1 // Copyright 2012 Google Inc. All Rights Reserved.
2 //
3 // Use of this source code is governed by a BSD-style license
4 // that can be found in the COPYING file in the root of the source
5 // tree. An additional intellectual property rights grant can be found
6 // in the file PATENTS. All contributing project authors may
7 // be found in the AUTHORS file in the root of the source tree.
8 // -----------------------------------------------------------------------------
9 //
10 // main entry for the decoder
11 //
12 // Authors: Vikas Arora (vikaas.arora@gmail.com)
13 //          Jyrki Alakuijala (jyrki@google.com)
14 
15 #include <stdlib.h>
16 
17 #include "src/dec/alphai_dec.h"
18 #include "src/dec/vp8li_dec.h"
19 #include "src/dsp/dsp.h"
20 #include "src/dsp/lossless.h"
21 #include "src/dsp/lossless_common.h"
22 #include "src/dsp/yuv.h"
23 #include "src/utils/endian_inl_utils.h"
24 #include "src/utils/huffman_utils.h"
25 #include "src/utils/utils.h"
26 
27 #define NUM_ARGB_CACHE_ROWS          16
28 
29 static const int kCodeLengthLiterals = 16;
30 static const int kCodeLengthRepeatCode = 16;
31 static const uint8_t kCodeLengthExtraBits[3] = { 2, 3, 7 };
32 static const uint8_t kCodeLengthRepeatOffsets[3] = { 3, 3, 11 };
33 
34 // -----------------------------------------------------------------------------
35 //  Five Huffman codes are used at each meta code:
36 //  1. green + length prefix codes + color cache codes,
37 //  2. alpha,
38 //  3. red,
39 //  4. blue, and,
40 //  5. distance prefix codes.
41 typedef enum {
42   GREEN = 0,
43   RED   = 1,
44   BLUE  = 2,
45   ALPHA = 3,
46   DIST  = 4
47 } HuffIndex;
48 
49 static const uint16_t kAlphabetSize[HUFFMAN_CODES_PER_META_CODE] = {
50   NUM_LITERAL_CODES + NUM_LENGTH_CODES,
51   NUM_LITERAL_CODES, NUM_LITERAL_CODES, NUM_LITERAL_CODES,
52   NUM_DISTANCE_CODES
53 };
54 
55 static const uint8_t kLiteralMap[HUFFMAN_CODES_PER_META_CODE] = {
56   0, 1, 1, 1, 0
57 };
58 
59 #define NUM_CODE_LENGTH_CODES       19
60 static const uint8_t kCodeLengthCodeOrder[NUM_CODE_LENGTH_CODES] = {
61   17, 18, 0, 1, 2, 3, 4, 5, 16, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
62 };
63 
64 #define CODE_TO_PLANE_CODES        120
65 static const uint8_t kCodeToPlane[CODE_TO_PLANE_CODES] = {
66   0x18, 0x07, 0x17, 0x19, 0x28, 0x06, 0x27, 0x29, 0x16, 0x1a,
67   0x26, 0x2a, 0x38, 0x05, 0x37, 0x39, 0x15, 0x1b, 0x36, 0x3a,
68   0x25, 0x2b, 0x48, 0x04, 0x47, 0x49, 0x14, 0x1c, 0x35, 0x3b,
69   0x46, 0x4a, 0x24, 0x2c, 0x58, 0x45, 0x4b, 0x34, 0x3c, 0x03,
70   0x57, 0x59, 0x13, 0x1d, 0x56, 0x5a, 0x23, 0x2d, 0x44, 0x4c,
71   0x55, 0x5b, 0x33, 0x3d, 0x68, 0x02, 0x67, 0x69, 0x12, 0x1e,
72   0x66, 0x6a, 0x22, 0x2e, 0x54, 0x5c, 0x43, 0x4d, 0x65, 0x6b,
73   0x32, 0x3e, 0x78, 0x01, 0x77, 0x79, 0x53, 0x5d, 0x11, 0x1f,
74   0x64, 0x6c, 0x42, 0x4e, 0x76, 0x7a, 0x21, 0x2f, 0x75, 0x7b,
75   0x31, 0x3f, 0x63, 0x6d, 0x52, 0x5e, 0x00, 0x74, 0x7c, 0x41,
76   0x4f, 0x10, 0x20, 0x62, 0x6e, 0x30, 0x73, 0x7d, 0x51, 0x5f,
77   0x40, 0x72, 0x7e, 0x61, 0x6f, 0x50, 0x71, 0x7f, 0x60, 0x70
78 };
79 
80 // Memory needed for lookup tables of one Huffman tree group. Red, blue, alpha
81 // and distance alphabets are constant (256 for red, blue and alpha, 40 for
82 // distance) and lookup table sizes for them in worst case are 630 and 410
83 // respectively. Size of green alphabet depends on color cache size and is equal
84 // to 256 (green component values) + 24 (length prefix values)
85 // + color_cache_size (between 0 and 2048).
86 // All values computed for 8-bit first level lookup with Mark Adler's tool:
87 // https://github.com/madler/zlib/blob/v1.2.5/examples/enough.c
88 #define FIXED_TABLE_SIZE (630 * 3 + 410)
89 static const uint16_t kTableSize[12] = {
90   FIXED_TABLE_SIZE + 654,
91   FIXED_TABLE_SIZE + 656,
92   FIXED_TABLE_SIZE + 658,
93   FIXED_TABLE_SIZE + 662,
94   FIXED_TABLE_SIZE + 670,
95   FIXED_TABLE_SIZE + 686,
96   FIXED_TABLE_SIZE + 718,
97   FIXED_TABLE_SIZE + 782,
98   FIXED_TABLE_SIZE + 912,
99   FIXED_TABLE_SIZE + 1168,
100   FIXED_TABLE_SIZE + 1680,
101   FIXED_TABLE_SIZE + 2704
102 };
103 
104 static int DecodeImageStream(int xsize, int ysize,
105                              int is_level0,
106                              VP8LDecoder* const dec,
107                              uint32_t** const decoded_data);
108 
109 //------------------------------------------------------------------------------
110 
VP8LCheckSignature(const uint8_t * const data,size_t size)111 int VP8LCheckSignature(const uint8_t* const data, size_t size) {
112   return (size >= VP8L_FRAME_HEADER_SIZE &&
113           data[0] == VP8L_MAGIC_BYTE &&
114           (data[4] >> 5) == 0);  // version
115 }
116 
ReadImageInfo(VP8LBitReader * const br,int * const width,int * const height,int * const has_alpha)117 static int ReadImageInfo(VP8LBitReader* const br,
118                          int* const width, int* const height,
119                          int* const has_alpha) {
120   if (VP8LReadBits(br, 8) != VP8L_MAGIC_BYTE) return 0;
121   *width = VP8LReadBits(br, VP8L_IMAGE_SIZE_BITS) + 1;
122   *height = VP8LReadBits(br, VP8L_IMAGE_SIZE_BITS) + 1;
123   *has_alpha = VP8LReadBits(br, 1);
124   if (VP8LReadBits(br, VP8L_VERSION_BITS) != 0) return 0;
125   return !br->eos_;
126 }
127 
VP8LGetInfo(const uint8_t * data,size_t data_size,int * const width,int * const height,int * const has_alpha)128 int VP8LGetInfo(const uint8_t* data, size_t data_size,
129                 int* const width, int* const height, int* const has_alpha) {
130   if (data == NULL || data_size < VP8L_FRAME_HEADER_SIZE) {
131     return 0;         // not enough data
132   } else if (!VP8LCheckSignature(data, data_size)) {
133     return 0;         // bad signature
134   } else {
135     int w, h, a;
136     VP8LBitReader br;
137     VP8LInitBitReader(&br, data, data_size);
138     if (!ReadImageInfo(&br, &w, &h, &a)) {
139       return 0;
140     }
141     if (width != NULL) *width = w;
142     if (height != NULL) *height = h;
143     if (has_alpha != NULL) *has_alpha = a;
144     return 1;
145   }
146 }
147 
148 //------------------------------------------------------------------------------
149 
GetCopyDistance(int distance_symbol,VP8LBitReader * const br)150 static WEBP_INLINE int GetCopyDistance(int distance_symbol,
151                                        VP8LBitReader* const br) {
152   int extra_bits, offset;
153   if (distance_symbol < 4) {
154     return distance_symbol + 1;
155   }
156   extra_bits = (distance_symbol - 2) >> 1;
157   offset = (2 + (distance_symbol & 1)) << extra_bits;
158   return offset + VP8LReadBits(br, extra_bits) + 1;
159 }
160 
GetCopyLength(int length_symbol,VP8LBitReader * const br)161 static WEBP_INLINE int GetCopyLength(int length_symbol,
162                                      VP8LBitReader* const br) {
163   // Length and distance prefixes are encoded the same way.
164   return GetCopyDistance(length_symbol, br);
165 }
166 
PlaneCodeToDistance(int xsize,int plane_code)167 static WEBP_INLINE int PlaneCodeToDistance(int xsize, int plane_code) {
168   if (plane_code > CODE_TO_PLANE_CODES) {
169     return plane_code - CODE_TO_PLANE_CODES;
170   } else {
171     const int dist_code = kCodeToPlane[plane_code - 1];
172     const int yoffset = dist_code >> 4;
173     const int xoffset = 8 - (dist_code & 0xf);
174     const int dist = yoffset * xsize + xoffset;
175     return (dist >= 1) ? dist : 1;  // dist<1 can happen if xsize is very small
176   }
177 }
178 
179 //------------------------------------------------------------------------------
180 // Decodes the next Huffman code from bit-stream.
181 // FillBitWindow(br) needs to be called at minimum every second call
182 // to ReadSymbol, in order to pre-fetch enough bits.
ReadSymbol(const HuffmanCode * table,VP8LBitReader * const br)183 static WEBP_INLINE int ReadSymbol(const HuffmanCode* table,
184                                   VP8LBitReader* const br) {
185   int nbits;
186   uint32_t val = VP8LPrefetchBits(br);
187   table += val & HUFFMAN_TABLE_MASK;
188   nbits = table->bits - HUFFMAN_TABLE_BITS;
189   if (nbits > 0) {
190     VP8LSetBitPos(br, br->bit_pos_ + HUFFMAN_TABLE_BITS);
191     val = VP8LPrefetchBits(br);
192     table += table->value;
193     table += val & ((1 << nbits) - 1);
194   }
195   VP8LSetBitPos(br, br->bit_pos_ + table->bits);
196   return table->value;
197 }
198 
199 // Reads packed symbol depending on GREEN channel
200 #define BITS_SPECIAL_MARKER 0x100  // something large enough (and a bit-mask)
201 #define PACKED_NON_LITERAL_CODE 0  // must be < NUM_LITERAL_CODES
ReadPackedSymbols(const HTreeGroup * group,VP8LBitReader * const br,uint32_t * const dst)202 static WEBP_INLINE int ReadPackedSymbols(const HTreeGroup* group,
203                                          VP8LBitReader* const br,
204                                          uint32_t* const dst) {
205   const uint32_t val = VP8LPrefetchBits(br) & (HUFFMAN_PACKED_TABLE_SIZE - 1);
206   const HuffmanCode32 code = group->packed_table[val];
207   assert(group->use_packed_table);
208   if (code.bits < BITS_SPECIAL_MARKER) {
209     VP8LSetBitPos(br, br->bit_pos_ + code.bits);
210     *dst = code.value;
211     return PACKED_NON_LITERAL_CODE;
212   } else {
213     VP8LSetBitPos(br, br->bit_pos_ + code.bits - BITS_SPECIAL_MARKER);
214     assert(code.value >= NUM_LITERAL_CODES);
215     return code.value;
216   }
217 }
218 
AccumulateHCode(HuffmanCode hcode,int shift,HuffmanCode32 * const huff)219 static int AccumulateHCode(HuffmanCode hcode, int shift,
220                            HuffmanCode32* const huff) {
221   huff->bits += hcode.bits;
222   huff->value |= (uint32_t)hcode.value << shift;
223   assert(huff->bits <= HUFFMAN_TABLE_BITS);
224   return hcode.bits;
225 }
226 
BuildPackedTable(HTreeGroup * const htree_group)227 static void BuildPackedTable(HTreeGroup* const htree_group) {
228   uint32_t code;
229   for (code = 0; code < HUFFMAN_PACKED_TABLE_SIZE; ++code) {
230     uint32_t bits = code;
231     HuffmanCode32* const huff = &htree_group->packed_table[bits];
232     HuffmanCode hcode = htree_group->htrees[GREEN][bits];
233     if (hcode.value >= NUM_LITERAL_CODES) {
234       huff->bits = hcode.bits + BITS_SPECIAL_MARKER;
235       huff->value = hcode.value;
236     } else {
237       huff->bits = 0;
238       huff->value = 0;
239       bits >>= AccumulateHCode(hcode, 8, huff);
240       bits >>= AccumulateHCode(htree_group->htrees[RED][bits], 16, huff);
241       bits >>= AccumulateHCode(htree_group->htrees[BLUE][bits], 0, huff);
242       bits >>= AccumulateHCode(htree_group->htrees[ALPHA][bits], 24, huff);
243       (void)bits;
244     }
245   }
246 }
247 
ReadHuffmanCodeLengths(VP8LDecoder * const dec,const int * const code_length_code_lengths,int num_symbols,int * const code_lengths)248 static int ReadHuffmanCodeLengths(
249     VP8LDecoder* const dec, const int* const code_length_code_lengths,
250     int num_symbols, int* const code_lengths) {
251   int ok = 0;
252   VP8LBitReader* const br = &dec->br_;
253   int symbol;
254   int max_symbol;
255   int prev_code_len = DEFAULT_CODE_LENGTH;
256   HuffmanCode table[1 << LENGTHS_TABLE_BITS];
257 
258   if (!VP8LBuildHuffmanTable(table, LENGTHS_TABLE_BITS,
259                              code_length_code_lengths,
260                              NUM_CODE_LENGTH_CODES)) {
261     goto End;
262   }
263 
264   if (VP8LReadBits(br, 1)) {    // use length
265     const int length_nbits = 2 + 2 * VP8LReadBits(br, 3);
266     max_symbol = 2 + VP8LReadBits(br, length_nbits);
267     if (max_symbol > num_symbols) {
268       goto End;
269     }
270   } else {
271     max_symbol = num_symbols;
272   }
273 
274   symbol = 0;
275   while (symbol < num_symbols) {
276     const HuffmanCode* p;
277     int code_len;
278     if (max_symbol-- == 0) break;
279     VP8LFillBitWindow(br);
280     p = &table[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK];
281     VP8LSetBitPos(br, br->bit_pos_ + p->bits);
282     code_len = p->value;
283     if (code_len < kCodeLengthLiterals) {
284       code_lengths[symbol++] = code_len;
285       if (code_len != 0) prev_code_len = code_len;
286     } else {
287       const int use_prev = (code_len == kCodeLengthRepeatCode);
288       const int slot = code_len - kCodeLengthLiterals;
289       const int extra_bits = kCodeLengthExtraBits[slot];
290       const int repeat_offset = kCodeLengthRepeatOffsets[slot];
291       int repeat = VP8LReadBits(br, extra_bits) + repeat_offset;
292       if (symbol + repeat > num_symbols) {
293         goto End;
294       } else {
295         const int length = use_prev ? prev_code_len : 0;
296         while (repeat-- > 0) code_lengths[symbol++] = length;
297       }
298     }
299   }
300   ok = 1;
301 
302  End:
303   if (!ok) dec->status_ = VP8_STATUS_BITSTREAM_ERROR;
304   return ok;
305 }
306 
307 // 'code_lengths' is pre-allocated temporary buffer, used for creating Huffman
308 // tree.
ReadHuffmanCode(int alphabet_size,VP8LDecoder * const dec,int * const code_lengths,HuffmanCode * const table)309 static int ReadHuffmanCode(int alphabet_size, VP8LDecoder* const dec,
310                            int* const code_lengths, HuffmanCode* const table) {
311   int ok = 0;
312   int size = 0;
313   VP8LBitReader* const br = &dec->br_;
314   const int simple_code = VP8LReadBits(br, 1);
315 
316   memset(code_lengths, 0, alphabet_size * sizeof(*code_lengths));
317 
318   if (simple_code) {  // Read symbols, codes & code lengths directly.
319     const int num_symbols = VP8LReadBits(br, 1) + 1;
320     const int first_symbol_len_code = VP8LReadBits(br, 1);
321     // The first code is either 1 bit or 8 bit code.
322     int symbol = VP8LReadBits(br, (first_symbol_len_code == 0) ? 1 : 8);
323     code_lengths[symbol] = 1;
324     // The second code (if present), is always 8 bit long.
325     if (num_symbols == 2) {
326       symbol = VP8LReadBits(br, 8);
327       code_lengths[symbol] = 1;
328     }
329     ok = 1;
330   } else {  // Decode Huffman-coded code lengths.
331     int i;
332     int code_length_code_lengths[NUM_CODE_LENGTH_CODES] = { 0 };
333     const int num_codes = VP8LReadBits(br, 4) + 4;
334     if (num_codes > NUM_CODE_LENGTH_CODES) {
335       dec->status_ = VP8_STATUS_BITSTREAM_ERROR;
336       return 0;
337     }
338 
339     for (i = 0; i < num_codes; ++i) {
340       code_length_code_lengths[kCodeLengthCodeOrder[i]] = VP8LReadBits(br, 3);
341     }
342     ok = ReadHuffmanCodeLengths(dec, code_length_code_lengths, alphabet_size,
343                                 code_lengths);
344   }
345 
346   ok = ok && !br->eos_;
347   if (ok) {
348     size = VP8LBuildHuffmanTable(table, HUFFMAN_TABLE_BITS,
349                                  code_lengths, alphabet_size);
350   }
351   if (!ok || size == 0) {
352     dec->status_ = VP8_STATUS_BITSTREAM_ERROR;
353     return 0;
354   }
355   return size;
356 }
357 
ReadHuffmanCodes(VP8LDecoder * const dec,int xsize,int ysize,int color_cache_bits,int allow_recursion)358 static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
359                             int color_cache_bits, int allow_recursion) {
360   int i, j;
361   VP8LBitReader* const br = &dec->br_;
362   VP8LMetadata* const hdr = &dec->hdr_;
363   uint32_t* huffman_image = NULL;
364   HTreeGroup* htree_groups = NULL;
365   HuffmanCode* huffman_tables = NULL;
366   HuffmanCode* huffman_table = NULL;
367   int num_htree_groups = 1;
368   int num_htree_groups_max = 1;
369   int max_alphabet_size = 0;
370   int* code_lengths = NULL;
371   const int table_size = kTableSize[color_cache_bits];
372   int* mapping = NULL;
373   int ok = 0;
374 
375   if (allow_recursion && VP8LReadBits(br, 1)) {
376     // use meta Huffman codes.
377     const int huffman_precision = VP8LReadBits(br, 3) + 2;
378     const int huffman_xsize = VP8LSubSampleSize(xsize, huffman_precision);
379     const int huffman_ysize = VP8LSubSampleSize(ysize, huffman_precision);
380     const int huffman_pixs = huffman_xsize * huffman_ysize;
381     if (!DecodeImageStream(huffman_xsize, huffman_ysize, 0, dec,
382                            &huffman_image)) {
383       goto Error;
384     }
385     hdr->huffman_subsample_bits_ = huffman_precision;
386     for (i = 0; i < huffman_pixs; ++i) {
387       // The huffman data is stored in red and green bytes.
388       const int group = (huffman_image[i] >> 8) & 0xffff;
389       huffman_image[i] = group;
390       if (group >= num_htree_groups_max) {
391         num_htree_groups_max = group + 1;
392       }
393     }
394     // Check the validity of num_htree_groups_max. If it seems too big, use a
395     // smaller value for later. This will prevent big memory allocations to end
396     // up with a bad bitstream anyway.
397     // The value of 1000 is totally arbitrary. We know that num_htree_groups_max
398     // is smaller than (1 << 16) and should be smaller than the number of pixels
399     // (though the format allows it to be bigger).
400     if (num_htree_groups_max > 1000 || num_htree_groups_max > xsize * ysize) {
401       // Create a mapping from the used indices to the minimal set of used
402       // values [0, num_htree_groups)
403       mapping = (int*)WebPSafeMalloc(num_htree_groups_max, sizeof(*mapping));
404       if (mapping == NULL) {
405         dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
406         goto Error;
407       }
408       // -1 means a value is unmapped, and therefore unused in the Huffman
409       // image.
410       memset(mapping, 0xff, num_htree_groups_max * sizeof(*mapping));
411       for (num_htree_groups = 0, i = 0; i < huffman_pixs; ++i) {
412         // Get the current mapping for the group and remap the Huffman image.
413         int* const mapped_group = &mapping[huffman_image[i]];
414         if (*mapped_group == -1) *mapped_group = num_htree_groups++;
415         huffman_image[i] = *mapped_group;
416       }
417     } else {
418       num_htree_groups = num_htree_groups_max;
419     }
420   }
421 
422   if (br->eos_) goto Error;
423 
424   // Find maximum alphabet size for the htree group.
425   for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; ++j) {
426     int alphabet_size = kAlphabetSize[j];
427     if (j == 0 && color_cache_bits > 0) {
428       alphabet_size += 1 << color_cache_bits;
429     }
430     if (max_alphabet_size < alphabet_size) {
431       max_alphabet_size = alphabet_size;
432     }
433   }
434 
435   code_lengths = (int*)WebPSafeCalloc((uint64_t)max_alphabet_size,
436                                       sizeof(*code_lengths));
437   huffman_tables = (HuffmanCode*)WebPSafeMalloc(num_htree_groups * table_size,
438                                                 sizeof(*huffman_tables));
439   htree_groups = VP8LHtreeGroupsNew(num_htree_groups);
440 
441   if (htree_groups == NULL || code_lengths == NULL || huffman_tables == NULL) {
442     dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
443     goto Error;
444   }
445 
446   huffman_table = huffman_tables;
447   for (i = 0; i < num_htree_groups_max; ++i) {
448     // If the index "i" is unused in the Huffman image, just make sure the
449     // coefficients are valid but do not store them.
450     if (mapping != NULL && mapping[i] == -1) {
451       for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; ++j) {
452         int alphabet_size = kAlphabetSize[j];
453         if (j == 0 && color_cache_bits > 0) {
454           alphabet_size += (1 << color_cache_bits);
455         }
456         // Passing in NULL so that nothing gets filled.
457         if (!ReadHuffmanCode(alphabet_size, dec, code_lengths, NULL)) {
458           goto Error;
459         }
460       }
461     } else {
462       HTreeGroup* const htree_group =
463           &htree_groups[(mapping == NULL) ? i : mapping[i]];
464       HuffmanCode** const htrees = htree_group->htrees;
465       int size;
466       int total_size = 0;
467       int is_trivial_literal = 1;
468       int max_bits = 0;
469       for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; ++j) {
470         int alphabet_size = kAlphabetSize[j];
471         htrees[j] = huffman_table;
472         if (j == 0 && color_cache_bits > 0) {
473           alphabet_size += (1 << color_cache_bits);
474         }
475         size = ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_table);
476         if (size == 0) {
477           goto Error;
478         }
479         if (is_trivial_literal && kLiteralMap[j] == 1) {
480           is_trivial_literal = (huffman_table->bits == 0);
481         }
482         total_size += huffman_table->bits;
483         huffman_table += size;
484         if (j <= ALPHA) {
485           int local_max_bits = code_lengths[0];
486           int k;
487           for (k = 1; k < alphabet_size; ++k) {
488             if (code_lengths[k] > local_max_bits) {
489               local_max_bits = code_lengths[k];
490             }
491           }
492           max_bits += local_max_bits;
493         }
494       }
495       htree_group->is_trivial_literal = is_trivial_literal;
496       htree_group->is_trivial_code = 0;
497       if (is_trivial_literal) {
498         const int red = htrees[RED][0].value;
499         const int blue = htrees[BLUE][0].value;
500         const int alpha = htrees[ALPHA][0].value;
501         htree_group->literal_arb = ((uint32_t)alpha << 24) | (red << 16) | blue;
502         if (total_size == 0 && htrees[GREEN][0].value < NUM_LITERAL_CODES) {
503           htree_group->is_trivial_code = 1;
504           htree_group->literal_arb |= htrees[GREEN][0].value << 8;
505         }
506       }
507       htree_group->use_packed_table =
508           !htree_group->is_trivial_code && (max_bits < HUFFMAN_PACKED_BITS);
509       if (htree_group->use_packed_table) BuildPackedTable(htree_group);
510     }
511   }
512   ok = 1;
513 
514   // All OK. Finalize pointers.
515   hdr->huffman_image_ = huffman_image;
516   hdr->num_htree_groups_ = num_htree_groups;
517   hdr->htree_groups_ = htree_groups;
518   hdr->huffman_tables_ = huffman_tables;
519 
520  Error:
521   WebPSafeFree(code_lengths);
522   WebPSafeFree(mapping);
523   if (!ok) {
524     WebPSafeFree(huffman_image);
525     WebPSafeFree(huffman_tables);
526     VP8LHtreeGroupsFree(htree_groups);
527   }
528   return ok;
529 }
530 
531 //------------------------------------------------------------------------------
532 // Scaling.
533 
534 #if !defined(WEBP_REDUCE_SIZE)
AllocateAndInitRescaler(VP8LDecoder * const dec,VP8Io * const io)535 static int AllocateAndInitRescaler(VP8LDecoder* const dec, VP8Io* const io) {
536   const int num_channels = 4;
537   const int in_width = io->mb_w;
538   const int out_width = io->scaled_width;
539   const int in_height = io->mb_h;
540   const int out_height = io->scaled_height;
541   const uint64_t work_size = 2 * num_channels * (uint64_t)out_width;
542   rescaler_t* work;        // Rescaler work area.
543   const uint64_t scaled_data_size = (uint64_t)out_width;
544   uint32_t* scaled_data;  // Temporary storage for scaled BGRA data.
545   const uint64_t memory_size = sizeof(*dec->rescaler) +
546                                work_size * sizeof(*work) +
547                                scaled_data_size * sizeof(*scaled_data);
548   uint8_t* memory = (uint8_t*)WebPSafeMalloc(memory_size, sizeof(*memory));
549   if (memory == NULL) {
550     dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
551     return 0;
552   }
553   assert(dec->rescaler_memory == NULL);
554   dec->rescaler_memory = memory;
555 
556   dec->rescaler = (WebPRescaler*)memory;
557   memory += sizeof(*dec->rescaler);
558   work = (rescaler_t*)memory;
559   memory += work_size * sizeof(*work);
560   scaled_data = (uint32_t*)memory;
561 
562   if (!WebPRescalerInit(dec->rescaler, in_width, in_height,
563                         (uint8_t*)scaled_data, out_width, out_height,
564                         0, num_channels, work)) {
565     return 0;
566   }
567   return 1;
568 }
569 #endif   // WEBP_REDUCE_SIZE
570 
571 //------------------------------------------------------------------------------
572 // Export to ARGB
573 
574 #if !defined(WEBP_REDUCE_SIZE)
575 
576 // We have special "export" function since we need to convert from BGRA
Export(WebPRescaler * const rescaler,WEBP_CSP_MODE colorspace,int rgba_stride,uint8_t * const rgba)577 static int Export(WebPRescaler* const rescaler, WEBP_CSP_MODE colorspace,
578                   int rgba_stride, uint8_t* const rgba) {
579   uint32_t* const src = (uint32_t*)rescaler->dst;
580   uint8_t* dst = rgba;
581   const int dst_width = rescaler->dst_width;
582   int num_lines_out = 0;
583   while (WebPRescalerHasPendingOutput(rescaler)) {
584     WebPRescalerExportRow(rescaler);
585     WebPMultARGBRow(src, dst_width, 1);
586     VP8LConvertFromBGRA(src, dst_width, colorspace, dst);
587     dst += rgba_stride;
588     ++num_lines_out;
589   }
590   return num_lines_out;
591 }
592 
593 // Emit scaled rows.
EmitRescaledRowsRGBA(const VP8LDecoder * const dec,uint8_t * in,int in_stride,int mb_h,uint8_t * const out,int out_stride)594 static int EmitRescaledRowsRGBA(const VP8LDecoder* const dec,
595                                 uint8_t* in, int in_stride, int mb_h,
596                                 uint8_t* const out, int out_stride) {
597   const WEBP_CSP_MODE colorspace = dec->output_->colorspace;
598   int num_lines_in = 0;
599   int num_lines_out = 0;
600   while (num_lines_in < mb_h) {
601     uint8_t* const row_in = in + (uint64_t)num_lines_in * in_stride;
602     uint8_t* const row_out = out + (uint64_t)num_lines_out * out_stride;
603     const int lines_left = mb_h - num_lines_in;
604     const int needed_lines = WebPRescaleNeededLines(dec->rescaler, lines_left);
605     int lines_imported;
606     assert(needed_lines > 0 && needed_lines <= lines_left);
607     WebPMultARGBRows(row_in, in_stride,
608                      dec->rescaler->src_width, needed_lines, 0);
609     lines_imported =
610         WebPRescalerImport(dec->rescaler, lines_left, row_in, in_stride);
611     assert(lines_imported == needed_lines);
612     num_lines_in += lines_imported;
613     num_lines_out += Export(dec->rescaler, colorspace, out_stride, row_out);
614   }
615   return num_lines_out;
616 }
617 
618 #endif   // WEBP_REDUCE_SIZE
619 
620 // Emit rows without any scaling.
EmitRows(WEBP_CSP_MODE colorspace,const uint8_t * row_in,int in_stride,int mb_w,int mb_h,uint8_t * const out,int out_stride)621 static int EmitRows(WEBP_CSP_MODE colorspace,
622                     const uint8_t* row_in, int in_stride,
623                     int mb_w, int mb_h,
624                     uint8_t* const out, int out_stride) {
625   int lines = mb_h;
626   uint8_t* row_out = out;
627   while (lines-- > 0) {
628     VP8LConvertFromBGRA((const uint32_t*)row_in, mb_w, colorspace, row_out);
629     row_in += in_stride;
630     row_out += out_stride;
631   }
632   return mb_h;  // Num rows out == num rows in.
633 }
634 
635 //------------------------------------------------------------------------------
636 // Export to YUVA
637 
ConvertToYUVA(const uint32_t * const src,int width,int y_pos,const WebPDecBuffer * const output)638 static void ConvertToYUVA(const uint32_t* const src, int width, int y_pos,
639                           const WebPDecBuffer* const output) {
640   const WebPYUVABuffer* const buf = &output->u.YUVA;
641 
642   // first, the luma plane
643   WebPConvertARGBToY(src, buf->y + y_pos * buf->y_stride, width);
644 
645   // then U/V planes
646   {
647     uint8_t* const u = buf->u + (y_pos >> 1) * buf->u_stride;
648     uint8_t* const v = buf->v + (y_pos >> 1) * buf->v_stride;
649     // even lines: store values
650     // odd lines: average with previous values
651     WebPConvertARGBToUV(src, u, v, width, !(y_pos & 1));
652   }
653   // Lastly, store alpha if needed.
654   if (buf->a != NULL) {
655     uint8_t* const a = buf->a + y_pos * buf->a_stride;
656 #if defined(WORDS_BIGENDIAN)
657     WebPExtractAlpha((uint8_t*)src + 0, 0, width, 1, a, 0);
658 #else
659     WebPExtractAlpha((uint8_t*)src + 3, 0, width, 1, a, 0);
660 #endif
661   }
662 }
663 
ExportYUVA(const VP8LDecoder * const dec,int y_pos)664 static int ExportYUVA(const VP8LDecoder* const dec, int y_pos) {
665   WebPRescaler* const rescaler = dec->rescaler;
666   uint32_t* const src = (uint32_t*)rescaler->dst;
667   const int dst_width = rescaler->dst_width;
668   int num_lines_out = 0;
669   while (WebPRescalerHasPendingOutput(rescaler)) {
670     WebPRescalerExportRow(rescaler);
671     WebPMultARGBRow(src, dst_width, 1);
672     ConvertToYUVA(src, dst_width, y_pos, dec->output_);
673     ++y_pos;
674     ++num_lines_out;
675   }
676   return num_lines_out;
677 }
678 
EmitRescaledRowsYUVA(const VP8LDecoder * const dec,uint8_t * in,int in_stride,int mb_h)679 static int EmitRescaledRowsYUVA(const VP8LDecoder* const dec,
680                                 uint8_t* in, int in_stride, int mb_h) {
681   int num_lines_in = 0;
682   int y_pos = dec->last_out_row_;
683   while (num_lines_in < mb_h) {
684     const int lines_left = mb_h - num_lines_in;
685     const int needed_lines = WebPRescaleNeededLines(dec->rescaler, lines_left);
686     int lines_imported;
687     WebPMultARGBRows(in, in_stride, dec->rescaler->src_width, needed_lines, 0);
688     lines_imported =
689         WebPRescalerImport(dec->rescaler, lines_left, in, in_stride);
690     assert(lines_imported == needed_lines);
691     num_lines_in += lines_imported;
692     in += needed_lines * in_stride;
693     y_pos += ExportYUVA(dec, y_pos);
694   }
695   return y_pos;
696 }
697 
EmitRowsYUVA(const VP8LDecoder * const dec,const uint8_t * in,int in_stride,int mb_w,int num_rows)698 static int EmitRowsYUVA(const VP8LDecoder* const dec,
699                         const uint8_t* in, int in_stride,
700                         int mb_w, int num_rows) {
701   int y_pos = dec->last_out_row_;
702   while (num_rows-- > 0) {
703     ConvertToYUVA((const uint32_t*)in, mb_w, y_pos, dec->output_);
704     in += in_stride;
705     ++y_pos;
706   }
707   return y_pos;
708 }
709 
710 //------------------------------------------------------------------------------
711 // Cropping.
712 
713 // Sets io->mb_y, io->mb_h & io->mb_w according to start row, end row and
714 // crop options. Also updates the input data pointer, so that it points to the
715 // start of the cropped window. Note that pixels are in ARGB format even if
716 // 'in_data' is uint8_t*.
717 // Returns true if the crop window is not empty.
SetCropWindow(VP8Io * const io,int y_start,int y_end,uint8_t ** const in_data,int pixel_stride)718 static int SetCropWindow(VP8Io* const io, int y_start, int y_end,
719                          uint8_t** const in_data, int pixel_stride) {
720   assert(y_start < y_end);
721   assert(io->crop_left < io->crop_right);
722   if (y_end > io->crop_bottom) {
723     y_end = io->crop_bottom;  // make sure we don't overflow on last row.
724   }
725   if (y_start < io->crop_top) {
726     const int delta = io->crop_top - y_start;
727     y_start = io->crop_top;
728     *in_data += delta * pixel_stride;
729   }
730   if (y_start >= y_end) return 0;  // Crop window is empty.
731 
732   *in_data += io->crop_left * sizeof(uint32_t);
733 
734   io->mb_y = y_start - io->crop_top;
735   io->mb_w = io->crop_right - io->crop_left;
736   io->mb_h = y_end - y_start;
737   return 1;  // Non-empty crop window.
738 }
739 
740 //------------------------------------------------------------------------------
741 
GetMetaIndex(const uint32_t * const image,int xsize,int bits,int x,int y)742 static WEBP_INLINE int GetMetaIndex(
743     const uint32_t* const image, int xsize, int bits, int x, int y) {
744   if (bits == 0) return 0;
745   return image[xsize * (y >> bits) + (x >> bits)];
746 }
747 
GetHtreeGroupForPos(VP8LMetadata * const hdr,int x,int y)748 static WEBP_INLINE HTreeGroup* GetHtreeGroupForPos(VP8LMetadata* const hdr,
749                                                    int x, int y) {
750   const int meta_index = GetMetaIndex(hdr->huffman_image_, hdr->huffman_xsize_,
751                                       hdr->huffman_subsample_bits_, x, y);
752   assert(meta_index < hdr->num_htree_groups_);
753   return hdr->htree_groups_ + meta_index;
754 }
755 
756 //------------------------------------------------------------------------------
757 // Main loop, with custom row-processing function
758 
759 typedef void (*ProcessRowsFunc)(VP8LDecoder* const dec, int row);
760 
ApplyInverseTransforms(VP8LDecoder * const dec,int start_row,int num_rows,const uint32_t * const rows)761 static void ApplyInverseTransforms(VP8LDecoder* const dec,
762                                    int start_row, int num_rows,
763                                    const uint32_t* const rows) {
764   int n = dec->next_transform_;
765   const int cache_pixs = dec->width_ * num_rows;
766   const int end_row = start_row + num_rows;
767   const uint32_t* rows_in = rows;
768   uint32_t* const rows_out = dec->argb_cache_;
769 
770   // Inverse transforms.
771   while (n-- > 0) {
772     VP8LTransform* const transform = &dec->transforms_[n];
773     VP8LInverseTransform(transform, start_row, end_row, rows_in, rows_out);
774     rows_in = rows_out;
775   }
776   if (rows_in != rows_out) {
777     // No transform called, hence just copy.
778     memcpy(rows_out, rows_in, cache_pixs * sizeof(*rows_out));
779   }
780 }
781 
782 // Processes (transforms, scales & color-converts) the rows decoded after the
783 // last call.
ProcessRows(VP8LDecoder * const dec,int row)784 static void ProcessRows(VP8LDecoder* const dec, int row) {
785   const uint32_t* const rows = dec->pixels_ + dec->width_ * dec->last_row_;
786   const int num_rows = row - dec->last_row_;
787 
788   assert(row <= dec->io_->crop_bottom);
789   // We can't process more than NUM_ARGB_CACHE_ROWS at a time (that's the size
790   // of argb_cache_), but we currently don't need more than that.
791   assert(num_rows <= NUM_ARGB_CACHE_ROWS);
792   if (num_rows > 0) {    // Emit output.
793     VP8Io* const io = dec->io_;
794     uint8_t* rows_data = (uint8_t*)dec->argb_cache_;
795     const int in_stride = io->width * sizeof(uint32_t);  // in unit of RGBA
796     ApplyInverseTransforms(dec, dec->last_row_, num_rows, rows);
797     if (!SetCropWindow(io, dec->last_row_, row, &rows_data, in_stride)) {
798       // Nothing to output (this time).
799     } else {
800       const WebPDecBuffer* const output = dec->output_;
801       if (WebPIsRGBMode(output->colorspace)) {  // convert to RGBA
802         const WebPRGBABuffer* const buf = &output->u.RGBA;
803         uint8_t* const rgba =
804             buf->rgba + (int64_t)dec->last_out_row_ * buf->stride;
805         const int num_rows_out =
806 #if !defined(WEBP_REDUCE_SIZE)
807          io->use_scaling ?
808             EmitRescaledRowsRGBA(dec, rows_data, in_stride, io->mb_h,
809                                  rgba, buf->stride) :
810 #endif  // WEBP_REDUCE_SIZE
811             EmitRows(output->colorspace, rows_data, in_stride,
812                      io->mb_w, io->mb_h, rgba, buf->stride);
813         // Update 'last_out_row_'.
814         dec->last_out_row_ += num_rows_out;
815       } else {                              // convert to YUVA
816         dec->last_out_row_ = io->use_scaling ?
817             EmitRescaledRowsYUVA(dec, rows_data, in_stride, io->mb_h) :
818             EmitRowsYUVA(dec, rows_data, in_stride, io->mb_w, io->mb_h);
819       }
820       assert(dec->last_out_row_ <= output->height);
821     }
822   }
823 
824   // Update 'last_row_'.
825   dec->last_row_ = row;
826   assert(dec->last_row_ <= dec->height_);
827 }
828 
829 // Row-processing for the special case when alpha data contains only one
830 // transform (color indexing), and trivial non-green literals.
Is8bOptimizable(const VP8LMetadata * const hdr)831 static int Is8bOptimizable(const VP8LMetadata* const hdr) {
832   int i;
833   if (hdr->color_cache_size_ > 0) return 0;
834   // When the Huffman tree contains only one symbol, we can skip the
835   // call to ReadSymbol() for red/blue/alpha channels.
836   for (i = 0; i < hdr->num_htree_groups_; ++i) {
837     HuffmanCode** const htrees = hdr->htree_groups_[i].htrees;
838     if (htrees[RED][0].bits > 0) return 0;
839     if (htrees[BLUE][0].bits > 0) return 0;
840     if (htrees[ALPHA][0].bits > 0) return 0;
841   }
842   return 1;
843 }
844 
AlphaApplyFilter(ALPHDecoder * const alph_dec,int first_row,int last_row,uint8_t * out,int stride)845 static void AlphaApplyFilter(ALPHDecoder* const alph_dec,
846                              int first_row, int last_row,
847                              uint8_t* out, int stride) {
848   if (alph_dec->filter_ != WEBP_FILTER_NONE) {
849     int y;
850     const uint8_t* prev_line = alph_dec->prev_line_;
851     assert(WebPUnfilters[alph_dec->filter_] != NULL);
852     for (y = first_row; y < last_row; ++y) {
853       WebPUnfilters[alph_dec->filter_](prev_line, out, out, stride);
854       prev_line = out;
855       out += stride;
856     }
857     alph_dec->prev_line_ = prev_line;
858   }
859 }
860 
ExtractPalettedAlphaRows(VP8LDecoder * const dec,int last_row)861 static void ExtractPalettedAlphaRows(VP8LDecoder* const dec, int last_row) {
862   // For vertical and gradient filtering, we need to decode the part above the
863   // crop_top row, in order to have the correct spatial predictors.
864   ALPHDecoder* const alph_dec = (ALPHDecoder*)dec->io_->opaque;
865   const int top_row =
866       (alph_dec->filter_ == WEBP_FILTER_NONE ||
867        alph_dec->filter_ == WEBP_FILTER_HORIZONTAL) ? dec->io_->crop_top
868                                                     : dec->last_row_;
869   const int first_row = (dec->last_row_ < top_row) ? top_row : dec->last_row_;
870   assert(last_row <= dec->io_->crop_bottom);
871   if (last_row > first_row) {
872     // Special method for paletted alpha data. We only process the cropped area.
873     const int width = dec->io_->width;
874     uint8_t* out = alph_dec->output_ + width * first_row;
875     const uint8_t* const in =
876       (uint8_t*)dec->pixels_ + dec->width_ * first_row;
877     VP8LTransform* const transform = &dec->transforms_[0];
878     assert(dec->next_transform_ == 1);
879     assert(transform->type_ == COLOR_INDEXING_TRANSFORM);
880     VP8LColorIndexInverseTransformAlpha(transform, first_row, last_row,
881                                         in, out);
882     AlphaApplyFilter(alph_dec, first_row, last_row, out, width);
883   }
884   dec->last_row_ = dec->last_out_row_ = last_row;
885 }
886 
887 //------------------------------------------------------------------------------
888 // Helper functions for fast pattern copy (8b and 32b)
889 
890 // cyclic rotation of pattern word
Rotate8b(uint32_t V)891 static WEBP_INLINE uint32_t Rotate8b(uint32_t V) {
892 #if defined(WORDS_BIGENDIAN)
893   return ((V & 0xff000000u) >> 24) | (V << 8);
894 #else
895   return ((V & 0xffu) << 24) | (V >> 8);
896 #endif
897 }
898 
899 // copy 1, 2 or 4-bytes pattern
CopySmallPattern8b(const uint8_t * src,uint8_t * dst,int length,uint32_t pattern)900 static WEBP_INLINE void CopySmallPattern8b(const uint8_t* src, uint8_t* dst,
901                                            int length, uint32_t pattern) {
902   int i;
903   // align 'dst' to 4-bytes boundary. Adjust the pattern along the way.
904   while ((uintptr_t)dst & 3) {
905     *dst++ = *src++;
906     pattern = Rotate8b(pattern);
907     --length;
908   }
909   // Copy the pattern 4 bytes at a time.
910   for (i = 0; i < (length >> 2); ++i) {
911     ((uint32_t*)dst)[i] = pattern;
912   }
913   // Finish with left-overs. 'pattern' is still correctly positioned,
914   // so no Rotate8b() call is needed.
915   for (i <<= 2; i < length; ++i) {
916     dst[i] = src[i];
917   }
918 }
919 
CopyBlock8b(uint8_t * const dst,int dist,int length)920 static WEBP_INLINE void CopyBlock8b(uint8_t* const dst, int dist, int length) {
921   const uint8_t* src = dst - dist;
922   if (length >= 8) {
923     uint32_t pattern = 0;
924     switch (dist) {
925       case 1:
926         pattern = src[0];
927 #if defined(__arm__) || defined(_M_ARM)   // arm doesn't like multiply that much
928         pattern |= pattern << 8;
929         pattern |= pattern << 16;
930 #elif defined(WEBP_USE_MIPS_DSP_R2)
931         __asm__ volatile ("replv.qb %0, %0" : "+r"(pattern));
932 #else
933         pattern = 0x01010101u * pattern;
934 #endif
935         break;
936       case 2:
937 #if !defined(WORDS_BIGENDIAN)
938         memcpy(&pattern, src, sizeof(uint16_t));
939 #else
940         pattern = ((uint32_t)src[0] << 8) | src[1];
941 #endif
942 #if defined(__arm__) || defined(_M_ARM)
943         pattern |= pattern << 16;
944 #elif defined(WEBP_USE_MIPS_DSP_R2)
945         __asm__ volatile ("replv.ph %0, %0" : "+r"(pattern));
946 #else
947         pattern = 0x00010001u * pattern;
948 #endif
949         break;
950       case 4:
951         memcpy(&pattern, src, sizeof(uint32_t));
952         break;
953       default:
954         goto Copy;
955     }
956     CopySmallPattern8b(src, dst, length, pattern);
957     return;
958   }
959  Copy:
960   if (dist >= length) {  // no overlap -> use memcpy()
961     memcpy(dst, src, length * sizeof(*dst));
962   } else {
963     int i;
964     for (i = 0; i < length; ++i) dst[i] = src[i];
965   }
966 }
967 
968 // copy pattern of 1 or 2 uint32_t's
CopySmallPattern32b(const uint32_t * src,uint32_t * dst,int length,uint64_t pattern)969 static WEBP_INLINE void CopySmallPattern32b(const uint32_t* src,
970                                             uint32_t* dst,
971                                             int length, uint64_t pattern) {
972   int i;
973   if ((uintptr_t)dst & 4) {           // Align 'dst' to 8-bytes boundary.
974     *dst++ = *src++;
975     pattern = (pattern >> 32) | (pattern << 32);
976     --length;
977   }
978   assert(0 == ((uintptr_t)dst & 7));
979   for (i = 0; i < (length >> 1); ++i) {
980     ((uint64_t*)dst)[i] = pattern;    // Copy the pattern 8 bytes at a time.
981   }
982   if (length & 1) {                   // Finish with left-over.
983     dst[i << 1] = src[i << 1];
984   }
985 }
986 
CopyBlock32b(uint32_t * const dst,int dist,int length)987 static WEBP_INLINE void CopyBlock32b(uint32_t* const dst,
988                                      int dist, int length) {
989   const uint32_t* const src = dst - dist;
990   if (dist <= 2 && length >= 4 && ((uintptr_t)dst & 3) == 0) {
991     uint64_t pattern;
992     if (dist == 1) {
993       pattern = (uint64_t)src[0];
994       pattern |= pattern << 32;
995     } else {
996       memcpy(&pattern, src, sizeof(pattern));
997     }
998     CopySmallPattern32b(src, dst, length, pattern);
999   } else if (dist >= length) {  // no overlap
1000     memcpy(dst, src, length * sizeof(*dst));
1001   } else {
1002     int i;
1003     for (i = 0; i < length; ++i) dst[i] = src[i];
1004   }
1005 }
1006 
1007 //------------------------------------------------------------------------------
1008 
DecodeAlphaData(VP8LDecoder * const dec,uint8_t * const data,int width,int height,int last_row)1009 static int DecodeAlphaData(VP8LDecoder* const dec, uint8_t* const data,
1010                            int width, int height, int last_row) {
1011   int ok = 1;
1012   int row = dec->last_pixel_ / width;
1013   int col = dec->last_pixel_ % width;
1014   VP8LBitReader* const br = &dec->br_;
1015   VP8LMetadata* const hdr = &dec->hdr_;
1016   int pos = dec->last_pixel_;         // current position
1017   const int end = width * height;     // End of data
1018   const int last = width * last_row;  // Last pixel to decode
1019   const int len_code_limit = NUM_LITERAL_CODES + NUM_LENGTH_CODES;
1020   const int mask = hdr->huffman_mask_;
1021   const HTreeGroup* htree_group =
1022       (pos < last) ? GetHtreeGroupForPos(hdr, col, row) : NULL;
1023   assert(pos <= end);
1024   assert(last_row <= height);
1025   assert(Is8bOptimizable(hdr));
1026 
1027   while (!br->eos_ && pos < last) {
1028     int code;
1029     // Only update when changing tile.
1030     if ((col & mask) == 0) {
1031       htree_group = GetHtreeGroupForPos(hdr, col, row);
1032     }
1033     assert(htree_group != NULL);
1034     VP8LFillBitWindow(br);
1035     code = ReadSymbol(htree_group->htrees[GREEN], br);
1036     if (code < NUM_LITERAL_CODES) {  // Literal
1037       data[pos] = code;
1038       ++pos;
1039       ++col;
1040       if (col >= width) {
1041         col = 0;
1042         ++row;
1043         if (row <= last_row && (row % NUM_ARGB_CACHE_ROWS == 0)) {
1044           ExtractPalettedAlphaRows(dec, row);
1045         }
1046       }
1047     } else if (code < len_code_limit) {  // Backward reference
1048       int dist_code, dist;
1049       const int length_sym = code - NUM_LITERAL_CODES;
1050       const int length = GetCopyLength(length_sym, br);
1051       const int dist_symbol = ReadSymbol(htree_group->htrees[DIST], br);
1052       VP8LFillBitWindow(br);
1053       dist_code = GetCopyDistance(dist_symbol, br);
1054       dist = PlaneCodeToDistance(width, dist_code);
1055       if (pos >= dist && end - pos >= length) {
1056         CopyBlock8b(data + pos, dist, length);
1057       } else {
1058         ok = 0;
1059         goto End;
1060       }
1061       pos += length;
1062       col += length;
1063       while (col >= width) {
1064         col -= width;
1065         ++row;
1066         if (row <= last_row && (row % NUM_ARGB_CACHE_ROWS == 0)) {
1067           ExtractPalettedAlphaRows(dec, row);
1068         }
1069       }
1070       if (pos < last && (col & mask)) {
1071         htree_group = GetHtreeGroupForPos(hdr, col, row);
1072       }
1073     } else {  // Not reached
1074       ok = 0;
1075       goto End;
1076     }
1077     br->eos_ = VP8LIsEndOfStream(br);
1078   }
1079   // Process the remaining rows corresponding to last row-block.
1080   ExtractPalettedAlphaRows(dec, row > last_row ? last_row : row);
1081 
1082  End:
1083   br->eos_ = VP8LIsEndOfStream(br);
1084   if (!ok || (br->eos_ && pos < end)) {
1085     ok = 0;
1086     dec->status_ = br->eos_ ? VP8_STATUS_SUSPENDED
1087                             : VP8_STATUS_BITSTREAM_ERROR;
1088   } else {
1089     dec->last_pixel_ = pos;
1090   }
1091   return ok;
1092 }
1093 
SaveState(VP8LDecoder * const dec,int last_pixel)1094 static void SaveState(VP8LDecoder* const dec, int last_pixel) {
1095   assert(dec->incremental_);
1096   dec->saved_br_ = dec->br_;
1097   dec->saved_last_pixel_ = last_pixel;
1098   if (dec->hdr_.color_cache_size_ > 0) {
1099     VP8LColorCacheCopy(&dec->hdr_.color_cache_, &dec->hdr_.saved_color_cache_);
1100   }
1101 }
1102 
RestoreState(VP8LDecoder * const dec)1103 static void RestoreState(VP8LDecoder* const dec) {
1104   assert(dec->br_.eos_);
1105   dec->status_ = VP8_STATUS_SUSPENDED;
1106   dec->br_ = dec->saved_br_;
1107   dec->last_pixel_ = dec->saved_last_pixel_;
1108   if (dec->hdr_.color_cache_size_ > 0) {
1109     VP8LColorCacheCopy(&dec->hdr_.saved_color_cache_, &dec->hdr_.color_cache_);
1110   }
1111 }
1112 
1113 #define SYNC_EVERY_N_ROWS 8  // minimum number of rows between check-points
DecodeImageData(VP8LDecoder * const dec,uint32_t * const data,int width,int height,int last_row,ProcessRowsFunc process_func)1114 static int DecodeImageData(VP8LDecoder* const dec, uint32_t* const data,
1115                            int width, int height, int last_row,
1116                            ProcessRowsFunc process_func) {
1117   int row = dec->last_pixel_ / width;
1118   int col = dec->last_pixel_ % width;
1119   VP8LBitReader* const br = &dec->br_;
1120   VP8LMetadata* const hdr = &dec->hdr_;
1121   uint32_t* src = data + dec->last_pixel_;
1122   uint32_t* last_cached = src;
1123   uint32_t* const src_end = data + width * height;     // End of data
1124   uint32_t* const src_last = data + width * last_row;  // Last pixel to decode
1125   const int len_code_limit = NUM_LITERAL_CODES + NUM_LENGTH_CODES;
1126   const int color_cache_limit = len_code_limit + hdr->color_cache_size_;
1127   int next_sync_row = dec->incremental_ ? row : 1 << 24;
1128   VP8LColorCache* const color_cache =
1129       (hdr->color_cache_size_ > 0) ? &hdr->color_cache_ : NULL;
1130   const int mask = hdr->huffman_mask_;
1131   const HTreeGroup* htree_group =
1132       (src < src_last) ? GetHtreeGroupForPos(hdr, col, row) : NULL;
1133   assert(dec->last_row_ < last_row);
1134   assert(src_last <= src_end);
1135 
1136   while (src < src_last) {
1137     int code;
1138     if (row >= next_sync_row) {
1139       SaveState(dec, (int)(src - data));
1140       next_sync_row = row + SYNC_EVERY_N_ROWS;
1141     }
1142     // Only update when changing tile. Note we could use this test:
1143     // if "((((prev_col ^ col) | prev_row ^ row)) > mask)" -> tile changed
1144     // but that's actually slower and needs storing the previous col/row.
1145     if ((col & mask) == 0) {
1146       htree_group = GetHtreeGroupForPos(hdr, col, row);
1147     }
1148     assert(htree_group != NULL);
1149     if (htree_group->is_trivial_code) {
1150       *src = htree_group->literal_arb;
1151       goto AdvanceByOne;
1152     }
1153     VP8LFillBitWindow(br);
1154     if (htree_group->use_packed_table) {
1155       code = ReadPackedSymbols(htree_group, br, src);
1156       if (VP8LIsEndOfStream(br)) break;
1157       if (code == PACKED_NON_LITERAL_CODE) goto AdvanceByOne;
1158     } else {
1159       code = ReadSymbol(htree_group->htrees[GREEN], br);
1160     }
1161     if (VP8LIsEndOfStream(br)) break;
1162     if (code < NUM_LITERAL_CODES) {  // Literal
1163       if (htree_group->is_trivial_literal) {
1164         *src = htree_group->literal_arb | (code << 8);
1165       } else {
1166         int red, blue, alpha;
1167         red = ReadSymbol(htree_group->htrees[RED], br);
1168         VP8LFillBitWindow(br);
1169         blue = ReadSymbol(htree_group->htrees[BLUE], br);
1170         alpha = ReadSymbol(htree_group->htrees[ALPHA], br);
1171         if (VP8LIsEndOfStream(br)) break;
1172         *src = ((uint32_t)alpha << 24) | (red << 16) | (code << 8) | blue;
1173       }
1174     AdvanceByOne:
1175       ++src;
1176       ++col;
1177       if (col >= width) {
1178         col = 0;
1179         ++row;
1180         if (process_func != NULL) {
1181           if (row <= last_row && (row % NUM_ARGB_CACHE_ROWS == 0)) {
1182             process_func(dec, row);
1183           }
1184         }
1185         if (color_cache != NULL) {
1186           while (last_cached < src) {
1187             VP8LColorCacheInsert(color_cache, *last_cached++);
1188           }
1189         }
1190       }
1191     } else if (code < len_code_limit) {  // Backward reference
1192       int dist_code, dist;
1193       const int length_sym = code - NUM_LITERAL_CODES;
1194       const int length = GetCopyLength(length_sym, br);
1195       const int dist_symbol = ReadSymbol(htree_group->htrees[DIST], br);
1196       VP8LFillBitWindow(br);
1197       dist_code = GetCopyDistance(dist_symbol, br);
1198       dist = PlaneCodeToDistance(width, dist_code);
1199 
1200       if (VP8LIsEndOfStream(br)) break;
1201       if (src - data < (ptrdiff_t)dist || src_end - src < (ptrdiff_t)length) {
1202         goto Error;
1203       } else {
1204         CopyBlock32b(src, dist, length);
1205       }
1206       src += length;
1207       col += length;
1208       while (col >= width) {
1209         col -= width;
1210         ++row;
1211         if (process_func != NULL) {
1212           if (row <= last_row && (row % NUM_ARGB_CACHE_ROWS == 0)) {
1213             process_func(dec, row);
1214           }
1215         }
1216       }
1217       // Because of the check done above (before 'src' was incremented by
1218       // 'length'), the following holds true.
1219       assert(src <= src_end);
1220       if (col & mask) htree_group = GetHtreeGroupForPos(hdr, col, row);
1221       if (color_cache != NULL) {
1222         while (last_cached < src) {
1223           VP8LColorCacheInsert(color_cache, *last_cached++);
1224         }
1225       }
1226     } else if (code < color_cache_limit) {  // Color cache
1227       const int key = code - len_code_limit;
1228       assert(color_cache != NULL);
1229       while (last_cached < src) {
1230         VP8LColorCacheInsert(color_cache, *last_cached++);
1231       }
1232       *src = VP8LColorCacheLookup(color_cache, key);
1233       goto AdvanceByOne;
1234     } else {  // Not reached
1235       goto Error;
1236     }
1237   }
1238 
1239   br->eos_ = VP8LIsEndOfStream(br);
1240   if (dec->incremental_ && br->eos_ && src < src_end) {
1241     RestoreState(dec);
1242   } else if (!br->eos_) {
1243     // Process the remaining rows corresponding to last row-block.
1244     if (process_func != NULL) {
1245       process_func(dec, row > last_row ? last_row : row);
1246     }
1247     dec->status_ = VP8_STATUS_OK;
1248     dec->last_pixel_ = (int)(src - data);  // end-of-scan marker
1249   } else {
1250     // if not incremental, and we are past the end of buffer (eos_=1), then this
1251     // is a real bitstream error.
1252     goto Error;
1253   }
1254   return 1;
1255 
1256  Error:
1257   dec->status_ = VP8_STATUS_BITSTREAM_ERROR;
1258   return 0;
1259 }
1260 
1261 // -----------------------------------------------------------------------------
1262 // VP8LTransform
1263 
ClearTransform(VP8LTransform * const transform)1264 static void ClearTransform(VP8LTransform* const transform) {
1265   WebPSafeFree(transform->data_);
1266   transform->data_ = NULL;
1267 }
1268 
1269 // For security reason, we need to remap the color map to span
1270 // the total possible bundled values, and not just the num_colors.
ExpandColorMap(int num_colors,VP8LTransform * const transform)1271 static int ExpandColorMap(int num_colors, VP8LTransform* const transform) {
1272   int i;
1273   const int final_num_colors = 1 << (8 >> transform->bits_);
1274   uint32_t* const new_color_map =
1275       (uint32_t*)WebPSafeMalloc((uint64_t)final_num_colors,
1276                                 sizeof(*new_color_map));
1277   if (new_color_map == NULL) {
1278     return 0;
1279   } else {
1280     uint8_t* const data = (uint8_t*)transform->data_;
1281     uint8_t* const new_data = (uint8_t*)new_color_map;
1282     new_color_map[0] = transform->data_[0];
1283     for (i = 4; i < 4 * num_colors; ++i) {
1284       // Equivalent to AddPixelEq(), on a byte-basis.
1285       new_data[i] = (data[i] + new_data[i - 4]) & 0xff;
1286     }
1287     for (; i < 4 * final_num_colors; ++i) {
1288       new_data[i] = 0;  // black tail.
1289     }
1290     WebPSafeFree(transform->data_);
1291     transform->data_ = new_color_map;
1292   }
1293   return 1;
1294 }
1295 
ReadTransform(int * const xsize,int const * ysize,VP8LDecoder * const dec)1296 static int ReadTransform(int* const xsize, int const* ysize,
1297                          VP8LDecoder* const dec) {
1298   int ok = 1;
1299   VP8LBitReader* const br = &dec->br_;
1300   VP8LTransform* transform = &dec->transforms_[dec->next_transform_];
1301   const VP8LImageTransformType type =
1302       (VP8LImageTransformType)VP8LReadBits(br, 2);
1303 
1304   // Each transform type can only be present once in the stream.
1305   if (dec->transforms_seen_ & (1U << type)) {
1306     return 0;  // Already there, let's not accept the second same transform.
1307   }
1308   dec->transforms_seen_ |= (1U << type);
1309 
1310   transform->type_ = type;
1311   transform->xsize_ = *xsize;
1312   transform->ysize_ = *ysize;
1313   transform->data_ = NULL;
1314   ++dec->next_transform_;
1315   assert(dec->next_transform_ <= NUM_TRANSFORMS);
1316 
1317   switch (type) {
1318     case PREDICTOR_TRANSFORM:
1319     case CROSS_COLOR_TRANSFORM:
1320       transform->bits_ = VP8LReadBits(br, 3) + 2;
1321       ok = DecodeImageStream(VP8LSubSampleSize(transform->xsize_,
1322                                                transform->bits_),
1323                              VP8LSubSampleSize(transform->ysize_,
1324                                                transform->bits_),
1325                              0, dec, &transform->data_);
1326       break;
1327     case COLOR_INDEXING_TRANSFORM: {
1328        const int num_colors = VP8LReadBits(br, 8) + 1;
1329        const int bits = (num_colors > 16) ? 0
1330                       : (num_colors > 4) ? 1
1331                       : (num_colors > 2) ? 2
1332                       : 3;
1333        *xsize = VP8LSubSampleSize(transform->xsize_, bits);
1334        transform->bits_ = bits;
1335        ok = DecodeImageStream(num_colors, 1, 0, dec, &transform->data_);
1336        ok = ok && ExpandColorMap(num_colors, transform);
1337       break;
1338     }
1339     case SUBTRACT_GREEN:
1340       break;
1341     default:
1342       assert(0);    // can't happen
1343       break;
1344   }
1345 
1346   return ok;
1347 }
1348 
1349 // -----------------------------------------------------------------------------
1350 // VP8LMetadata
1351 
InitMetadata(VP8LMetadata * const hdr)1352 static void InitMetadata(VP8LMetadata* const hdr) {
1353   assert(hdr != NULL);
1354   memset(hdr, 0, sizeof(*hdr));
1355 }
1356 
ClearMetadata(VP8LMetadata * const hdr)1357 static void ClearMetadata(VP8LMetadata* const hdr) {
1358   assert(hdr != NULL);
1359 
1360   WebPSafeFree(hdr->huffman_image_);
1361   WebPSafeFree(hdr->huffman_tables_);
1362   VP8LHtreeGroupsFree(hdr->htree_groups_);
1363   VP8LColorCacheClear(&hdr->color_cache_);
1364   VP8LColorCacheClear(&hdr->saved_color_cache_);
1365   InitMetadata(hdr);
1366 }
1367 
1368 // -----------------------------------------------------------------------------
1369 // VP8LDecoder
1370 
VP8LNew(void)1371 VP8LDecoder* VP8LNew(void) {
1372   VP8LDecoder* const dec = (VP8LDecoder*)WebPSafeCalloc(1ULL, sizeof(*dec));
1373   if (dec == NULL) return NULL;
1374   dec->status_ = VP8_STATUS_OK;
1375   dec->state_ = READ_DIM;
1376 
1377   VP8LDspInit();  // Init critical function pointers.
1378 
1379   return dec;
1380 }
1381 
VP8LClear(VP8LDecoder * const dec)1382 void VP8LClear(VP8LDecoder* const dec) {
1383   int i;
1384   if (dec == NULL) return;
1385   ClearMetadata(&dec->hdr_);
1386 
1387   WebPSafeFree(dec->pixels_);
1388   dec->pixels_ = NULL;
1389   for (i = 0; i < dec->next_transform_; ++i) {
1390     ClearTransform(&dec->transforms_[i]);
1391   }
1392   dec->next_transform_ = 0;
1393   dec->transforms_seen_ = 0;
1394 
1395   WebPSafeFree(dec->rescaler_memory);
1396   dec->rescaler_memory = NULL;
1397 
1398   dec->output_ = NULL;   // leave no trace behind
1399 }
1400 
VP8LDelete(VP8LDecoder * const dec)1401 void VP8LDelete(VP8LDecoder* const dec) {
1402   if (dec != NULL) {
1403     VP8LClear(dec);
1404     WebPSafeFree(dec);
1405   }
1406 }
1407 
UpdateDecoder(VP8LDecoder * const dec,int width,int height)1408 static void UpdateDecoder(VP8LDecoder* const dec, int width, int height) {
1409   VP8LMetadata* const hdr = &dec->hdr_;
1410   const int num_bits = hdr->huffman_subsample_bits_;
1411   dec->width_ = width;
1412   dec->height_ = height;
1413 
1414   hdr->huffman_xsize_ = VP8LSubSampleSize(width, num_bits);
1415   hdr->huffman_mask_ = (num_bits == 0) ? ~0 : (1 << num_bits) - 1;
1416 }
1417 
DecodeImageStream(int xsize,int ysize,int is_level0,VP8LDecoder * const dec,uint32_t ** const decoded_data)1418 static int DecodeImageStream(int xsize, int ysize,
1419                              int is_level0,
1420                              VP8LDecoder* const dec,
1421                              uint32_t** const decoded_data) {
1422   int ok = 1;
1423   int transform_xsize = xsize;
1424   int transform_ysize = ysize;
1425   VP8LBitReader* const br = &dec->br_;
1426   VP8LMetadata* const hdr = &dec->hdr_;
1427   uint32_t* data = NULL;
1428   int color_cache_bits = 0;
1429 
1430   // Read the transforms (may recurse).
1431   if (is_level0) {
1432     while (ok && VP8LReadBits(br, 1)) {
1433       ok = ReadTransform(&transform_xsize, &transform_ysize, dec);
1434     }
1435   }
1436 
1437   // Color cache
1438   if (ok && VP8LReadBits(br, 1)) {
1439     color_cache_bits = VP8LReadBits(br, 4);
1440     ok = (color_cache_bits >= 1 && color_cache_bits <= MAX_CACHE_BITS);
1441     if (!ok) {
1442       dec->status_ = VP8_STATUS_BITSTREAM_ERROR;
1443       goto End;
1444     }
1445   }
1446 
1447   // Read the Huffman codes (may recurse).
1448   ok = ok && ReadHuffmanCodes(dec, transform_xsize, transform_ysize,
1449                               color_cache_bits, is_level0);
1450   if (!ok) {
1451     dec->status_ = VP8_STATUS_BITSTREAM_ERROR;
1452     goto End;
1453   }
1454 
1455   // Finish setting up the color-cache
1456   if (color_cache_bits > 0) {
1457     hdr->color_cache_size_ = 1 << color_cache_bits;
1458     if (!VP8LColorCacheInit(&hdr->color_cache_, color_cache_bits)) {
1459       dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
1460       ok = 0;
1461       goto End;
1462     }
1463   } else {
1464     hdr->color_cache_size_ = 0;
1465   }
1466   UpdateDecoder(dec, transform_xsize, transform_ysize);
1467 
1468   if (is_level0) {   // level 0 complete
1469     dec->state_ = READ_HDR;
1470     goto End;
1471   }
1472 
1473   {
1474     const uint64_t total_size = (uint64_t)transform_xsize * transform_ysize;
1475     data = (uint32_t*)WebPSafeMalloc(total_size, sizeof(*data));
1476     if (data == NULL) {
1477       dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
1478       ok = 0;
1479       goto End;
1480     }
1481   }
1482 
1483   // Use the Huffman trees to decode the LZ77 encoded data.
1484   ok = DecodeImageData(dec, data, transform_xsize, transform_ysize,
1485                        transform_ysize, NULL);
1486   ok = ok && !br->eos_;
1487 
1488  End:
1489   if (!ok) {
1490     WebPSafeFree(data);
1491     ClearMetadata(hdr);
1492   } else {
1493     if (decoded_data != NULL) {
1494       *decoded_data = data;
1495     } else {
1496       // We allocate image data in this function only for transforms. At level 0
1497       // (that is: not the transforms), we shouldn't have allocated anything.
1498       assert(data == NULL);
1499       assert(is_level0);
1500     }
1501     dec->last_pixel_ = 0;  // Reset for future DECODE_DATA_FUNC() calls.
1502     if (!is_level0) ClearMetadata(hdr);  // Clean up temporary data behind.
1503   }
1504   return ok;
1505 }
1506 
1507 //------------------------------------------------------------------------------
1508 // Allocate internal buffers dec->pixels_ and dec->argb_cache_.
AllocateInternalBuffers32b(VP8LDecoder * const dec,int final_width)1509 static int AllocateInternalBuffers32b(VP8LDecoder* const dec, int final_width) {
1510   const uint64_t num_pixels = (uint64_t)dec->width_ * dec->height_;
1511   // Scratch buffer corresponding to top-prediction row for transforming the
1512   // first row in the row-blocks. Not needed for paletted alpha.
1513   const uint64_t cache_top_pixels = (uint16_t)final_width;
1514   // Scratch buffer for temporary BGRA storage. Not needed for paletted alpha.
1515   const uint64_t cache_pixels = (uint64_t)final_width * NUM_ARGB_CACHE_ROWS;
1516   const uint64_t total_num_pixels =
1517       num_pixels + cache_top_pixels + cache_pixels;
1518 
1519   assert(dec->width_ <= final_width);
1520   dec->pixels_ = (uint32_t*)WebPSafeMalloc(total_num_pixels, sizeof(uint32_t));
1521   if (dec->pixels_ == NULL) {
1522     dec->argb_cache_ = NULL;    // for soundness
1523     dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
1524     return 0;
1525   }
1526   dec->argb_cache_ = dec->pixels_ + num_pixels + cache_top_pixels;
1527   return 1;
1528 }
1529 
AllocateInternalBuffers8b(VP8LDecoder * const dec)1530 static int AllocateInternalBuffers8b(VP8LDecoder* const dec) {
1531   const uint64_t total_num_pixels = (uint64_t)dec->width_ * dec->height_;
1532   dec->argb_cache_ = NULL;    // for soundness
1533   dec->pixels_ = (uint32_t*)WebPSafeMalloc(total_num_pixels, sizeof(uint8_t));
1534   if (dec->pixels_ == NULL) {
1535     dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
1536     return 0;
1537   }
1538   return 1;
1539 }
1540 
1541 //------------------------------------------------------------------------------
1542 
1543 // Special row-processing that only stores the alpha data.
ExtractAlphaRows(VP8LDecoder * const dec,int last_row)1544 static void ExtractAlphaRows(VP8LDecoder* const dec, int last_row) {
1545   int cur_row = dec->last_row_;
1546   int num_rows = last_row - cur_row;
1547   const uint32_t* in = dec->pixels_ + dec->width_ * cur_row;
1548 
1549   assert(last_row <= dec->io_->crop_bottom);
1550   while (num_rows > 0) {
1551     const int num_rows_to_process =
1552         (num_rows > NUM_ARGB_CACHE_ROWS) ? NUM_ARGB_CACHE_ROWS : num_rows;
1553     // Extract alpha (which is stored in the green plane).
1554     ALPHDecoder* const alph_dec = (ALPHDecoder*)dec->io_->opaque;
1555     uint8_t* const output = alph_dec->output_;
1556     const int width = dec->io_->width;      // the final width (!= dec->width_)
1557     const int cache_pixs = width * num_rows_to_process;
1558     uint8_t* const dst = output + width * cur_row;
1559     const uint32_t* const src = dec->argb_cache_;
1560     ApplyInverseTransforms(dec, cur_row, num_rows_to_process, in);
1561     WebPExtractGreen(src, dst, cache_pixs);
1562     AlphaApplyFilter(alph_dec,
1563                      cur_row, cur_row + num_rows_to_process, dst, width);
1564     num_rows -= num_rows_to_process;
1565     in += num_rows_to_process * dec->width_;
1566     cur_row += num_rows_to_process;
1567   }
1568   assert(cur_row == last_row);
1569   dec->last_row_ = dec->last_out_row_ = last_row;
1570 }
1571 
VP8LDecodeAlphaHeader(ALPHDecoder * const alph_dec,const uint8_t * const data,size_t data_size)1572 int VP8LDecodeAlphaHeader(ALPHDecoder* const alph_dec,
1573                           const uint8_t* const data, size_t data_size) {
1574   int ok = 0;
1575   VP8LDecoder* dec = VP8LNew();
1576 
1577   if (dec == NULL) return 0;
1578 
1579   assert(alph_dec != NULL);
1580 
1581   dec->width_ = alph_dec->width_;
1582   dec->height_ = alph_dec->height_;
1583   dec->io_ = &alph_dec->io_;
1584   dec->io_->opaque = alph_dec;
1585   dec->io_->width = alph_dec->width_;
1586   dec->io_->height = alph_dec->height_;
1587 
1588   dec->status_ = VP8_STATUS_OK;
1589   VP8LInitBitReader(&dec->br_, data, data_size);
1590 
1591   if (!DecodeImageStream(alph_dec->width_, alph_dec->height_, 1, dec, NULL)) {
1592     goto Err;
1593   }
1594 
1595   // Special case: if alpha data uses only the color indexing transform and
1596   // doesn't use color cache (a frequent case), we will use DecodeAlphaData()
1597   // method that only needs allocation of 1 byte per pixel (alpha channel).
1598   if (dec->next_transform_ == 1 &&
1599       dec->transforms_[0].type_ == COLOR_INDEXING_TRANSFORM &&
1600       Is8bOptimizable(&dec->hdr_)) {
1601     alph_dec->use_8b_decode_ = 1;
1602     ok = AllocateInternalBuffers8b(dec);
1603   } else {
1604     // Allocate internal buffers (note that dec->width_ may have changed here).
1605     alph_dec->use_8b_decode_ = 0;
1606     ok = AllocateInternalBuffers32b(dec, alph_dec->width_);
1607   }
1608 
1609   if (!ok) goto Err;
1610 
1611   // Only set here, once we are sure it is valid (to avoid thread races).
1612   alph_dec->vp8l_dec_ = dec;
1613   return 1;
1614 
1615  Err:
1616   VP8LDelete(dec);
1617   return 0;
1618 }
1619 
VP8LDecodeAlphaImageStream(ALPHDecoder * const alph_dec,int last_row)1620 int VP8LDecodeAlphaImageStream(ALPHDecoder* const alph_dec, int last_row) {
1621   VP8LDecoder* const dec = alph_dec->vp8l_dec_;
1622   assert(dec != NULL);
1623   assert(last_row <= dec->height_);
1624 
1625   if (dec->last_row_ >= last_row) {
1626     return 1;  // done
1627   }
1628 
1629   if (!alph_dec->use_8b_decode_) WebPInitAlphaProcessing();
1630 
1631   // Decode (with special row processing).
1632   return alph_dec->use_8b_decode_ ?
1633       DecodeAlphaData(dec, (uint8_t*)dec->pixels_, dec->width_, dec->height_,
1634                       last_row) :
1635       DecodeImageData(dec, dec->pixels_, dec->width_, dec->height_,
1636                       last_row, ExtractAlphaRows);
1637 }
1638 
1639 //------------------------------------------------------------------------------
1640 
VP8LDecodeHeader(VP8LDecoder * const dec,VP8Io * const io)1641 int VP8LDecodeHeader(VP8LDecoder* const dec, VP8Io* const io) {
1642   int width, height, has_alpha;
1643 
1644   if (dec == NULL) return 0;
1645   if (io == NULL) {
1646     dec->status_ = VP8_STATUS_INVALID_PARAM;
1647     return 0;
1648   }
1649 
1650   dec->io_ = io;
1651   dec->status_ = VP8_STATUS_OK;
1652   VP8LInitBitReader(&dec->br_, io->data, io->data_size);
1653   if (!ReadImageInfo(&dec->br_, &width, &height, &has_alpha)) {
1654     dec->status_ = VP8_STATUS_BITSTREAM_ERROR;
1655     goto Error;
1656   }
1657   dec->state_ = READ_DIM;
1658   io->width = width;
1659   io->height = height;
1660 
1661   if (!DecodeImageStream(width, height, 1, dec, NULL)) goto Error;
1662   return 1;
1663 
1664  Error:
1665   VP8LClear(dec);
1666   assert(dec->status_ != VP8_STATUS_OK);
1667   return 0;
1668 }
1669 
VP8LDecodeImage(VP8LDecoder * const dec)1670 int VP8LDecodeImage(VP8LDecoder* const dec) {
1671   VP8Io* io = NULL;
1672   WebPDecParams* params = NULL;
1673 
1674   if (dec == NULL) return 0;
1675 
1676   assert(dec->hdr_.huffman_tables_ != NULL);
1677   assert(dec->hdr_.htree_groups_ != NULL);
1678   assert(dec->hdr_.num_htree_groups_ > 0);
1679 
1680   io = dec->io_;
1681   assert(io != NULL);
1682   params = (WebPDecParams*)io->opaque;
1683   assert(params != NULL);
1684 
1685   // Initialization.
1686   if (dec->state_ != READ_DATA) {
1687     dec->output_ = params->output;
1688     assert(dec->output_ != NULL);
1689 
1690     if (!WebPIoInitFromOptions(params->options, io, MODE_BGRA)) {
1691       dec->status_ = VP8_STATUS_INVALID_PARAM;
1692       goto Err;
1693     }
1694 
1695     if (!AllocateInternalBuffers32b(dec, io->width)) goto Err;
1696 
1697 #if !defined(WEBP_REDUCE_SIZE)
1698     if (io->use_scaling && !AllocateAndInitRescaler(dec, io)) goto Err;
1699 #else
1700     if (io->use_scaling) {
1701       dec->status_ = VP8_STATUS_INVALID_PARAM;
1702       goto Err;
1703     }
1704 #endif
1705     if (io->use_scaling || WebPIsPremultipliedMode(dec->output_->colorspace)) {
1706       // need the alpha-multiply functions for premultiplied output or rescaling
1707       WebPInitAlphaProcessing();
1708     }
1709 
1710     if (!WebPIsRGBMode(dec->output_->colorspace)) {
1711       WebPInitConvertARGBToYUV();
1712       if (dec->output_->u.YUVA.a != NULL) WebPInitAlphaProcessing();
1713     }
1714     if (dec->incremental_) {
1715       if (dec->hdr_.color_cache_size_ > 0 &&
1716           dec->hdr_.saved_color_cache_.colors_ == NULL) {
1717         if (!VP8LColorCacheInit(&dec->hdr_.saved_color_cache_,
1718                                 dec->hdr_.color_cache_.hash_bits_)) {
1719           dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
1720           goto Err;
1721         }
1722       }
1723     }
1724     dec->state_ = READ_DATA;
1725   }
1726 
1727   // Decode.
1728   if (!DecodeImageData(dec, dec->pixels_, dec->width_, dec->height_,
1729                        io->crop_bottom, ProcessRows)) {
1730     goto Err;
1731   }
1732 
1733   params->last_y = dec->last_out_row_;
1734   return 1;
1735 
1736  Err:
1737   VP8LClear(dec);
1738   assert(dec->status_ != VP8_STATUS_OK);
1739   return 0;
1740 }
1741 
1742 //------------------------------------------------------------------------------
1743