b[12] << 2) | (b[13] >> 6)) & 0x3f) << shift) - bias;
785     s[15] = s[14] +   ((b[13]                       & 0x3f) << shift) - bias;
786 
787     for (i = 0; i < 16; ++i) {
788         if (s[i] & 0x8000)
789             s[i] &= 0x7fff;
790         else
791             s[i] = ~s[i];
792     }
793 }
794 
unpack_3(const uint8_t b[3],uint16_t s[16])795 static void unpack_3(const uint8_t b[3], uint16_t s[16])
796 {
797     int i;
798 
799     s[0] = (b[0] << 8) | b[1];
800 
801     if (s[0] & 0x8000)
802         s[0] &= 0x7fff;
803     else
804         s[0] = ~s[0];
805 
806     for (i = 1; i < 16; i++)
807         s[i] = s[0];
808 }
809 
810 
b44_uncompress(EXRContext * s,const uint8_t * src,int compressed_size,int uncompressed_size,EXRThreadData * td)811 static int b44_uncompress(EXRContext *s, const uint8_t *src, int compressed_size,
812                           int uncompressed_size, EXRThreadData *td) {
813     const int8_t *sr = src;
814     int stay_to_uncompress = compressed_size;
815     int nb_b44_block_w, nb_b44_block_h;
816     int index_tl_x, index_tl_y, index_out, index_tmp;
817     uint16_t tmp_buffer[16]; /* B44 use 4x4 half float pixel */
818     int c, iY, iX, y, x;
819     int target_channel_offset = 0;
820 
821     /* calc B44 block count */
822     nb_b44_block_w = td->xsize / 4;
823     if ((td->xsize % 4) != 0)
824         nb_b44_block_w++;
825 
826     nb_b44_block_h = td->ysize / 4;
827     if ((td->ysize % 4) != 0)
828         nb_b44_block_h++;
829 
830     for (c = 0; c < s->nb_channels; c++) {
831         if (s->channels[c].pixel_type == EXR_HALF) {/* B44 only compress half float data */
832             for (iY = 0; iY < nb_b44_block_h; iY++) {
833                 for (iX = 0; iX < nb_b44_block_w; iX++) {/* For each B44 block */
834                     if (stay_to_uncompress < 3) {
835                         av_log(s, AV_LOG_ERROR, "Not enough data for B44A block: %d", stay_to_uncompress);
836                         return AVERROR_INVALIDDATA;
837                     }
838 
839                     if (src[compressed_size - stay_to_uncompress + 2] == 0xfc) { /* B44A block */
840                         unpack_3(sr, tmp_buffer);
841                         sr += 3;
842                         stay_to_uncompress -= 3;
843                     }  else {/* B44 Block */
844                         if (stay_to_uncompress < 14) {
845                             av_log(s, AV_LOG_ERROR, "Not enough data for B44 block: %d", stay_to_uncompress);
846                             return AVERROR_INVALIDDATA;
847                         }
848                         unpack_14(sr, tmp_buffer);
849                         sr += 14;
850                         stay_to_uncompress -= 14;
851                     }
852 
853                     /* copy data to uncompress buffer (B44 block can exceed target resolution)*/
854                     index_tl_x = iX * 4;
855                     index_tl_y = iY * 4;
856 
857                     for (y = index_tl_y; y < FFMIN(index_tl_y + 4, td->ysize); y++) {
858                         for (x = index_tl_x; x < FFMIN(index_tl_x + 4, td->xsize); x++) {
859                             index_out = target_channel_offset * td->xsize + y * td->channel_line_size + 2 * x;
860                             index_tmp = (y-index_tl_y) * 4 + (x-index_tl_x);
861                             td->uncompressed_data[index_out] = tmp_buffer[index_tmp] & 0xff;
862                             td->uncompressed_data[index_out + 1] = tmp_buffer[index_tmp] >> 8;
863                         }
864                     }
865                 }
866             }
867             target_channel_offset += 2;
868         } else {/* Float or UINT 32 channel */
869             if (stay_to_uncompress < td->ysize * td->xsize * 4) {
870                 av_log(s, AV_LOG_ERROR, "Not enough data for uncompress channel: %d", stay_to_uncompress);
871                 return AVERROR_INVALIDDATA;
872             }
873 
874             for (y = 0; y < td->ysize; y++) {
875                 index_out = target_channel_offset * td->xsize + y * td->channel_line_size;
876                 memcpy(&td->uncompressed_data[index_out], sr, td->xsize * 4);
877                 sr += td->xsize * 4;
878             }
879             target_channel_offset += 4;
880 
881             stay_to_uncompress -= td->ysize * td->xsize * 4;
882         }
883     }
884 
885     return 0;
886 }
887 
ac_uncompress(EXRContext * s,GetByteContext * gb,float * block)888 static int ac_uncompress(EXRContext *s, GetByteContext *gb, float *block)
889 {
890     int ret = 0, n = 1;
891 
892     while (n < 64) {
893         uint16_t val = bytestream2_get_ne16(gb);
894 
895         if (val == 0xff00) {
896             n = 64;
897         } else if ((val >> 8) == 0xff) {
898             n += val & 0xff;
899         } else {
900             ret = n;
901             block[ff_zigzag_direct[n]] = av_int2float(half2float(val,
902                                                       s->mantissatable,
903                                                       s->exponenttable,
904                                                       s->offsettable));
905             n++;
906         }
907     }
908 
909     return ret;
910 }
911 
idct_1d(float * blk,int step)912 static void idct_1d(float *blk, int step)
913 {
914     const float a = .5f * cosf(    M_PI / 4.f);
915     const float b = .5f * cosf(    M_PI / 16.f);
916     const float c = .5f * cosf(    M_PI / 8.f);
917     const float d = .5f * cosf(3.f*M_PI / 16.f);
918     const float e = .5f * cosf(5.f*M_PI / 16.f);
919     const float f = .5f * cosf(3.f*M_PI / 8.f);
920     const float g = .5f * cosf(7.f*M_PI / 16.f);
921 
922     float alpha[4], beta[4], theta[4], gamma[4];
923 
924     alpha[0] = c * blk[2 * step];
925     alpha[1] = f * blk[2 * step];
926     alpha[2] = c * blk[6 * step];
927     alpha[3] = f * blk[6 * step];
928 
929     beta[0] = b * blk[1 * step] + d * blk[3 * step] + e * blk[5 * step] + g * blk[7 * step];
930     beta[1] = d * blk[1 * step] - g * blk[3 * step] - b * blk[5 * step] - e * blk[7 * step];
931     beta[2] = e * blk[1 * step] - b * blk[3 * step] + g * blk[5 * step] + d * blk[7 * step];
932     beta[3] = g * blk[1 * step] - e * blk[3 * step] + d * blk[5 * step] - b * blk[7 * step];
933 
934     theta[0] = a * (blk[0 * step] + blk[4 * step]);
935     theta[3] = a * (blk[0 * step] - blk[4 * step]);
936 
937     theta[1] = alpha[0] + alpha[3];
938     theta[2] = alpha[1] - alpha[2];
939 
940     gamma[0] = theta[0] + theta[1];
941     gamma[1] = theta[3] + theta[2];
942     gamma[2] = theta[3] - theta[2];
943     gamma[3] = theta[0] - theta[1];
944 
945     blk[0 * step] = gamma[0] + beta[0];
946     blk[1 * step] = gamma[1] + beta[1];
947     blk[2 * step] = gamma[2] + beta[2];
948     blk[3 * step] = gamma[3] + beta[3];
949 
950     blk[4 * step] = gamma[3] - beta[3];
951     blk[5 * step] = gamma[2] - beta[2];
952     blk[6 * step] = gamma[1] - beta[1];
953     blk[7 * step] = gamma[0] - beta[0];
954 }
955 
dct_inverse(float * block)956 static void dct_inverse(float *block)
957 {
958     for (int i = 0; i < 8; i++)
959         idct_1d(block + i, 8);
960 
961     for (int i = 0; i < 8; i++) {
962         idct_1d(block, 1);
963         block += 8;
964     }
965 }
966 
convert(float y,float u,float v,float * b,float * g,float * r)967 static void convert(float y, float u, float v,
968                     float *b, float *g, float *r)
969 {
970     *r = y               + 1.5747f * v;
971     *g = y - 0.1873f * u - 0.4682f * v;
972     *b = y + 1.8556f * u;
973 }
974 
to_linear(float x,float scale)975 static float to_linear(float x, float scale)
976 {
977     float ax = fabsf(x);
978 
979     if (ax <= 1.f) {
980         return FFSIGN(x) * powf(ax, 2.2f * scale);
981     } else {
982         const float log_base = expf(2.2f * scale);
983 
984         return FFSIGN(x) * powf(log_base, ax - 1.f);
985     }
986 }
987 
dwa_uncompress(EXRContext * s,const uint8_t * src,int compressed_size,int uncompressed_size,EXRThreadData * td)988 static int dwa_uncompress(EXRContext *s, const uint8_t *src, int compressed_size,
989                           int uncompressed_size, EXRThreadData *td)
990 {
991     int64_t version, lo_usize, lo_size;
992     int64_t ac_size, dc_size, rle_usize, rle_csize, rle_raw_size;
993     int64_t ac_count, dc_count, ac_compression;
994     const int dc_w = td->xsize >> 3;
995     const int dc_h = td->ysize >> 3;
996     GetByteContext gb, agb;
997     int skip, ret;
998 
999     if (compressed_size <= 88)
1000         return AVERROR_INVALIDDATA;
1001 
1002     version = AV_RL64(src + 0);
1003     if (version != 2)
1004         return AVERROR_INVALIDDATA;
1005 
1006     lo_usize = AV_RL64(src + 8);
1007     lo_size = AV_RL64(src + 16);
1008     ac_size = AV_RL64(src + 24);
1009     dc_size = AV_RL64(src + 32);
1010     rle_csize = AV_RL64(src + 40);
1011     rle_usize = AV_RL64(src + 48);
1012     rle_raw_size = AV_RL64(src + 56);
1013     ac_count = AV_RL64(src + 64);
1014     dc_count = AV_RL64(src + 72);
1015     ac_compression = AV_RL64(src + 80);
1016 
1017     if (   compressed_size < (uint64_t)(lo_size | ac_size | dc_size | rle_csize) || compressed_size < 88LL + lo_size + ac_size + dc_size + rle_csize
1018         || ac_count > (uint64_t)INT_MAX/2
1019     )
1020         return AVERROR_INVALIDDATA;
1021 
1022     bytestream2_init(&gb, src + 88, compressed_size - 88);
1023     skip = bytestream2_get_le16(&gb);
1024     if (skip < 2)
1025         return AVERROR_INVALIDDATA;
1026 
1027     bytestream2_skip(&gb, skip - 2);
1028 
1029     if (lo_size > 0) {
1030         if (lo_usize > uncompressed_size)
1031             return AVERROR_INVALIDDATA;
1032         bytestream2_skip(&gb, lo_size);
1033     }
1034 
1035     if (ac_size > 0) {
1036         unsigned long dest_len;
1037         GetByteContext agb = gb;
1038 
1039         if (ac_count > 3LL * td->xsize * s->scan_lines_per_block)
1040             return AVERROR_INVALIDDATA;
1041 
1042         dest_len = ac_count * 2LL;
1043 
1044         av_fast_padded_malloc(&td->ac_data, &td->ac_size, dest_len);
1045         if (!td->ac_data)
1046             return AVERROR(ENOMEM);
1047 
1048         switch (ac_compression) {
1049         case 0:
1050             ret = huf_uncompress(s, td, &agb, (int16_t *)td->ac_data, ac_count);
1051             if (ret < 0)
1052                 return ret;
1053             break;
1054         case 1:
1055             if (uncompress(td->ac_data, &dest_len, agb.buffer, ac_size) != Z_OK ||
1056                 dest_len != ac_count * 2LL)
1057                 return AVERROR_INVALIDDATA;
1058             break;
1059         default:
1060             return AVERROR_INVALIDDATA;
1061         }
1062 
1063         bytestream2_skip(&gb, ac_size);
1064     }
1065 
1066     {
1067         unsigned long dest_len;
1068         GetByteContext agb = gb;
1069 
1070         if (dc_count != dc_w * dc_h * 3)
1071             return AVERROR_INVALIDDATA;
1072 
1073         dest_len = dc_count * 2LL;
1074 
1075         av_fast_padded_malloc(&td->dc_data, &td->dc_size, FFALIGN(dest_len, 64) * 2);
1076         if (!td->dc_data)
1077             return AVERROR(ENOMEM);
1078 
1079         if (uncompress(td->dc_data + FFALIGN(dest_len, 64), &dest_len, agb.buffer, dc_size) != Z_OK ||
1080             (dest_len != dc_count * 2LL))
1081             return AVERROR_INVALIDDATA;
1082 
1083         s->dsp.predictor(td->dc_data + FFALIGN(dest_len, 64), dest_len);
1084         s->dsp.reorder_pixels(td->dc_data, td->dc_data + FFALIGN(dest_len, 64), dest_len);
1085 
1086         bytestream2_skip(&gb, dc_size);
1087     }
1088 
1089     if (rle_raw_size > 0 && rle_csize > 0 && rle_usize > 0) {
1090         unsigned long dest_len = rle_usize;
1091 
1092         av_fast_padded_malloc(&td->rle_data, &td->rle_size, rle_usize);
1093         if (!td->rle_data)
1094             return AVERROR(ENOMEM);
1095 
1096         av_fast_padded_malloc(&td->rle_raw_data, &td->rle_raw_size, rle_raw_size);
1097         if (!td->rle_raw_data)
1098             return AVERROR(ENOMEM);
1099 
1100         if (uncompress(td->rle_data, &dest_len, gb.buffer, rle_csize) != Z_OK ||
1101             (dest_len != rle_usize))
1102             return AVERROR_INVALIDDATA;
1103 
1104         ret = rle(td->rle_raw_data, td->rle_data, rle_usize, rle_raw_size);
1105         if (ret < 0)
1106             return ret;
1107         bytestream2_skip(&gb, rle_csize);
1108     }
1109 
1110     bytestream2_init(&agb, td->ac_data, ac_count * 2);
1111 
1112     for (int y = 0; y < td->ysize; y += 8) {
1113         for (int x = 0; x < td->xsize; x += 8) {
1114             memset(td->block, 0, sizeof(td->block));
1115 
1116             for (int j = 0; j < 3; j++) {
1117                 float *block = td->block[j];
1118                 const int idx = (x >> 3) + (y >> 3) * dc_w + dc_w * dc_h * j;
1119                 uint16_t *dc = (uint16_t *)td->dc_data;
1120                 union av_intfloat32 dc_val;
1121 
1122                 dc_val.i = half2float(dc[idx], s->mantissatable,
1123                                       s->exponenttable, s->offsettable);
1124 
1125                 block[0] = dc_val.f;
1126                 ac_uncompress(s, &agb, block);
1127                 dct_inverse(block);
1128             }
1129 
1130             {
1131                 const float scale = s->pixel_type == EXR_FLOAT ? 2.f : 1.f;
1132                 const int o = s->nb_channels == 4;
1133                 float *bo = ((float *)td->uncompressed_data) +
1134                     y * td->xsize * s->nb_channels + td->xsize * (o + 0) + x;
1135                 float *go = ((float *)td->uncompressed_data) +
1136                     y * td->xsize * s->nb_channels + td->xsize * (o + 1) + x;
1137                 float *ro = ((float *)td->uncompressed_data) +
1138                     y * td->xsize * s->nb_channels + td->xsize * (o + 2) + x;
1139                 float *yb = td->block[0];
1140                 float *ub = td->block[1];
1141                 float *vb = td->block[2];
1142 
1143                 for (int yy = 0; yy < 8; yy++) {
1144                     for (int xx = 0; xx < 8; xx++) {
1145                         const int idx = xx + yy * 8;
1146 
1147                         convert(yb[idx], ub[idx], vb[idx], &bo[xx], &go[xx], &ro[xx]);
1148 
1149                         bo[xx] = to_linear(bo[xx], scale);
1150                         go[xx] = to_linear(go[xx], scale);
1151                         ro[xx] = to_linear(ro[xx], scale);
1152                     }
1153 
1154                     bo += td->xsize * s->nb_channels;
1155                     go += td->xsize * s->nb_channels;
1156                     ro += td->xsize * s->nb_channels;
1157                 }
1158             }
1159         }
1160     }
1161 
1162     if (s->nb_channels < 4)
1163         return 0;
1164 
1165     for (int y = 0; y < td->ysize && td->rle_raw_data; y++) {
1166         uint32_t *ao = ((uint32_t *)td->uncompressed_data) + y * td->xsize * s->nb_channels;
1167         uint8_t *ai0 = td->rle_raw_data + y * td->xsize;
1168         uint8_t *ai1 = td->rle_raw_data + y * td->xsize + rle_raw_size / 2;
1169 
1170         for (int x = 0; x < td->xsize; x++) {
1171             uint16_t ha = ai0[x] | (ai1[x] << 8);
1172 
1173             ao[x] = half2float(ha, s->mantissatable, s->exponenttable, s->offsettable);
1174         }
1175     }
1176 
1177     return 0;
1178 }
1179 
decode_block(AVCodecContext * avctx,void * tdata,int jobnr,int threadnr)1180 static int decode_block(AVCodecContext *avctx, void *tdata,
1181                         int jobnr, int threadnr)
1182 {
1183     EXRContext *s = avctx->priv_data;
1184     AVFrame *const p = s->picture;
1185     EXRThreadData *td = &s->thread_data[threadnr];
1186     const uint8_t *channel_buffer[4] = { 0 };
1187     const uint8_t *buf = s->buf;
1188     uint64_t line_offset, uncompressed_size;
1189     uint8_t *ptr;
1190     uint32_t data_size;
1191     int line, col = 0;
1192     uint64_t tile_x, tile_y, tile_level_x, tile_level_y;
1193     const uint8_t *src;
1194     int step = s->desc->flags & AV_PIX_FMT_FLAG_FLOAT ? 4 : 2 * s->desc->nb_components;
1195     int bxmin = 0, axmax = 0, window_xoffset = 0;
1196     int window_xmin, window_xmax, window_ymin, window_ymax;
1197     int data_xoffset, data_yoffset, data_window_offset, xsize, ysize;
1198     int i, x, buf_size = s->buf_size;
1199     int c, rgb_channel_count;
1200     float one_gamma = 1.0f / s->gamma;
1201     avpriv_trc_function trc_func = avpriv_get_trc_function_from_trc(s->apply_trc_type);
1202     int ret;
1203 
1204     line_offset = AV_RL64(s->gb.buffer + jobnr * 8);
1205 
1206     if (s->is_tile) {
1207         if (buf_size < 20 || line_offset > buf_size - 20)
1208             return AVERROR_INVALIDDATA;
1209 
1210         src  = buf + line_offset + 20;
1211         if (s->is_multipart)
1212             src += 4;
1213 
1214         tile_x = AV_RL32(src - 20);
1215         tile_y = AV_RL32(src - 16);
1216         tile_level_x = AV_RL32(src - 12);
1217         tile_level_y = AV_RL32(src - 8);
1218 
1219         data_size = AV_RL32(src - 4);
1220         if (data_size <= 0 || data_size > buf_size - line_offset - 20)
1221             return AVERROR_INVALIDDATA;
1222 
1223         if (tile_level_x || tile_level_y) { /* tile level, is not the full res level */
1224             avpriv_report_missing_feature(s->avctx, "Subres tile before full res tile");
1225             return AVERROR_PATCHWELCOME;
1226         }
1227 
1228         if (tile_x && s->tile_attr.xSize + (int64_t)FFMAX(s->xmin, 0) >= INT_MAX / tile_x )
1229             return AVERROR_INVALIDDATA;
1230         if (tile_y && s->tile_attr.ySize + (int64_t)FFMAX(s->ymin, 0) >= INT_MAX / tile_y )
1231             return AVERROR_INVALIDDATA;
1232 
1233         line = s->ymin + s->tile_attr.ySize * tile_y;
1234         col = s->tile_attr.xSize * tile_x;
1235 
1236         if (line < s->ymin || line > s->ymax ||
1237             s->xmin + col  < s->xmin ||  s->xmin + col  > s->xmax)
1238             return AVERROR_INVALIDDATA;
1239 
1240         td->ysize = FFMIN(s->tile_attr.ySize, s->ydelta - tile_y * s->tile_attr.ySize);
1241         td->xsize = FFMIN(s->tile_attr.xSize, s->xdelta - tile_x * s->tile_attr.xSize);
1242 
1243         if (td->xsize * (uint64_t)s->current_channel_offset > INT_MAX)
1244             return AVERROR_INVALIDDATA;
1245 
1246         td->channel_line_size = td->xsize * s->current_channel_offset;/* uncompress size of one line */
1247         uncompressed_size = td->channel_line_size * (uint64_t)td->ysize;/* uncompress size of the block */
1248     } else {
1249         if (buf_size < 8 || line_offset > buf_size - 8)
1250             return AVERROR_INVALIDDATA;
1251 
1252         src  = buf + line_offset + 8;
1253         if (s->is_multipart)
1254             src += 4;
1255         line = AV_RL32(src - 8);
1256 
1257         if (line < s->ymin || line > s->ymax)
1258             return AVERROR_INVALIDDATA;
1259 
1260         data_size = AV_RL32(src - 4);
1261         if (data_size <= 0 || data_size > buf_size - line_offset - 8)
1262             return AVERROR_INVALIDDATA;
1263 
1264         td->ysize          = FFMIN(s->scan_lines_per_block, s->ymax - line + 1); /* s->ydelta - line ?? */
1265         td->xsize          = s->xdelta;
1266 
1267         if (td->xsize * (uint64_t)s->current_channel_offset > INT_MAX)
1268             return AVERROR_INVALIDDATA;
1269 
1270         td->channel_line_size = td->xsize * s->current_channel_offset;/* uncompress size of one line */
1271         uncompressed_size = td->channel_line_size * (uint64_t)td->ysize;/* uncompress size of the block */
1272 
1273         if ((s->compression == EXR_RAW && (data_size != uncompressed_size ||
1274                                            line_offset > buf_size - uncompressed_size)) ||
1275             (s->compression != EXR_RAW && (data_size > uncompressed_size ||
1276                                            line_offset > buf_size - data_size))) {
1277             return AVERROR_INVALIDDATA;
1278         }
1279     }
1280 
1281     window_xmin = FFMIN(avctx->width, FFMAX(0, s->xmin + col));
1282     window_xmax = FFMIN(avctx->width, FFMAX(0, s->xmin + col + td->xsize));
1283     window_ymin = FFMIN(avctx->height, FFMAX(0, line ));
1284     window_ymax = FFMIN(avctx->height, FFMAX(0, line + td->ysize));
1285     xsize = window_xmax - window_xmin;
1286     ysize = window_ymax - window_ymin;
1287 
1288     /* tile or scanline not visible skip decoding */
1289     if (xsize <= 0 || ysize <= 0)
1290         return 0;
1291 
1292     /* is the first tile or is a scanline */
1293     if(col == 0) {
1294         window_xmin = 0;
1295         /* pixels to add at the left of the display window */
1296         window_xoffset = FFMAX(0, s->xmin);
1297         /* bytes to add at the left of the display window */
1298         bxmin = window_xoffset * step;
1299     }
1300 
1301     /* is the last tile or is a scanline */
1302     if(col + td->xsize == s->xdelta) {
1303         window_xmax = avctx->width;
1304          /* bytes to add at the right of the display window */
1305         axmax = FFMAX(0, (avctx->width - (s->xmax + 1))) * step;
1306     }
1307 
1308     if (data_size < uncompressed_size || s->is_tile) { /* td->tmp is use for tile reorganization */
1309         av_fast_padded_malloc(&td->tmp, &td->tmp_size, uncompressed_size);
1310         if (!td->tmp)
1311             return AVERROR(ENOMEM);
1312     }
1313 
1314     if (data_size < uncompressed_size) {
1315         av_fast_padded_malloc(&td->uncompressed_data,
1316                               &td->uncompressed_size, uncompressed_size + 64);/* Force 64 padding for AVX2 reorder_pixels dst */
1317 
1318         if (!td->uncompressed_data)
1319             return AVERROR(ENOMEM);
1320 
1321         ret = AVERROR_INVALIDDATA;
1322         switch (s->compression) {
1323         case EXR_ZIP1:
1324         case EXR_ZIP16:
1325             ret = zip_uncompress(s, src, data_size, uncompressed_size, td);
1326             break;
1327         case EXR_PIZ:
1328             ret = piz_uncompress(s, src, data_size, uncompressed_size, td);
1329             break;
1330         case EXR_PXR24:
1331             ret = pxr24_uncompress(s, src, data_size, uncompressed_size, td);
1332             break;
1333         case EXR_RLE:
1334             ret = rle_uncompress(s, src, data_size, uncompressed_size, td);
1335             break;
1336         case EXR_B44:
1337         case EXR_B44A:
1338             ret = b44_uncompress(s, src, data_size, uncompressed_size, td);
1339             break;
1340         case EXR_DWAA:
1341         case EXR_DWAB:
1342             ret = dwa_uncompress(s, src, data_size, uncompressed_size, td);
1343             break;
1344         }
1345         if (ret < 0) {
1346             av_log(avctx, AV_LOG_ERROR, "decode_block() failed.\n");
1347             return ret;
1348         }
1349         src = td->uncompressed_data;
1350     }
1351 
1352     /* offsets to crop data outside display window */
1353     data_xoffset = FFABS(FFMIN(0, s->xmin + col)) * (s->pixel_type == EXR_HALF ? 2 : 4);
1354     data_yoffset = FFABS(FFMIN(0, line));
1355     data_window_offset = (data_yoffset * td->channel_line_size) + data_xoffset;
1356 
1357     if (!s->is_luma) {
1358         channel_buffer[0] = src + (td->xsize * s->channel_offsets[0]) + data_window_offset;
1359         channel_buffer[1] = src + (td->xsize * s->channel_offsets[1]) + data_window_offset;
1360         channel_buffer[2] = src + (td->xsize * s->channel_offsets[2]) + data_window_offset;
1361         rgb_channel_count = 3;
1362     } else { /* put y data in the first channel_buffer */
1363         channel_buffer[0] = src + (td->xsize * s->channel_offsets[1]) + data_window_offset;
1364         rgb_channel_count = 1;
1365     }
1366      if (s->channel_offsets[3] >= 0)
1367         channel_buffer[3] = src + (td->xsize * s->channel_offsets[3]) + data_window_offset;
1368 
1369     if (s->desc->flags & AV_PIX_FMT_FLAG_FLOAT) {
1370         /* todo: change this when a floating point pixel format with luma with alpha is implemented */
1371         int channel_count = s->channel_offsets[3] >= 0 ? 4 : rgb_channel_count;
1372         if (s->is_luma) {
1373             channel_buffer[1] = channel_buffer[0];
1374             channel_buffer[2] = channel_buffer[0];
1375         }
1376 
1377         for (c = 0; c < channel_count; c++) {
1378             int plane = s->desc->comp[c].plane;
1379             ptr = p->data[plane] + window_ymin * p->linesize[plane] + (window_xmin * 4);
1380 
1381             for (i = 0; i < ysize; i++, ptr += p->linesize[plane]) {
1382                 const uint8_t *src;
1383                 union av_intfloat32 *ptr_x;
1384 
1385                 src = channel_buffer[c];
1386                 ptr_x = (union av_intfloat32 *)ptr;
1387 
1388                 // Zero out the start if xmin is not 0
1389                 memset(ptr_x, 0, bxmin);
1390                 ptr_x += window_xoffset;
1391 
1392                 if (s->pixel_type == EXR_FLOAT ||
1393                     s->compression == EXR_DWAA ||
1394                     s->compression == EXR_DWAB) {
1395                     // 32-bit
1396                     union av_intfloat32 t;
1397                     if (trc_func && c < 3) {
1398                         for (x = 0; x < xsize; x++) {
1399                             t.i = bytestream_get_le32(&src);
1400                             t.f = trc_func(t.f);
1401                             *ptr_x++ = t;
1402                         }
1403                     } else if (one_gamma != 1.f) {
1404                         for (x = 0; x < xsize; x++) {
1405                             t.i = bytestream_get_le32(&src);
1406                             if (t.f > 0.0f && c < 3)  /* avoid negative values */
1407                                 t.f = powf(t.f, one_gamma);
1408                             *ptr_x++ = t;
1409                         }
1410                     } else {
1411                         for (x = 0; x < xsize; x++) {
1412                             t.i = bytestream_get_le32(&src);
1413                             *ptr_x++ = t;
1414                         }
1415                     }
1416                 } else if (s->pixel_type == EXR_HALF) {
1417                     // 16-bit
1418                     if (c < 3 || !trc_func) {
1419                         for (x = 0; x < xsize; x++) {
1420                             *ptr_x++ = s->gamma_table[bytestream_get_le16(&src)];
1421                         }
1422                     } else {
1423                         for (x = 0; x < xsize; x++) {
1424                             ptr_x[0].i = half2float(bytestream_get_le16(&src),
1425                                                     s->mantissatable,
1426                                                     s->exponenttable,
1427                                                     s->offsettable);
1428                             ptr_x++;
1429                         }
1430                     }
1431                 }
1432 
1433                 // Zero out the end if xmax+1 is not w
1434                 memset(ptr_x, 0, axmax);
1435                 channel_buffer[c] += td->channel_line_size;
1436             }
1437         }
1438     } else {
1439 
1440         av_assert1(s->pixel_type == EXR_UINT);
1441         ptr = p->data[0] + window_ymin * p->linesize[0] + (window_xmin * s->desc->nb_components * 2);
1442 
1443         for (i = 0; i < ysize; i++, ptr += p->linesize[0]) {
1444 
1445             const uint8_t * a;
1446             const uint8_t *rgb[3];
1447             uint16_t *ptr_x;
1448 
1449             for (c = 0; c < rgb_channel_count; c++) {
1450                 rgb[c] = channel_buffer[c];
1451             }
1452 
1453             if (channel_buffer[3])
1454                 a = channel_buffer[3];
1455 
1456             ptr_x = (uint16_t *) ptr;
1457 
1458             // Zero out the start if xmin is not 0
1459             memset(ptr_x, 0, bxmin);
1460             ptr_x += window_xoffset * s->desc->nb_components;
1461 
1462             for (x = 0; x < xsize; x++) {
1463                 for (c = 0; c < rgb_channel_count; c++) {
1464                     *ptr_x++ = bytestream_get_le32(&rgb[c]) >> 16;
1465                 }
1466 
1467                 if (channel_buffer[3])
1468                     *ptr_x++ = bytestream_get_le32(&a) >> 16;
1469             }
1470 
1471             // Zero out the end if xmax+1 is not w
1472             memset(ptr_x, 0, axmax);
1473 
1474             channel_buffer[0] += td->channel_line_size;
1475             channel_buffer[1] += td->channel_line_size;
1476             channel_buffer[2] += td->channel_line_size;
1477             if (channel_buffer[3])
1478                 channel_buffer[3] += td->channel_line_size;
1479         }
1480     }
1481 
1482     return 0;
1483 }
1484 
skip_header_chunk(EXRContext * s)1485 static void skip_header_chunk(EXRContext *s)
1486 {
1487     GetByteContext *gb = &s->gb;
1488 
1489     while (bytestream2_get_bytes_left(gb) > 0) {
1490         if (!bytestream2_peek_byte(gb))
1491             break;
1492 
1493         // Process unknown variables
1494         for (int i = 0; i < 2; i++) // value_name and value_type
1495             while (bytestream2_get_byte(gb) != 0);
1496 
1497         // Skip variable length
1498         bytestream2_skip(gb, bytestream2_get_le32(gb));
1499     }
1500 }
1501 
1502 /**
1503  * Check if the variable name corresponds to its data type.
1504  *
1505  * @param s              the EXRContext
1506  * @param value_name     name of the variable to check
1507  * @param value_type     type of the variable to check
1508  * @param minimum_length minimum length of the variable data
1509  *
1510  * @return bytes to read containing variable data
1511  *         -1 if variable is not found
1512  *         0 if buffer ended prematurely
1513  */
check_header_variable(EXRContext * s,const char * value_name,const char * value_type,unsigned int minimum_length)1514 static int check_header_variable(EXRContext *s,
1515                                  const char *value_name,
1516                                  const char *value_type,
1517                                  unsigned int minimum_length)
1518 {
1519     GetByteContext *gb = &s->gb;
1520     int var_size = -1;
1521 
1522     if (bytestream2_get_bytes_left(gb) >= minimum_length &&
1523         !strcmp(gb->buffer, value_name)) {
1524         // found value_name, jump to value_type (null terminated strings)
1525         gb->buffer += strlen(value_name) + 1;
1526         if (!strcmp(gb->buffer, value_type)) {
1527             gb->buffer += strlen(value_type) + 1;
1528             var_size = bytestream2_get_le32(gb);
1529             // don't go read past boundaries
1530             if (var_size > bytestream2_get_bytes_left(gb))
1531                 var_size = 0;
1532         } else {
1533             // value_type not found, reset the buffer
1534             gb->buffer -= strlen(value_name) + 1;
1535             av_log(s->avctx, AV_LOG_WARNING,
1536                    "Unknown data type %s for header variable %s.\n",
1537                    value_type, value_name);
1538         }
1539     }
1540 
1541     return var_size;
1542 }
1543 
decode_header(EXRContext * s,AVFrame * frame)1544 static int decode_header(EXRContext *s, AVFrame *frame)
1545 {
1546     AVDictionary *metadata = NULL;
1547     GetByteContext *gb = &s->gb;
1548     int magic_number, version, flags;
1549     int layer_match = 0;
1550     int ret;
1551     int dup_channels = 0;
1552 
1553     s->current_channel_offset = 0;
1554     s->xmin               = ~0;
1555     s->xmax               = ~0;
1556     s->ymin               = ~0;
1557     s->ymax               = ~0;
1558     s->xdelta             = ~0;
1559     s->ydelta             = ~0;
1560     s->channel_offsets[0] = -1;
1561     s->channel_offsets[1] = -1;
1562     s->channel_offsets[2] = -1;
1563     s->channel_offsets[3] = -1;
1564     s->pixel_type         = EXR_UNKNOWN;
1565     s->compression        = EXR_UNKN;
1566     s->nb_channels        = 0;
1567     s->w                  = 0;
1568     s->h                  = 0;
1569     s->tile_attr.xSize    = -1;
1570     s->tile_attr.ySize    = -1;
1571     s->is_tile            = 0;
1572     s->is_multipart       = 0;
1573     s->is_luma            = 0;
1574     s->current_part       = 0;
1575 
1576     if (bytestream2_get_bytes_left(gb) < 10) {
1577         av_log(s->avctx, AV_LOG_ERROR, "Header too short to parse.\n");
1578         return AVERROR_INVALIDDATA;
1579     }
1580 
1581     magic_number = bytestream2_get_le32(gb);
1582     if (magic_number != 20000630) {
1583         /* As per documentation of OpenEXR, it is supposed to be
1584          * int 20000630 little-endian */
1585         av_log(s->avctx, AV_LOG_ERROR, "Wrong magic number %d.\n", magic_number);
1586         return AVERROR_INVALIDDATA;
1587     }
1588 
1589     version = bytestream2_get_byte(gb);
1590     if (version != 2) {
1591         avpriv_report_missing_feature(s->avctx, "Version %d", version);
1592         return AVERROR_PATCHWELCOME;
1593     }
1594 
1595     flags = bytestream2_get_le24(gb);
1596 
1597     if (flags & 0x02)
1598         s->is_tile = 1;
1599     if (flags & 0x10)
1600         s->is_multipart = 1;
1601     if (flags & 0x08) {
1602         avpriv_report_missing_feature(s->avctx, "deep data");
1603         return AVERROR_PATCHWELCOME;
1604     }
1605 
1606     // Parse the header
1607     while (bytestream2_get_bytes_left(gb) > 0) {
1608         int var_size;
1609 
1610         while (s->is_multipart && s->current_part < s->selected_part &&
1611                bytestream2_get_bytes_left(gb) > 0) {
1612             if (bytestream2_peek_byte(gb)) {
1613                 skip_header_chunk(s);
1614             } else {
1615                 bytestream2_skip(gb, 1);
1616                 if (!bytestream2_peek_byte(gb))
1617                     break;
1618             }
1619             bytestream2_skip(gb, 1);
1620             s->current_part++;
1621         }
1622 
1623         if (!bytestream2_peek_byte(gb)) {
1624             if (!s->is_multipart)
1625                 break;
1626             bytestream2_skip(gb, 1);
1627             if (s->current_part == s->selected_part) {
1628                 while (bytestream2_get_bytes_left(gb) > 0) {
1629                     if (bytestream2_peek_byte(gb)) {
1630                         skip_header_chunk(s);
1631                     } else {
1632                         bytestream2_skip(gb, 1);
1633                         if (!bytestream2_peek_byte(gb))
1634                             break;
1635                     }
1636                 }
1637             }
1638             if (!bytestream2_peek_byte(gb))
1639                 break;
1640             s->current_part++;
1641         }
1642 
1643         if ((var_size = check_header_variable(s, "channels",
1644                                               "chlist", 38)) >= 0) {
1645             GetByteContext ch_gb;
1646             if (!var_size) {
1647                 ret = AVERROR_INVALIDDATA;
1648                 goto fail;
1649             }
1650 
1651             bytestream2_init(&ch_gb, gb->buffer, var_size);
1652 
1653             while (bytestream2_get_bytes_left(&ch_gb) >= 19) {
1654                 EXRChannel *channel;
1655                 enum ExrPixelType current_pixel_type;
1656                 int channel_index = -1;
1657                 int xsub, ysub;
1658 
1659                 if (strcmp(s->layer, "") != 0) {
1660                     if (strncmp(ch_gb.buffer, s->layer, strlen(s->layer)) == 0) {
1661                         layer_match = 1;
1662                         av_log(s->avctx, AV_LOG_INFO,
1663                                "Channel match layer : %s.\n", ch_gb.buffer);
1664                         ch_gb.buffer += strlen(s->layer);
1665                         if (*ch_gb.buffer == '.')
1666                             ch_gb.buffer++;         /* skip dot if not given */
1667                     } else {
1668                         layer_match = 0;
1669                         av_log(s->avctx, AV_LOG_INFO,
1670                                "Channel doesn't match layer : %s.\n", ch_gb.buffer);
1671                     }
1672                 } else {
1673                     layer_match = 1;
1674                 }
1675 
1676                 if (layer_match) { /* only search channel if the layer match is valid */
1677                     if (!av_strcasecmp(ch_gb.buffer, "R") ||
1678                         !av_strcasecmp(ch_gb.buffer, "X") ||
1679                         !av_strcasecmp(ch_gb.buffer, "U")) {
1680                         channel_index = 0;
1681                         s->is_luma = 0;
1682                     } else if (!av_strcasecmp(ch_gb.buffer, "G") ||
1683                                !av_strcasecmp(ch_gb.buffer, "V")) {
1684                         channel_index = 1;
1685                         s->is_luma = 0;
1686                     } else if (!av_strcasecmp(ch_gb.buffer, "Y")) {
1687                         channel_index = 1;
1688                         s->is_luma = 1;
1689                     } else if (!av_strcasecmp(ch_gb.buffer, "B") ||
1690                                !av_strcasecmp(ch_gb.buffer, "Z") ||
1691                                !av_strcasecmp(ch_gb.buffer, "W")) {
1692                         channel_index = 2;
1693                         s->is_luma = 0;
1694                     } else if (!av_strcasecmp(ch_gb.buffer, "A")) {
1695                         channel_index = 3;
1696                     } else {
1697                         av_log(s->avctx, AV_LOG_WARNING,
1698                                "Unsupported channel %.256s.\n", ch_gb.buffer);
1699                     }
1700                 }
1701 
1702                 /* skip until you get a 0 */
1703                 while (bytestream2_get_bytes_left(&ch_gb) > 0 &&
1704                        bytestream2_get_byte(&ch_gb))
1705                     continue;
1706 
1707                 if (bytestream2_get_bytes_left(&ch_gb) < 4) {
1708                     av_log(s->avctx, AV_LOG_ERROR, "Incomplete header.\n");
1709                     ret = AVERROR_INVALIDDATA;
1710                     goto fail;
1711                 }
1712 
1713                 current_pixel_type = bytestream2_get_le32(&ch_gb);
1714                 if (current_pixel_type >= EXR_UNKNOWN) {
1715                     avpriv_report_missing_feature(s->avctx, "Pixel type %d",
1716                                                   current_pixel_type);
1717                     ret = AVERROR_PATCHWELCOME;
1718                     goto fail;
1719                 }
1720 
1721                 bytestream2_skip(&ch_gb, 4);
1722                 xsub = bytestream2_get_le32(&ch_gb);
1723                 ysub = bytestream2_get_le32(&ch_gb);
1724 
1725                 if (xsub != 1 || ysub != 1) {
1726                     avpriv_report_missing_feature(s->avctx,
1727                                                   "Subsampling %dx%d",
1728                                                   xsub, ysub);
1729                     ret = AVERROR_PATCHWELCOME;
1730                     goto fail;
1731                 }
1732 
1733                 if (channel_index >= 0 && s->channel_offsets[channel_index] == -1) { /* channel has not been previously assigned */
1734                     if (s->pixel_type != EXR_UNKNOWN &&
1735                         s->pixel_type != current_pixel_type) {
1736                         av_log(s->avctx, AV_LOG_ERROR,
1737                                "RGB channels not of the same depth.\n");
1738                         ret = AVERROR_INVALIDDATA;
1739                         goto fail;
1740                     }
1741                     s->pixel_type                     = current_pixel_type;
1742                     s->channel_offsets[channel_index] = s->current_channel_offset;
1743                 } else if (channel_index >= 0) {
1744                     av_log(s->avctx, AV_LOG_WARNING,
1745                             "Multiple channels with index %d.\n", channel_index);
1746                     if (++dup_channels > 10) {
1747                         ret = AVERROR_INVALIDDATA;
1748                         goto fail;
1749                     }
1750                 }
1751 
1752                 s->channels = av_realloc(s->channels,
1753                                          ++s->nb_channels * sizeof(EXRChannel));
1754                 if (!s->channels) {
1755                     ret = AVERROR(ENOMEM);
1756                     goto fail;
1757                 }
1758                 channel             = &s->channels[s->nb_channels - 1];
1759                 channel->pixel_type = current_pixel_type;
1760                 channel->xsub       = xsub;
1761                 channel->ysub       = ysub;
1762 
1763                 if (current_pixel_type == EXR_HALF) {
1764                     s->current_channel_offset += 2;
1765                 } else {/* Float or UINT32 */
1766                     s->current_channel_offset += 4;
1767                 }
1768             }
1769 
1770             /* Check if all channels are set with an offset or if the channels
1771              * are causing an overflow  */
1772             if (!s->is_luma) {/* if we expected to have at least 3 channels */
1773                 if (FFMIN3(s->channel_offsets[0],
1774                            s->channel_offsets[1],
1775                            s->channel_offsets[2]) < 0) {
1776                     if (s->channel_offsets[0] < 0)
1777                         av_log(s->avctx, AV_LOG_ERROR, "Missing red channel.\n");
1778                     if (s->channel_offsets[1] < 0)
1779                         av_log(s->avctx, AV_LOG_ERROR, "Missing green channel.\n");
1780                     if (s->channel_offsets[2] < 0)
1781                         av_log(s->avctx, AV_LOG_ERROR, "Missing blue channel.\n");
1782                     ret = AVERROR_INVALIDDATA;
1783                     goto fail;
1784                 }
1785             }
1786 
1787             // skip one last byte and update main gb
1788             gb->buffer = ch_gb.buffer + 1;
1789             continue;
1790         } else if ((var_size = check_header_variable(s, "dataWindow", "box2i",
1791                                                      31)) >= 0) {
1792             int xmin, ymin, xmax, ymax;
1793             if (!var_size) {
1794                 ret = AVERROR_INVALIDDATA;
1795                 goto fail;
1796             }
1797 
1798             xmin   = bytestream2_get_le32(gb);
1799             ymin   = bytestream2_get_le32(gb);
1800             xmax   = bytestream2_get_le32(gb);
1801             ymax   = bytestream2_get_le32(gb);
1802 
1803             if (xmin > xmax || ymin > ymax ||
1804                 ymax == INT_MAX || xmax == INT_MAX ||
1805                 (unsigned)xmax - xmin >= INT_MAX ||
1806                 (unsigned)ymax - ymin >= INT_MAX) {
1807                 ret = AVERROR_INVALIDDATA;
1808                 goto fail;
1809             }
1810             s->xmin = xmin;
1811             s->xmax = xmax;
1812             s->ymin = ymin;
1813             s->ymax = ymax;
1814             s->xdelta = (s->xmax - s->xmin) + 1;
1815             s->ydelta = (s->ymax - s->ymin) + 1;
1816 
1817             continue;
1818         } else if ((var_size = check_header_variable(s, "displayWindow",
1819                                                      "box2i", 34)) >= 0) {
1820             int32_t sx, sy, dx, dy;
1821 
1822             if (!var_size) {
1823                 ret = AVERROR_INVALIDDATA;
1824                 goto fail;
1825             }
1826 
1827             sx = bytestream2_get_le32(gb);
1828             sy = bytestream2_get_le32(gb);
1829             dx = bytestream2_get_le32(gb);
1830             dy = bytestream2_get_le32(gb);
1831 
1832             s->w = dx - sx + 1;
1833             s->h = dy - sy + 1;
1834 
1835             continue;
1836         } else if ((var_size = check_header_variable(s, "lineOrder",
1837                                                      "lineOrder", 25)) >= 0) {
1838             int line_order;
1839             if (!var_size) {
1840                 ret = AVERROR_INVALIDDATA;
1841                 goto fail;
1842             }
1843 
1844             line_order = bytestream2_get_byte(gb);
1845             av_log(s->avctx, AV_LOG_DEBUG, "line order: %d.\n", line_order);
1846             if (line_order > 2) {
1847                 av_log(s->avctx, AV_LOG_ERROR, "Unknown line order.\n");
1848                 ret = AVERROR_INVALIDDATA;
1849                 goto fail;
1850             }
1851 
1852             continue;
1853         } else if ((var_size = check_header_variable(s, "pixelAspectRatio",
1854                                                      "float", 31)) >= 0) {
1855             if (!var_size) {
1856                 ret = AVERROR_INVALIDDATA;
1857                 goto fail;
1858             }
1859 
1860             s->sar = bytestream2_get_le32(gb);
1861 
1862             continue;
1863         } else if ((var_size = check_header_variable(s, "compression",
1864                                                      "compression", 29)) >= 0) {
1865             if (!var_size) {
1866                 ret = AVERROR_INVALIDDATA;
1867                 goto fail;
1868             }
1869 
1870             if (s->compression == EXR_UNKN)
1871                 s->compression = bytestream2_get_byte(gb);
1872             else {
1873                 bytestream2_skip(gb, 1);
1874                 av_log(s->avctx, AV_LOG_WARNING,
1875                        "Found more than one compression attribute.\n");
1876             }
1877 
1878             continue;
1879         } else if ((var_size = check_header_variable(s, "tiles",
1880                                                      "tiledesc", 22)) >= 0) {
1881             char tileLevel;
1882 
1883             if (!s->is_tile)
1884                 av_log(s->avctx, AV_LOG_WARNING,
1885                        "Found tile attribute and scanline flags. Exr will be interpreted as scanline.\n");
1886 
1887             s->tile_attr.xSize = bytestream2_get_le32(gb);
1888             s->tile_attr.ySize = bytestream2_get_le32(gb);
1889 
1890             tileLevel = bytestream2_get_byte(gb);
1891             s->tile_attr.level_mode = tileLevel & 0x0f;
1892             s->tile_attr.level_round = (tileLevel >> 4) & 0x0f;
1893 
1894             if (s->tile_attr.level_mode >= EXR_TILE_LEVEL_UNKNOWN) {
1895                 avpriv_report_missing_feature(s->avctx, "Tile level mode %d",
1896                                               s->tile_attr.level_mode);
1897                 ret = AVERROR_PATCHWELCOME;
1898                 goto fail;
1899             }
1900 
1901             if (s->tile_attr.level_round >= EXR_TILE_ROUND_UNKNOWN) {
1902                 avpriv_report_missing_feature(s->avctx, "Tile level round %d",
1903                                               s->tile_attr.level_round);
1904                 ret = AVERROR_PATCHWELCOME;
1905                 goto fail;
1906             }
1907 
1908             continue;
1909         } else if ((var_size = check_header_variable(s, "writer",
1910                                                      "string", 1)) >= 0) {
1911             uint8_t key[256] = { 0 };
1912 
1913             bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1, var_size));
1914             av_dict_set(&metadata, "writer", key, 0);
1915 
1916             continue;
1917         } else if ((var_size = check_header_variable(s, "framesPerSecond",
1918                                                      "rational", 33)) >= 0) {
1919             if (!var_size) {
1920                 ret = AVERROR_INVALIDDATA;
1921                 goto fail;
1922             }
1923 
1924             s->avctx->framerate.num = bytestream2_get_le32(gb);
1925             s->avctx->framerate.den = bytestream2_get_le32(gb);
1926 
1927             continue;
1928         } else if ((var_size = check_header_variable(s, "chunkCount",
1929                                                      "int", 23)) >= 0) {
1930 
1931             s->chunk_count = bytestream2_get_le32(gb);
1932 
1933             continue;
1934         } else if ((var_size = check_header_variable(s, "type",
1935                                                      "string", 16)) >= 0) {
1936             uint8_t key[256] = { 0 };
1937 
1938             bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1, var_size));
1939             if (strncmp("scanlineimage", key, var_size) &&
1940                 strncmp("tiledimage", key, var_size))
1941                 return AVERROR_PATCHWELCOME;
1942 
1943             continue;
1944         } else if ((var_size = check_header_variable(s, "preview",
1945                                                      "preview", 16)) >= 0) {
1946             uint32_t pw = bytestream2_get_le32(gb);
1947             uint32_t ph = bytestream2_get_le32(gb);
1948             int64_t psize = 4LL * pw * ph;
1949 
1950             if (psize >= bytestream2_get_bytes_left(gb))
1951                 return AVERROR_INVALIDDATA;
1952 
1953             bytestream2_skip(gb, psize);
1954 
1955             continue;
1956         }
1957 
1958         // Check if there are enough bytes for a header
1959         if (bytestream2_get_bytes_left(gb) <= 9) {
1960             av_log(s->avctx, AV_LOG_ERROR, "Incomplete header\n");
1961             ret = AVERROR_INVALIDDATA;
1962             goto fail;
1963         }
1964 
1965         // Process unknown variables
1966         {
1967             uint8_t name[256] = { 0 };
1968             uint8_t type[256] = { 0 };
1969             uint8_t value[256] = { 0 };
1970             int i = 0, size;
1971 
1972             while (bytestream2_get_bytes_left(gb) > 0 &&
1973                    bytestream2_peek_byte(gb) && i < 255) {
1974                 name[i++] = bytestream2_get_byte(gb);
1975             }
1976 
1977             bytestream2_skip(gb, 1);
1978             i = 0;
1979             while (bytestream2_get_bytes_left(gb) > 0 &&
1980                    bytestream2_peek_byte(gb) && i < 255) {
1981                 type[i++] = bytestream2_get_byte(gb);
1982             }
1983             bytestream2_skip(gb, 1);
1984             size = bytestream2_get_le32(gb);
1985 
1986             bytestream2_get_buffer(gb, value, FFMIN(sizeof(value) - 1, size));
1987             if (!strcmp(type, "string"))
1988                 av_dict_set(&metadata, name, value, 0);
1989         }
1990     }
1991 
1992     if (s->compression == EXR_UNKN) {
1993         av_log(s->avctx, AV_LOG_ERROR, "Missing compression attribute.\n");
1994         ret = AVERROR_INVALIDDATA;
1995         goto fail;
1996     }
1997 
1998     if (s->is_tile) {
1999         if (s->tile_attr.xSize < 1 || s->tile_attr.ySize < 1) {
2000             av_log(s->avctx, AV_LOG_ERROR, "Invalid tile attribute.\n");
2001             ret = AVERROR_INVALIDDATA;
2002             goto fail;
2003         }
2004     }
2005 
2006     if (bytestream2_get_bytes_left(gb) <= 0) {
2007         av_log(s->avctx, AV_LOG_ERROR, "Incomplete frame.\n");
2008         ret = AVERROR_INVALIDDATA;
2009         goto fail;
2010     }
2011 
2012     frame->metadata = metadata;
2013 
2014     // aaand we are done
2015     bytestream2_skip(gb, 1);
2016     return 0;
2017 fail:
2018     av_dict_free(&metadata);
2019     return ret;
2020 }
2021 
decode_frame(AVCodecContext * avctx,void * data,int * got_frame,AVPacket * avpkt)2022 static int decode_frame(AVCodecContext *avctx, void *data,
2023                         int *got_frame, AVPacket *avpkt)
2024 {
2025     EXRContext *s = avctx->priv_data;
2026     GetByteContext *gb = &s->gb;
2027     ThreadFrame frame = { .f = data };
2028     AVFrame *picture = data;
2029     uint8_t *ptr;
2030 
2031     int i, y, ret, ymax;
2032     int planes;
2033     int out_line_size;
2034     int nb_blocks;   /* nb scanline or nb tile */
2035     uint64_t start_offset_table;
2036     uint64_t start_next_scanline;
2037     PutByteContext offset_table_writer;
2038 
2039     bytestream2_init(gb, avpkt->data, avpkt->size);
2040 
2041     if ((ret = decode_header(s, picture)) < 0)
2042         return ret;
2043 
2044     if ((s->compression == EXR_DWAA || s->compression == EXR_DWAB) &&
2045         s->pixel_type == EXR_HALF) {
2046         s->current_channel_offset *= 2;
2047         for (int i = 0; i < 4; i++)
2048             s->channel_offsets[i] *= 2;
2049     }
2050 
2051     switch (s->pixel_type) {
2052     case EXR_FLOAT:
2053     case EXR_HALF:
2054         if (s->channel_offsets[3] >= 0) {
2055             if (!s->is_luma) {
2056                 avctx->pix_fmt = AV_PIX_FMT_GBRAPF32;
2057             } else {
2058                 /* todo: change this when a floating point pixel format with luma with alpha is implemented */
2059                 avctx->pix_fmt = AV_PIX_FMT_GBRAPF32;
2060             }
2061         } else {
2062             if (!s->is_luma) {
2063                 avctx->pix_fmt = AV_PIX_FMT_GBRPF32;
2064             } else {
2065                 avctx->pix_fmt = AV_PIX_FMT_GRAYF32;
2066             }
2067         }
2068         break;
2069     case EXR_UINT:
2070         if (s->channel_offsets[3] >= 0) {
2071             if (!s->is_luma) {
2072                 avctx->pix_fmt = AV_PIX_FMT_RGBA64;
2073             } else {
2074                 avctx->pix_fmt = AV_PIX_FMT_YA16;
2075             }
2076         } else {
2077             if (!s->is_luma) {
2078                 avctx->pix_fmt = AV_PIX_FMT_RGB48;
2079             } else {
2080                 avctx->pix_fmt = AV_PIX_FMT_GRAY16;
2081             }
2082         }
2083         break;
2084     default:
2085         av_log(avctx, AV_LOG_ERROR, "Missing channel list.\n");
2086         return AVERROR_INVALIDDATA;
2087     }
2088 
2089     if (s->apply_trc_type != AVCOL_TRC_UNSPECIFIED)
2090         avctx->color_trc = s->apply_trc_type;
2091 
2092     switch (s->compression) {
2093     case EXR_RAW:
2094     case EXR_RLE:
2095     case EXR_ZIP1:
2096         s->scan_lines_per_block = 1;
2097         break;
2098     case EXR_PXR24:
2099     case EXR_ZIP16:
2100         s->scan_lines_per_block = 16;
2101         break;
2102     case EXR_PIZ:
2103     case EXR_B44:
2104     case EXR_B44A:
2105     case EXR_DWAA:
2106         s->scan_lines_per_block = 32;
2107         break;
2108     case EXR_DWAB:
2109         s->scan_lines_per_block = 256;
2110         break;
2111     default:
2112         avpriv_report_missing_feature(avctx, "Compression %d", s->compression);
2113         return AVERROR_PATCHWELCOME;
2114     }
2115 
2116     /* Verify the xmin, xmax, ymin and ymax before setting the actual image size.
2117      * It's possible for the data window can larger or outside the display window */
2118     if (s->xmin > s->xmax  || s->ymin > s->ymax ||
2119         s->ydelta == 0xFFFFFFFF || s->xdelta == 0xFFFFFFFF) {
2120         av_log(avctx, AV_LOG_ERROR, "Wrong or missing size information.\n");
2121         return AVERROR_INVALIDDATA;
2122     }
2123 
2124     if ((ret = ff_set_dimensions(avctx, s->w, s->h)) < 0)
2125         return ret;
2126 
2127     ff_set_sar(s->avctx, av_d2q(av_int2float(s->sar), 255));
2128 
2129     s->desc          = av_pix_fmt_desc_get(avctx->pix_fmt);
2130     if (!s->desc)
2131         return AVERROR_INVALIDDATA;
2132 
2133     if (s->desc->flags & AV_PIX_FMT_FLAG_FLOAT) {
2134         planes           = s->desc->nb_components;
2135         out_line_size    = avctx->width * 4;
2136     } else {
2137         planes           = 1;
2138         out_line_size    = avctx->width * 2 * s->desc->nb_components;
2139     }
2140 
2141     if (s->is_tile) {
2142         nb_blocks = ((s->xdelta + s->tile_attr.xSize - 1) / s->tile_attr.xSize) *
2143         ((s->ydelta + s->tile_attr.ySize - 1) / s->tile_attr.ySize);
2144     } else { /* scanline */
2145         nb_blocks = (s->ydelta + s->scan_lines_per_block - 1) /
2146         s->scan_lines_per_block;
2147     }
2148 
2149     if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0)
2150         return ret;
2151 
2152     if (bytestream2_get_bytes_left(gb)/8 < nb_blocks)
2153         return AVERROR_INVALIDDATA;
2154 
2155     // check offset table and recreate it if need
2156     if (!s->is_tile && bytestream2_peek_le64(gb) == 0) {
2157         av_log(s->avctx, AV_LOG_DEBUG, "recreating invalid scanline offset table\n");
2158 
2159         start_offset_table = bytestream2_tell(gb);
2160         start_next_scanline = start_offset_table + nb_blocks * 8;
2161         bytestream2_init_writer(&offset_table_writer, &avpkt->data[start_offset_table], nb_blocks * 8);
2162 
2163         for (y = 0; y < nb_blocks; y++) {
2164             /* write offset of prev scanline in offset table */
2165             bytestream2_put_le64(&offset_table_writer, start_next_scanline);
2166 
2167             /* get len of next scanline */
2168             bytestream2_seek(gb, start_next_scanline + 4, SEEK_SET);/* skip line number */
2169             start_next_scanline += (bytestream2_get_le32(gb) + 8);
2170         }
2171         bytestream2_seek(gb, start_offset_table, SEEK_SET);
2172     }
2173 
2174     // save pointer we are going to use in decode_block
2175     s->buf      = avpkt->data;
2176     s->buf_size = avpkt->size;
2177 
2178     // Zero out the start if ymin is not 0
2179     for (i = 0; i < planes; i++) {
2180         ptr = picture->data[i];
2181         for (y = 0; y < FFMIN(s->ymin, s->h); y++) {
2182             memset(ptr, 0, out_line_size);
2183             ptr += picture->linesize[i];
2184         }
2185     }
2186 
2187     s->picture = picture;
2188 
2189     avctx->execute2(avctx, decode_block, s->thread_data, NULL, nb_blocks);
2190 
2191     ymax = FFMAX(0, s->ymax + 1);
2192     // Zero out the end if ymax+1 is not h
2193     if (ymax < avctx->height)
2194         for (i = 0; i < planes; i++) {
2195             ptr = picture->data[i] + (ymax * picture->linesize[i]);
2196             for (y = ymax; y < avctx->height; y++) {
2197                 memset(ptr, 0, out_line_size);
2198                 ptr += picture->linesize[i];
2199             }
2200         }
2201 
2202     picture->pict_type = AV_PICTURE_TYPE_I;
2203     *got_frame = 1;
2204 
2205     return avpkt->size;
2206 }
2207 
decode_init(AVCodecContext * avctx)2208 static av_cold int decode_init(AVCodecContext *avctx)
2209 {
2210     EXRContext *s = avctx->priv_data;
2211     uint32_t i;
2212     union av_intfloat32 t;
2213     float one_gamma = 1.0f / s->gamma;
2214     avpriv_trc_function trc_func = NULL;
2215 
2216     half2float_table(s->mantissatable, s->exponenttable, s->offsettable);
2217 
2218     s->avctx              = avctx;
2219 
2220     ff_exrdsp_init(&s->dsp);
2221 
2222 #if HAVE_BIGENDIAN
2223     ff_bswapdsp_init(&s->bbdsp);
2224 #endif
2225 
2226     trc_func = avpriv_get_trc_function_from_trc(s->apply_trc_type);
2227     if (trc_func) {
2228         for (i = 0; i < 65536; ++i) {
2229             t.i = half2float(i, s->mantissatable, s->exponenttable, s->offsettable);
2230             t.f = trc_func(t.f);
2231             s->gamma_table[i] = t;
2232         }
2233     } else {
2234         if (one_gamma > 0.9999f && one_gamma < 1.0001f) {
2235             for (i = 0; i < 65536; ++i) {
2236                 s->gamma_table[i].i = half2float(i, s->mantissatable, s->exponenttable, s->offsettable);
2237             }
2238         } else {
2239             for (i = 0; i < 65536; ++i) {
2240                 t.i = half2float(i, s->mantissatable, s->exponenttable, s->offsettable);
2241                 /* If negative value we reuse half value */
2242                 if (t.f <= 0.0f) {
2243                     s->gamma_table[i] = t;
2244                 } else {
2245                     t.f = powf(t.f, one_gamma);
2246                     s->gamma_table[i] = t;
2247                 }
2248             }
2249         }
2250     }
2251 
2252     // allocate thread data, used for non EXR_RAW compression types
2253     s->thread_data = av_mallocz_array(avctx->thread_count, sizeof(EXRThreadData));
2254     if (!s->thread_data)
2255         return AVERROR_INVALIDDATA;
2256 
2257     return 0;
2258 }
2259 
decode_end(AVCodecContext * avctx)2260 static av_cold int decode_end(AVCodecContext *avctx)
2261 {
2262     EXRContext *s = avctx->priv_data;
2263     int i;
2264     for (i = 0; i < avctx->thread_count; i++) {
2265         EXRThreadData *td = &s->thread_data[i];
2266         av_freep(&td->uncompressed_data);
2267         av_freep(&td->tmp);
2268         av_freep(&td->bitmap);
2269         av_freep(&td->lut);
2270         av_freep(&td->he);
2271         av_freep(&td->freq);
2272         av_freep(&td->ac_data);
2273         av_freep(&td->dc_data);
2274         av_freep(&td->rle_data);
2275         av_freep(&td->rle_raw_data);
2276         ff_free_vlc(&td->vlc);
2277     }
2278 
2279     av_freep(&s->thread_data);
2280     av_freep(&s->channels);
2281 
2282     return 0;
2283 }
2284 
2285 #define OFFSET(x) offsetof(EXRContext, x)
2286 #define VD AV_OPT_FLAG_VIDEO_PARAM | AV_OPT_FLAG_DECODING_PARAM
2287 static const AVOption options[] = {
2288     { "layer", "Set the decoding layer", OFFSET(layer),
2289         AV_OPT_TYPE_STRING, { .str = "" }, 0, 0, VD },
2290     { "part",  "Set the decoding part", OFFSET(selected_part),
2291         AV_OPT_TYPE_INT, { .i64 = 0 }, 0, INT_MAX, VD },
2292     { "gamma", "Set the float gamma value when decoding", OFFSET(gamma),
2293         AV_OPT_TYPE_FLOAT, { .dbl = 1.0f }, 0.001, FLT_MAX, VD },
2294 
2295     // XXX: Note the abuse of the enum using AVCOL_TRC_UNSPECIFIED to subsume the existing gamma option
2296     { "apply_trc", "color transfer characteristics to apply to EXR linear input", OFFSET(apply_trc_type),
2297         AV_OPT_TYPE_INT, {.i64 = AVCOL_TRC_UNSPECIFIED }, 1, AVCOL_TRC_NB-1, VD, "apply_trc_type"},
2298     { "bt709",        "BT.709",           0,
2299         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_BT709 },        INT_MIN, INT_MAX, VD, "apply_trc_type"},
2300     { "gamma",        "gamma",            0,
2301         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_UNSPECIFIED },  INT_MIN, INT_MAX, VD, "apply_trc_type"},
2302     { "gamma22",      "BT.470 M",         0,
2303         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_GAMMA22 },      INT_MIN, INT_MAX, VD, "apply_trc_type"},
2304     { "gamma28",      "BT.470 BG",        0,
2305         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_GAMMA28 },      INT_MIN, INT_MAX, VD, "apply_trc_type"},
2306     { "smpte170m",    "SMPTE 170 M",      0,
2307         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_SMPTE170M },    INT_MIN, INT_MAX, VD, "apply_trc_type"},
2308     { "smpte240m",    "SMPTE 240 M",      0,
2309         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_SMPTE240M },    INT_MIN, INT_MAX, VD, "apply_trc_type"},
2310     { "linear",       "Linear",           0,
2311         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_LINEAR },       INT_MIN, INT_MAX, VD, "apply_trc_type"},
2312     { "log",          "Log",              0,
2313         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_LOG },          INT_MIN, INT_MAX, VD, "apply_trc_type"},
2314     { "log_sqrt",     "Log square root",  0,
2315         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_LOG_SQRT },     INT_MIN, INT_MAX, VD, "apply_trc_type"},
2316     { "iec61966_2_4", "IEC 61966-2-4",    0,
2317         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_IEC61966_2_4 }, INT_MIN, INT_MAX, VD, "apply_trc_type"},
2318     { "bt1361",       "BT.1361",          0,
2319         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_BT1361_ECG },   INT_MIN, INT_MAX, VD, "apply_trc_type"},
2320     { "iec61966_2_1", "IEC 61966-2-1",    0,
2321         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_IEC61966_2_1 }, INT_MIN, INT_MAX, VD, "apply_trc_type"},
2322     { "bt2020_10bit", "BT.2020 - 10 bit", 0,
2323         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_BT2020_10 },    INT_MIN, INT_MAX, VD, "apply_trc_type"},
2324     { "bt2020_12bit", "BT.2020 - 12 bit", 0,
2325         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_BT2020_12 },    INT_MIN, INT_MAX, VD, "apply_trc_type"},
2326     { "smpte2084",    "SMPTE ST 2084",    0,
2327         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_SMPTEST2084 },  INT_MIN, INT_MAX, VD, "apply_trc_type"},
2328     { "smpte428_1",   "SMPTE ST 428-1",   0,
2329         AV_OPT_TYPE_CONST, {.i64 = AVCOL_TRC_SMPTEST428_1 }, INT_MIN, INT_MAX, VD, "apply_trc_type"},
2330 
2331     { NULL },
2332 };
2333 
2334 static const AVClass exr_class = {
2335     .class_name = "EXR",
2336     .item_name  = av_default_item_name,
2337     .option     = options,
2338     .version    = LIBAVUTIL_VERSION_INT,
2339 };
2340 
2341 AVCodec ff_exr_decoder = {
2342     .name             = "exr",
2343     .long_name        = NULL_IF_CONFIG_SMALL("OpenEXR image"),
2344     .type             = AVMEDIA_TYPE_VIDEO,
2345     .id               = AV_CODEC_ID_EXR,
2346     .priv_data_size   = sizeof(EXRContext),
2347     .init             = decode_init,
2348     .close            = decode_end,
2349     .decode           = decode_frame,
2350     .capabilities     = AV_CODEC_CAP_DR1 | AV_CODEC_CAP_FRAME_THREADS |
2351                         AV_CODEC_CAP_SLICE_THREADS,
2352     .priv_class       = &exr_class,
2353 };
2354