1 /*
2 * jdmarker.c
3 *
4 * Copyright (C) 1991-1998, Thomas G. Lane.
5 * Modified 2009-2019 by Guido Vollbeding.
6 * This file is part of the Independent JPEG Group's software.
7 * For conditions of distribution and use, see the accompanying README file.
8 *
9 * This file contains routines to decode JPEG datastream markers.
10 * Most of the complexity arises from our desire to support input
11 * suspension: if not all of the data for a marker is available,
12 * we must exit back to the application. On resumption, we reprocess
13 * the marker.
14 */
15
16 #define JPEG_INTERNALS
17 #include "jinclude.h"
18 #include "jpeglib.h"
19
20
21 typedef enum { /* JPEG marker codes */
22 M_SOF0 = 0xc0,
23 M_SOF1 = 0xc1,
24 M_SOF2 = 0xc2,
25 M_SOF3 = 0xc3,
26
27 M_SOF5 = 0xc5,
28 M_SOF6 = 0xc6,
29 M_SOF7 = 0xc7,
30
31 M_JPG = 0xc8,
32 M_SOF9 = 0xc9,
33 M_SOF10 = 0xca,
34 M_SOF11 = 0xcb,
35
36 M_SOF13 = 0xcd,
37 M_SOF14 = 0xce,
38 M_SOF15 = 0xcf,
39
40 M_DHT = 0xc4,
41
42 M_DAC = 0xcc,
43
44 M_RST0 = 0xd0,
45 M_RST1 = 0xd1,
46 M_RST2 = 0xd2,
47 M_RST3 = 0xd3,
48 M_RST4 = 0xd4,
49 M_RST5 = 0xd5,
50 M_RST6 = 0xd6,
51 M_RST7 = 0xd7,
52
53 M_SOI = 0xd8,
54 M_EOI = 0xd9,
55 M_SOS = 0xda,
56 M_DQT = 0xdb,
57 M_DNL = 0xdc,
58 M_DRI = 0xdd,
59 M_DHP = 0xde,
60 M_EXP = 0xdf,
61
62 M_APP0 = 0xe0,
63 M_APP1 = 0xe1,
64 M_APP2 = 0xe2,
65 M_APP3 = 0xe3,
66 M_APP4 = 0xe4,
67 M_APP5 = 0xe5,
68 M_APP6 = 0xe6,
69 M_APP7 = 0xe7,
70 M_APP8 = 0xe8,
71 M_APP9 = 0xe9,
72 M_APP10 = 0xea,
73 M_APP11 = 0xeb,
74 M_APP12 = 0xec,
75 M_APP13 = 0xed,
76 M_APP14 = 0xee,
77 M_APP15 = 0xef,
78
79 M_JPG0 = 0xf0,
80 M_JPG8 = 0xf8,
81 M_JPG13 = 0xfd,
82 M_COM = 0xfe,
83
84 M_TEM = 0x01,
85
86 M_ERROR = 0x100
87 } JPEG_MARKER;
88
89
90 /* Private state */
91
92 typedef struct {
93 struct jpeg_marker_reader pub; /* public fields */
94
95 /* Application-overridable marker processing methods */
96 jpeg_marker_parser_method process_COM;
97 jpeg_marker_parser_method process_APPn[16];
98
99 /* Limit on marker data length to save for each marker type */
100 unsigned int length_limit_COM;
101 unsigned int length_limit_APPn[16];
102
103 /* Status of COM/APPn marker saving */
104 jpeg_saved_marker_ptr cur_marker; /* NULL if not processing a marker */
105 unsigned int bytes_read; /* data bytes read so far in marker */
106 /* Note: cur_marker is not linked into marker_list until it's all read. */
107 } my_marker_reader;
108
109 typedef my_marker_reader * my_marker_ptr;
110
111
112 /*
113 * Macros for fetching data from the data source module.
114 *
115 * At all times, cinfo->src->next_input_byte and ->bytes_in_buffer reflect
116 * the current restart point; we update them only when we have reached a
117 * suitable place to restart if a suspension occurs.
118 */
119
120 /* Declare and initialize local copies of input pointer/count */
121 #define INPUT_VARS(cinfo) \
122 struct jpeg_source_mgr * datasrc = (cinfo)->src; \
123 const JOCTET * next_input_byte = datasrc->next_input_byte; \
124 size_t bytes_in_buffer = datasrc->bytes_in_buffer
125
126 /* Unload the local copies --- do this only at a restart boundary */
127 #define INPUT_SYNC(cinfo) \
128 ( datasrc->next_input_byte = next_input_byte, \
129 datasrc->bytes_in_buffer = bytes_in_buffer )
130
131 /* Reload the local copies --- used only in MAKE_BYTE_AVAIL */
132 #define INPUT_RELOAD(cinfo) \
133 ( next_input_byte = datasrc->next_input_byte, \
134 bytes_in_buffer = datasrc->bytes_in_buffer )
135
136 /* Internal macro for INPUT_BYTE and INPUT_2BYTES: make a byte available.
137 * Note we do *not* do INPUT_SYNC before calling fill_input_buffer,
138 * but we must reload the local copies after a successful fill.
139 */
140 #define MAKE_BYTE_AVAIL(cinfo,action) \
141 if (bytes_in_buffer == 0) { \
142 if (! (*datasrc->fill_input_buffer) (cinfo)) \
143 { action; } \
144 INPUT_RELOAD(cinfo); \
145 }
146
147 /* Read a byte into variable V.
148 * If must suspend, take the specified action (typically "return FALSE").
149 */
150 #define INPUT_BYTE(cinfo,V,action) \
151 MAKESTMT( MAKE_BYTE_AVAIL(cinfo,action); \
152 bytes_in_buffer--; \
153 V = GETJOCTET(*next_input_byte++); )
154
155 /* As above, but read two bytes interpreted as an unsigned 16-bit integer.
156 * V should be declared unsigned int or perhaps INT32.
157 */
158 #define INPUT_2BYTES(cinfo,V,action) \
159 MAKESTMT( MAKE_BYTE_AVAIL(cinfo,action); \
160 bytes_in_buffer--; \
161 V = ((unsigned int) GETJOCTET(*next_input_byte++)) << 8; \
162 MAKE_BYTE_AVAIL(cinfo,action); \
163 bytes_in_buffer--; \
164 V += GETJOCTET(*next_input_byte++); )
165
166
167 /*
168 * Routines to process JPEG markers.
169 *
170 * Entry condition: JPEG marker itself has been read and its code saved
171 * in cinfo->unread_marker; input restart point is just after the marker.
172 *
173 * Exit: if return TRUE, have read and processed any parameters, and have
174 * updated the restart point to point after the parameters.
175 * If return FALSE, was forced to suspend before reaching end of
176 * marker parameters; restart point has not been moved. Same routine
177 * will be called again after application supplies more input data.
178 *
179 * This approach to suspension assumes that all of a marker's parameters
180 * can fit into a single input bufferload. This should hold for "normal"
181 * markers. Some COM/APPn markers might have large parameter segments
182 * that might not fit. If we are simply dropping such a marker, we use
183 * skip_input_data to get past it, and thereby put the problem on the
184 * source manager's shoulders. If we are saving the marker's contents
185 * into memory, we use a slightly different convention: when forced to
186 * suspend, the marker processor updates the restart point to the end of
187 * what it's consumed (ie, the end of the buffer) before returning FALSE.
188 * On resumption, cinfo->unread_marker still contains the marker code,
189 * but the data source will point to the next chunk of marker data.
190 * The marker processor must retain internal state to deal with this.
191 *
192 * Note that we don't bother to avoid duplicate trace messages if a
193 * suspension occurs within marker parameters. Other side effects
194 * require more care.
195 */
196
197
198 LOCAL(boolean)
get_soi(j_decompress_ptr cinfo)199 get_soi (j_decompress_ptr cinfo)
200 /* Process an SOI marker */
201 {
202 int i;
203
204 TRACEMS(cinfo, 1, JTRC_SOI);
205
206 if (cinfo->marker->saw_SOI)
207 ERREXIT(cinfo, JERR_SOI_DUPLICATE);
208
209 /* Reset all parameters that are defined to be reset by SOI */
210
211 for (i = 0; i < NUM_ARITH_TBLS; i++) {
212 cinfo->arith_dc_L[i] = 0;
213 cinfo->arith_dc_U[i] = 1;
214 cinfo->arith_ac_K[i] = 5;
215 }
216 cinfo->restart_interval = 0;
217
218 /* Set initial assumptions for colorspace etc */
219
220 cinfo->jpeg_color_space = JCS_UNKNOWN;
221 cinfo->color_transform = JCT_NONE;
222 cinfo->CCIR601_sampling = FALSE; /* Assume non-CCIR sampling??? */
223
224 cinfo->saw_JFIF_marker = FALSE;
225 cinfo->JFIF_major_version = 1; /* set default JFIF APP0 values */
226 cinfo->JFIF_minor_version = 1;
227 cinfo->density_unit = 0;
228 cinfo->X_density = 1;
229 cinfo->Y_density = 1;
230 cinfo->saw_Adobe_marker = FALSE;
231 cinfo->Adobe_transform = 0;
232
233 cinfo->marker->saw_SOI = TRUE;
234
235 return TRUE;
236 }
237
238
239 LOCAL(boolean)
get_sof(j_decompress_ptr cinfo,boolean is_baseline,boolean is_prog,boolean is_arith)240 get_sof (j_decompress_ptr cinfo, boolean is_baseline, boolean is_prog,
241 boolean is_arith)
242 /* Process a SOFn marker */
243 {
244 INT32 length;
245 int c, ci, i;
246 jpeg_component_info * compptr;
247 INPUT_VARS(cinfo);
248
249 cinfo->is_baseline = is_baseline;
250 cinfo->progressive_mode = is_prog;
251 cinfo->arith_code = is_arith;
252
253 INPUT_2BYTES(cinfo, length, return FALSE);
254
255 INPUT_BYTE(cinfo, cinfo->data_precision, return FALSE);
256 INPUT_2BYTES(cinfo, cinfo->image_height, return FALSE);
257 INPUT_2BYTES(cinfo, cinfo->image_width, return FALSE);
258 INPUT_BYTE(cinfo, cinfo->num_components, return FALSE);
259
260 length -= 8;
261
262 TRACEMS4(cinfo, 1, JTRC_SOF, cinfo->unread_marker,
263 (int) cinfo->image_width, (int) cinfo->image_height,
264 cinfo->num_components);
265
266 if (cinfo->marker->saw_SOF)
267 ERREXIT(cinfo, JERR_SOF_DUPLICATE);
268
269 /* We don't support files in which the image height is initially specified */
270 /* as 0 and is later redefined by DNL. As long as we have to check that, */
271 /* might as well have a general sanity check. */
272 if (cinfo->image_height <= 0 || cinfo->image_width <= 0 ||
273 cinfo->num_components <= 0)
274 ERREXIT(cinfo, JERR_EMPTY_IMAGE);
275
276 if (length != (cinfo->num_components * 3))
277 ERREXIT(cinfo, JERR_BAD_LENGTH);
278
279 if (cinfo->comp_info == NULL) /* do only once, even if suspend */
280 cinfo->comp_info = (jpeg_component_info *) (*cinfo->mem->alloc_small)
281 ((j_common_ptr) cinfo, JPOOL_IMAGE,
282 cinfo->num_components * SIZEOF(jpeg_component_info));
283
284 for (ci = 0; ci < cinfo->num_components; ci++) {
285 INPUT_BYTE(cinfo, c, return FALSE);
286 /* Check to see whether component id has already been seen */
287 /* (in violation of the spec, but unfortunately seen in some */
288 /* files). If so, create "fake" component id equal to the */
289 /* max id seen so far + 1. */
290 for (i = 0, compptr = cinfo->comp_info; i < ci; i++, compptr++) {
291 if (c == compptr->component_id) {
292 compptr = cinfo->comp_info;
293 c = compptr->component_id;
294 compptr++;
295 for (i = 1; i < ci; i++, compptr++) {
296 if (compptr->component_id > c) c = compptr->component_id;
297 }
298 c++;
299 break;
300 }
301 }
302 compptr->component_id = c;
303 compptr->component_index = ci;
304 INPUT_BYTE(cinfo, c, return FALSE);
305 compptr->h_samp_factor = (c >> 4) & 15;
306 compptr->v_samp_factor = (c ) & 15;
307 INPUT_BYTE(cinfo, compptr->quant_tbl_no, return FALSE);
308
309 TRACEMS4(cinfo, 1, JTRC_SOF_COMPONENT,
310 compptr->component_id, compptr->h_samp_factor,
311 compptr->v_samp_factor, compptr->quant_tbl_no);
312 }
313
314 cinfo->marker->saw_SOF = TRUE;
315
316 INPUT_SYNC(cinfo);
317 return TRUE;
318 }
319
320
321 LOCAL(boolean)
get_sos(j_decompress_ptr cinfo)322 get_sos (j_decompress_ptr cinfo)
323 /* Process a SOS marker */
324 {
325 INT32 length;
326 int c, ci, i, n;
327 jpeg_component_info * compptr;
328 INPUT_VARS(cinfo);
329
330 if (! cinfo->marker->saw_SOF)
331 ERREXITS(cinfo, JERR_SOF_BEFORE, "SOS");
332
333 INPUT_2BYTES(cinfo, length, return FALSE);
334
335 INPUT_BYTE(cinfo, n, return FALSE); /* Number of components */
336
337 TRACEMS1(cinfo, 1, JTRC_SOS, n);
338
339 if (length != (n * 2 + 6) || n > MAX_COMPS_IN_SCAN ||
340 (n == 0 && !cinfo->progressive_mode))
341 /* pseudo SOS marker only allowed in progressive mode */
342 ERREXIT(cinfo, JERR_BAD_LENGTH);
343
344 cinfo->comps_in_scan = n;
345
346 /* Collect the component-spec parameters */
347
348 for (i = 0; i < n; i++) {
349 INPUT_BYTE(cinfo, c, return FALSE);
350
351 /* Detect the case where component id's are not unique, and, if so, */
352 /* create a fake component id using the same logic as in get_sof. */
353 /* Note: This also ensures that all of the SOF components are */
354 /* referenced in the single scan case, which prevents access to */
355 /* uninitialized memory in later decoding stages. */
356 for (ci = 0; ci < i; ci++) {
357 if (c == cinfo->cur_comp_info[ci]->component_id) {
358 c = cinfo->cur_comp_info[0]->component_id;
359 for (ci = 1; ci < i; ci++) {
360 compptr = cinfo->cur_comp_info[ci];
361 if (compptr->component_id > c) c = compptr->component_id;
362 }
363 c++;
364 break;
365 }
366 }
367
368 for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
369 ci++, compptr++) {
370 if (c == compptr->component_id)
371 goto id_found;
372 }
373
374 ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, c);
375
376 id_found:
377
378 cinfo->cur_comp_info[i] = compptr;
379 INPUT_BYTE(cinfo, c, return FALSE);
380 compptr->dc_tbl_no = (c >> 4) & 15;
381 compptr->ac_tbl_no = (c ) & 15;
382
383 TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, compptr->component_id,
384 compptr->dc_tbl_no, compptr->ac_tbl_no);
385 }
386
387 /* Collect the additional scan parameters Ss, Se, Ah/Al. */
388 INPUT_BYTE(cinfo, c, return FALSE);
389 cinfo->Ss = c;
390 INPUT_BYTE(cinfo, c, return FALSE);
391 cinfo->Se = c;
392 INPUT_BYTE(cinfo, c, return FALSE);
393 cinfo->Ah = (c >> 4) & 15;
394 cinfo->Al = (c ) & 15;
395
396 TRACEMS4(cinfo, 1, JTRC_SOS_PARAMS, cinfo->Ss, cinfo->Se,
397 cinfo->Ah, cinfo->Al);
398
399 /* Prepare to scan data & restart markers */
400 cinfo->marker->next_restart_num = 0;
401
402 /* Count another (non-pseudo) SOS marker */
403 if (n) cinfo->input_scan_number++;
404
405 INPUT_SYNC(cinfo);
406 return TRUE;
407 }
408
409
410 #ifdef D_ARITH_CODING_SUPPORTED
411
412 LOCAL(boolean)
get_dac(j_decompress_ptr cinfo)413 get_dac (j_decompress_ptr cinfo)
414 /* Process a DAC marker */
415 {
416 INT32 length;
417 int index, val;
418 INPUT_VARS(cinfo);
419
420 INPUT_2BYTES(cinfo, length, return FALSE);
421 length -= 2;
422
423 while (length > 0) {
424 INPUT_BYTE(cinfo, index, return FALSE);
425 INPUT_BYTE(cinfo, val, return FALSE);
426
427 length -= 2;
428
429 TRACEMS2(cinfo, 1, JTRC_DAC, index, val);
430
431 if (index < 0 || index >= (2*NUM_ARITH_TBLS))
432 ERREXIT1(cinfo, JERR_DAC_INDEX, index);
433
434 if (index >= NUM_ARITH_TBLS) { /* define AC table */
435 cinfo->arith_ac_K[index-NUM_ARITH_TBLS] = (UINT8) val;
436 } else { /* define DC table */
437 cinfo->arith_dc_L[index] = (UINT8) (val & 0x0F);
438 cinfo->arith_dc_U[index] = (UINT8) (val >> 4);
439 if (cinfo->arith_dc_L[index] > cinfo->arith_dc_U[index])
440 ERREXIT1(cinfo, JERR_DAC_VALUE, val);
441 }
442 }
443
444 if (length != 0)
445 ERREXIT(cinfo, JERR_BAD_LENGTH);
446
447 INPUT_SYNC(cinfo);
448 return TRUE;
449 }
450
451 #else /* ! D_ARITH_CODING_SUPPORTED */
452
453 #define get_dac(cinfo) skip_variable(cinfo)
454
455 #endif /* D_ARITH_CODING_SUPPORTED */
456
457
458 LOCAL(boolean)
get_dht(j_decompress_ptr cinfo)459 get_dht (j_decompress_ptr cinfo)
460 /* Process a DHT marker */
461 {
462 INT32 length;
463 UINT8 bits[17];
464 UINT8 huffval[256];
465 int i, index, count;
466 JHUFF_TBL **htblptr;
467 INPUT_VARS(cinfo);
468
469 INPUT_2BYTES(cinfo, length, return FALSE);
470 length -= 2;
471
472 while (length > 16) {
473 INPUT_BYTE(cinfo, index, return FALSE);
474
475 TRACEMS1(cinfo, 1, JTRC_DHT, index);
476
477 bits[0] = 0;
478 count = 0;
479 for (i = 1; i <= 16; i++) {
480 INPUT_BYTE(cinfo, bits[i], return FALSE);
481 count += bits[i];
482 }
483
484 length -= 1 + 16;
485
486 TRACEMS8(cinfo, 2, JTRC_HUFFBITS,
487 bits[1], bits[2], bits[3], bits[4],
488 bits[5], bits[6], bits[7], bits[8]);
489 TRACEMS8(cinfo, 2, JTRC_HUFFBITS,
490 bits[9], bits[10], bits[11], bits[12],
491 bits[13], bits[14], bits[15], bits[16]);
492
493 /* Here we just do minimal validation of the counts to avoid walking
494 * off the end of our table space. jdhuff.c will check more carefully.
495 */
496 if (count > 256 || ((INT32) count) > length)
497 ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
498
499 for (i = 0; i < count; i++)
500 INPUT_BYTE(cinfo, huffval[i], return FALSE);
501
502 length -= count;
503
504 if (index & 0x10) { /* AC table definition */
505 index -= 0x10;
506 htblptr = &cinfo->ac_huff_tbl_ptrs[index];
507 } else { /* DC table definition */
508 htblptr = &cinfo->dc_huff_tbl_ptrs[index];
509 }
510
511 if (index < 0 || index >= NUM_HUFF_TBLS)
512 ERREXIT1(cinfo, JERR_DHT_INDEX, index);
513
514 if (*htblptr == NULL)
515 *htblptr = jpeg_alloc_huff_table((j_common_ptr) cinfo);
516
517 MEMCOPY((*htblptr)->bits, bits, SIZEOF((*htblptr)->bits));
518 if (count > 0)
519 MEMCOPY((*htblptr)->huffval, huffval, count * SIZEOF(UINT8));
520 }
521
522 if (length != 0)
523 ERREXIT(cinfo, JERR_BAD_LENGTH);
524
525 INPUT_SYNC(cinfo);
526 return TRUE;
527 }
528
529
530 LOCAL(boolean)
get_dqt(j_decompress_ptr cinfo)531 get_dqt (j_decompress_ptr cinfo)
532 /* Process a DQT marker */
533 {
534 INT32 length, count, i;
535 int n, prec;
536 unsigned int tmp;
537 JQUANT_TBL *quant_ptr;
538 const int *natural_order;
539 INPUT_VARS(cinfo);
540
541 INPUT_2BYTES(cinfo, length, return FALSE);
542 length -= 2;
543
544 while (length > 0) {
545 length--;
546 INPUT_BYTE(cinfo, n, return FALSE);
547 prec = n >> 4;
548 n &= 0x0F;
549
550 TRACEMS2(cinfo, 1, JTRC_DQT, n, prec);
551
552 if (n >= NUM_QUANT_TBLS)
553 ERREXIT1(cinfo, JERR_DQT_INDEX, n);
554
555 if (cinfo->quant_tbl_ptrs[n] == NULL)
556 cinfo->quant_tbl_ptrs[n] = jpeg_alloc_quant_table((j_common_ptr) cinfo);
557 quant_ptr = cinfo->quant_tbl_ptrs[n];
558
559 if (prec) {
560 if (length < DCTSIZE2 * 2) {
561 /* Initialize full table for safety. */
562 for (i = 0; i < DCTSIZE2; i++) {
563 quant_ptr->quantval[i] = 1;
564 }
565 count = length >> 1;
566 } else
567 count = DCTSIZE2;
568 } else {
569 if (length < DCTSIZE2) {
570 /* Initialize full table for safety. */
571 for (i = 0; i < DCTSIZE2; i++) {
572 quant_ptr->quantval[i] = 1;
573 }
574 count = length;
575 } else
576 count = DCTSIZE2;
577 }
578
579 switch ((int) count) {
580 case (2*2): natural_order = jpeg_natural_order2; break;
581 case (3*3): natural_order = jpeg_natural_order3; break;
582 case (4*4): natural_order = jpeg_natural_order4; break;
583 case (5*5): natural_order = jpeg_natural_order5; break;
584 case (6*6): natural_order = jpeg_natural_order6; break;
585 case (7*7): natural_order = jpeg_natural_order7; break;
586 default: natural_order = jpeg_natural_order;
587 }
588
589 for (i = 0; i < count; i++) {
590 if (prec)
591 INPUT_2BYTES(cinfo, tmp, return FALSE);
592 else
593 INPUT_BYTE(cinfo, tmp, return FALSE);
594 /* We convert the zigzag-order table to natural array order. */
595 quant_ptr->quantval[natural_order[i]] = (UINT16) tmp;
596 }
597
598 if (cinfo->err->trace_level >= 2) {
599 for (i = 0; i < DCTSIZE2; i += 8) {
600 TRACEMS8(cinfo, 2, JTRC_QUANTVALS,
601 quant_ptr->quantval[i], quant_ptr->quantval[i+1],
602 quant_ptr->quantval[i+2], quant_ptr->quantval[i+3],
603 quant_ptr->quantval[i+4], quant_ptr->quantval[i+5],
604 quant_ptr->quantval[i+6], quant_ptr->quantval[i+7]);
605 }
606 }
607
608 length -= count;
609 if (prec) length -= count;
610 }
611
612 if (length != 0)
613 ERREXIT(cinfo, JERR_BAD_LENGTH);
614
615 INPUT_SYNC(cinfo);
616 return TRUE;
617 }
618
619
620 LOCAL(boolean)
get_dri(j_decompress_ptr cinfo)621 get_dri (j_decompress_ptr cinfo)
622 /* Process a DRI marker */
623 {
624 INT32 length;
625 unsigned int tmp;
626 INPUT_VARS(cinfo);
627
628 INPUT_2BYTES(cinfo, length, return FALSE);
629
630 if (length != 4)
631 ERREXIT(cinfo, JERR_BAD_LENGTH);
632
633 INPUT_2BYTES(cinfo, tmp, return FALSE);
634
635 TRACEMS1(cinfo, 1, JTRC_DRI, tmp);
636
637 cinfo->restart_interval = tmp;
638
639 INPUT_SYNC(cinfo);
640 return TRUE;
641 }
642
643
644 LOCAL(boolean)
get_lse(j_decompress_ptr cinfo)645 get_lse (j_decompress_ptr cinfo)
646 /* Process an LSE marker */
647 {
648 INT32 length;
649 unsigned int tmp;
650 int cid;
651 INPUT_VARS(cinfo);
652
653 if (! cinfo->marker->saw_SOF)
654 ERREXITS(cinfo, JERR_SOF_BEFORE, "LSE");
655
656 if (cinfo->num_components < 3) goto bad;
657
658 INPUT_2BYTES(cinfo, length, return FALSE);
659
660 if (length != 24)
661 ERREXIT(cinfo, JERR_BAD_LENGTH);
662
663 INPUT_BYTE(cinfo, tmp, return FALSE);
664 if (tmp != 0x0D) /* ID inverse transform specification */
665 ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
666 INPUT_2BYTES(cinfo, tmp, return FALSE);
667 if (tmp != MAXJSAMPLE) goto bad; /* MAXTRANS */
668 INPUT_BYTE(cinfo, tmp, return FALSE);
669 if (tmp != 3) goto bad; /* Nt=3 */
670 INPUT_BYTE(cinfo, cid, return FALSE);
671 if (cid != cinfo->comp_info[1].component_id) goto bad;
672 INPUT_BYTE(cinfo, cid, return FALSE);
673 if (cid != cinfo->comp_info[0].component_id) goto bad;
674 INPUT_BYTE(cinfo, cid, return FALSE);
675 if (cid != cinfo->comp_info[2].component_id) goto bad;
676 INPUT_BYTE(cinfo, tmp, return FALSE);
677 if (tmp != 0x80) goto bad; /* F1: CENTER1=1, NORM1=0 */
678 INPUT_2BYTES(cinfo, tmp, return FALSE);
679 if (tmp != 0) goto bad; /* A(1,1)=0 */
680 INPUT_2BYTES(cinfo, tmp, return FALSE);
681 if (tmp != 0) goto bad; /* A(1,2)=0 */
682 INPUT_BYTE(cinfo, tmp, return FALSE);
683 if (tmp != 0) goto bad; /* F2: CENTER2=0, NORM2=0 */
684 INPUT_2BYTES(cinfo, tmp, return FALSE);
685 if (tmp != 1) goto bad; /* A(2,1)=1 */
686 INPUT_2BYTES(cinfo, tmp, return FALSE);
687 if (tmp != 0) goto bad; /* A(2,2)=0 */
688 INPUT_BYTE(cinfo, tmp, return FALSE);
689 if (tmp != 0) goto bad; /* F3: CENTER3=0, NORM3=0 */
690 INPUT_2BYTES(cinfo, tmp, return FALSE);
691 if (tmp != 1) goto bad; /* A(3,1)=1 */
692 INPUT_2BYTES(cinfo, tmp, return FALSE);
693 if (tmp != 0) { /* A(3,2)=0 */
694 bad:
695 ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
696 }
697
698 /* OK, valid transform that we can handle. */
699 cinfo->color_transform = JCT_SUBTRACT_GREEN;
700
701 INPUT_SYNC(cinfo);
702 return TRUE;
703 }
704
705
706 /*
707 * Routines for processing APPn and COM markers.
708 * These are either saved in memory or discarded, per application request.
709 * APP0 and APP14 are specially checked to see if they are
710 * JFIF and Adobe markers, respectively.
711 */
712
713 #define APP0_DATA_LEN 14 /* Length of interesting data in APP0 */
714 #define APP14_DATA_LEN 12 /* Length of interesting data in APP14 */
715 #define APPN_DATA_LEN 14 /* Must be the largest of the above!! */
716
717
718 LOCAL(void)
examine_app0(j_decompress_ptr cinfo,JOCTET FAR * data,unsigned int datalen,INT32 remaining)719 examine_app0 (j_decompress_ptr cinfo, JOCTET FAR * data,
720 unsigned int datalen, INT32 remaining)
721 /* Examine first few bytes from an APP0.
722 * Take appropriate action if it is a JFIF marker.
723 * datalen is # of bytes at data[], remaining is length of rest of marker data.
724 */
725 {
726 INT32 totallen = (INT32) datalen + remaining;
727
728 if (datalen >= APP0_DATA_LEN &&
729 GETJOCTET(data[0]) == 0x4A &&
730 GETJOCTET(data[1]) == 0x46 &&
731 GETJOCTET(data[2]) == 0x49 &&
732 GETJOCTET(data[3]) == 0x46 &&
733 GETJOCTET(data[4]) == 0) {
734 /* Found JFIF APP0 marker: save info */
735 cinfo->saw_JFIF_marker = TRUE;
736 cinfo->JFIF_major_version = GETJOCTET(data[5]);
737 cinfo->JFIF_minor_version = GETJOCTET(data[6]);
738 cinfo->density_unit = GETJOCTET(data[7]);
739 cinfo->X_density = (GETJOCTET(data[8]) << 8) + GETJOCTET(data[9]);
740 cinfo->Y_density = (GETJOCTET(data[10]) << 8) + GETJOCTET(data[11]);
741 /* Check version.
742 * Major version must be 1 or 2, anything else signals an incompatible
743 * change.
744 * (We used to treat this as an error, but now it's a nonfatal warning,
745 * because some bozo at Hijaak couldn't read the spec.)
746 * Minor version should be 0..2, but process anyway if newer.
747 */
748 if (cinfo->JFIF_major_version != 1 && cinfo->JFIF_major_version != 2)
749 WARNMS2(cinfo, JWRN_JFIF_MAJOR,
750 cinfo->JFIF_major_version, cinfo->JFIF_minor_version);
751 /* Generate trace messages */
752 TRACEMS5(cinfo, 1, JTRC_JFIF,
753 cinfo->JFIF_major_version, cinfo->JFIF_minor_version,
754 cinfo->X_density, cinfo->Y_density, cinfo->density_unit);
755 /* Validate thumbnail dimensions and issue appropriate messages */
756 if (GETJOCTET(data[12]) | GETJOCTET(data[13]))
757 TRACEMS2(cinfo, 1, JTRC_JFIF_THUMBNAIL,
758 GETJOCTET(data[12]), GETJOCTET(data[13]));
759 totallen -= APP0_DATA_LEN;
760 if (totallen !=
761 ((INT32)GETJOCTET(data[12]) * (INT32)GETJOCTET(data[13]) * (INT32) 3))
762 TRACEMS1(cinfo, 1, JTRC_JFIF_BADTHUMBNAILSIZE, (int) totallen);
763 } else if (datalen >= 6 &&
764 GETJOCTET(data[0]) == 0x4A &&
765 GETJOCTET(data[1]) == 0x46 &&
766 GETJOCTET(data[2]) == 0x58 &&
767 GETJOCTET(data[3]) == 0x58 &&
768 GETJOCTET(data[4]) == 0) {
769 /* Found JFIF "JFXX" extension APP0 marker */
770 /* The library doesn't actually do anything with these,
771 * but we try to produce a helpful trace message.
772 */
773 switch (GETJOCTET(data[5])) {
774 case 0x10:
775 TRACEMS1(cinfo, 1, JTRC_THUMB_JPEG, (int) totallen);
776 break;
777 case 0x11:
778 TRACEMS1(cinfo, 1, JTRC_THUMB_PALETTE, (int) totallen);
779 break;
780 case 0x13:
781 TRACEMS1(cinfo, 1, JTRC_THUMB_RGB, (int) totallen);
782 break;
783 default:
784 TRACEMS2(cinfo, 1, JTRC_JFIF_EXTENSION,
785 GETJOCTET(data[5]), (int) totallen);
786 }
787 } else {
788 /* Start of APP0 does not match "JFIF" or "JFXX", or too short */
789 TRACEMS1(cinfo, 1, JTRC_APP0, (int) totallen);
790 }
791 }
792
793
794 LOCAL(void)
examine_app14(j_decompress_ptr cinfo,JOCTET FAR * data,unsigned int datalen,INT32 remaining)795 examine_app14 (j_decompress_ptr cinfo, JOCTET FAR * data,
796 unsigned int datalen, INT32 remaining)
797 /* Examine first few bytes from an APP14.
798 * Take appropriate action if it is an Adobe marker.
799 * datalen is # of bytes at data[], remaining is length of rest of marker data.
800 */
801 {
802 unsigned int version, flags0, flags1, transform;
803
804 if (datalen >= APP14_DATA_LEN &&
805 GETJOCTET(data[0]) == 0x41 &&
806 GETJOCTET(data[1]) == 0x64 &&
807 GETJOCTET(data[2]) == 0x6F &&
808 GETJOCTET(data[3]) == 0x62 &&
809 GETJOCTET(data[4]) == 0x65) {
810 /* Found Adobe APP14 marker */
811 version = (GETJOCTET(data[5]) << 8) + GETJOCTET(data[6]);
812 flags0 = (GETJOCTET(data[7]) << 8) + GETJOCTET(data[8]);
813 flags1 = (GETJOCTET(data[9]) << 8) + GETJOCTET(data[10]);
814 transform = GETJOCTET(data[11]);
815 TRACEMS4(cinfo, 1, JTRC_ADOBE, version, flags0, flags1, transform);
816 cinfo->saw_Adobe_marker = TRUE;
817 cinfo->Adobe_transform = (UINT8) transform;
818 } else {
819 /* Start of APP14 does not match "Adobe", or too short */
820 TRACEMS1(cinfo, 1, JTRC_APP14, (int) (datalen + remaining));
821 }
822 }
823
824
825 METHODDEF(boolean)
get_interesting_appn(j_decompress_ptr cinfo)826 get_interesting_appn (j_decompress_ptr cinfo)
827 /* Process an APP0 or APP14 marker without saving it */
828 {
829 INT32 length;
830 JOCTET b[APPN_DATA_LEN];
831 unsigned int i, numtoread;
832 INPUT_VARS(cinfo);
833
834 INPUT_2BYTES(cinfo, length, return FALSE);
835 length -= 2;
836
837 /* get the interesting part of the marker data */
838 if (length >= APPN_DATA_LEN)
839 numtoread = APPN_DATA_LEN;
840 else if (length > 0)
841 numtoread = (unsigned int) length;
842 else
843 numtoread = 0;
844 for (i = 0; i < numtoread; i++)
845 INPUT_BYTE(cinfo, b[i], return FALSE);
846 length -= numtoread;
847
848 /* process it */
849 switch (cinfo->unread_marker) {
850 case M_APP0:
851 examine_app0(cinfo, (JOCTET FAR *) b, numtoread, length);
852 break;
853 case M_APP14:
854 examine_app14(cinfo, (JOCTET FAR *) b, numtoread, length);
855 break;
856 default:
857 /* can't get here unless jpeg_save_markers chooses wrong processor */
858 ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
859 }
860
861 /* skip any remaining data -- could be lots */
862 INPUT_SYNC(cinfo);
863 if (length > 0)
864 (*cinfo->src->skip_input_data) (cinfo, (long) length);
865
866 return TRUE;
867 }
868
869
870 #ifdef SAVE_MARKERS_SUPPORTED
871
872 METHODDEF(boolean)
save_marker(j_decompress_ptr cinfo)873 save_marker (j_decompress_ptr cinfo)
874 /* Save an APPn or COM marker into the marker list */
875 {
876 my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
877 jpeg_saved_marker_ptr cur_marker = marker->cur_marker;
878 unsigned int bytes_read, data_length;
879 JOCTET FAR * data;
880 INT32 length = 0;
881 INPUT_VARS(cinfo);
882
883 if (cur_marker == NULL) {
884 /* begin reading a marker */
885 INPUT_2BYTES(cinfo, length, return FALSE);
886 length -= 2;
887 if (length >= 0) { /* watch out for bogus length word */
888 /* figure out how much we want to save */
889 unsigned int limit;
890 if (cinfo->unread_marker == (int) M_COM)
891 limit = marker->length_limit_COM;
892 else
893 limit = marker->length_limit_APPn[cinfo->unread_marker - (int) M_APP0];
894 if ((unsigned int) length < limit)
895 limit = (unsigned int) length;
896 /* allocate and initialize the marker item */
897 cur_marker = (jpeg_saved_marker_ptr)
898 (*cinfo->mem->alloc_large) ((j_common_ptr) cinfo, JPOOL_IMAGE,
899 SIZEOF(struct jpeg_marker_struct) + limit);
900 cur_marker->next = NULL;
901 cur_marker->marker = (UINT8) cinfo->unread_marker;
902 cur_marker->original_length = (unsigned int) length;
903 cur_marker->data_length = limit;
904 /* data area is just beyond the jpeg_marker_struct */
905 data = cur_marker->data = (JOCTET FAR *) (cur_marker + 1);
906 marker->cur_marker = cur_marker;
907 marker->bytes_read = 0;
908 bytes_read = 0;
909 data_length = limit;
910 } else {
911 /* deal with bogus length word */
912 bytes_read = data_length = 0;
913 data = NULL;
914 }
915 } else {
916 /* resume reading a marker */
917 bytes_read = marker->bytes_read;
918 data_length = cur_marker->data_length;
919 data = cur_marker->data + bytes_read;
920 }
921
922 while (bytes_read < data_length) {
923 INPUT_SYNC(cinfo); /* move the restart point to here */
924 marker->bytes_read = bytes_read;
925 /* If there's not at least one byte in buffer, suspend */
926 MAKE_BYTE_AVAIL(cinfo, return FALSE);
927 /* Copy bytes with reasonable rapidity */
928 while (bytes_read < data_length && bytes_in_buffer > 0) {
929 *data++ = *next_input_byte++;
930 bytes_in_buffer--;
931 bytes_read++;
932 }
933 }
934
935 /* Done reading what we want to read */
936 if (cur_marker != NULL) { /* will be NULL if bogus length word */
937 /* Add new marker to end of list */
938 if (cinfo->marker_list == NULL) {
939 cinfo->marker_list = cur_marker;
940 } else {
941 jpeg_saved_marker_ptr prev = cinfo->marker_list;
942 while (prev->next != NULL)
943 prev = prev->next;
944 prev->next = cur_marker;
945 }
946 /* Reset pointer & calc remaining data length */
947 data = cur_marker->data;
948 length = cur_marker->original_length - data_length;
949 }
950 /* Reset to initial state for next marker */
951 marker->cur_marker = NULL;
952
953 /* Process the marker if interesting; else just make a generic trace msg */
954 switch (cinfo->unread_marker) {
955 case M_APP0:
956 examine_app0(cinfo, data, data_length, length);
957 break;
958 case M_APP14:
959 examine_app14(cinfo, data, data_length, length);
960 break;
961 default:
962 TRACEMS2(cinfo, 1, JTRC_MISC_MARKER, cinfo->unread_marker,
963 (int) (data_length + length));
964 }
965
966 /* skip any remaining data -- could be lots */
967 INPUT_SYNC(cinfo); /* do before skip_input_data */
968 if (length > 0)
969 (*cinfo->src->skip_input_data) (cinfo, (long) length);
970
971 return TRUE;
972 }
973
974 #endif /* SAVE_MARKERS_SUPPORTED */
975
976
977 METHODDEF(boolean)
skip_variable(j_decompress_ptr cinfo)978 skip_variable (j_decompress_ptr cinfo)
979 /* Skip over an unknown or uninteresting variable-length marker */
980 {
981 INT32 length;
982 INPUT_VARS(cinfo);
983
984 INPUT_2BYTES(cinfo, length, return FALSE);
985 length -= 2;
986
987 TRACEMS2(cinfo, 1, JTRC_MISC_MARKER, cinfo->unread_marker, (int) length);
988
989 INPUT_SYNC(cinfo); /* do before skip_input_data */
990 if (length > 0)
991 (*cinfo->src->skip_input_data) (cinfo, (long) length);
992
993 return TRUE;
994 }
995
996
997 /*
998 * Find the next JPEG marker, save it in cinfo->unread_marker.
999 * Returns FALSE if had to suspend before reaching a marker;
1000 * in that case cinfo->unread_marker is unchanged.
1001 *
1002 * Note that the result might not be a valid marker code,
1003 * but it will never be 0 or FF.
1004 */
1005
1006 LOCAL(boolean)
next_marker(j_decompress_ptr cinfo)1007 next_marker (j_decompress_ptr cinfo)
1008 {
1009 int c;
1010 INPUT_VARS(cinfo);
1011
1012 for (;;) {
1013 INPUT_BYTE(cinfo, c, return FALSE);
1014 /* Skip any non-FF bytes.
1015 * This may look a bit inefficient, but it will not occur in a valid file.
1016 * We sync after each discarded byte so that a suspending data source
1017 * can discard the byte from its buffer.
1018 */
1019 while (c != 0xFF) {
1020 cinfo->marker->discarded_bytes++;
1021 INPUT_SYNC(cinfo);
1022 INPUT_BYTE(cinfo, c, return FALSE);
1023 }
1024 /* This loop swallows any duplicate FF bytes. Extra FFs are legal as
1025 * pad bytes, so don't count them in discarded_bytes. We assume there
1026 * will not be so many consecutive FF bytes as to overflow a suspending
1027 * data source's input buffer.
1028 */
1029 do {
1030 INPUT_BYTE(cinfo, c, return FALSE);
1031 } while (c == 0xFF);
1032 if (c != 0)
1033 break; /* found a valid marker, exit loop */
1034 /* Reach here if we found a stuffed-zero data sequence (FF/00).
1035 * Discard it and loop back to try again.
1036 */
1037 cinfo->marker->discarded_bytes += 2;
1038 INPUT_SYNC(cinfo);
1039 }
1040
1041 if (cinfo->marker->discarded_bytes != 0) {
1042 WARNMS2(cinfo, JWRN_EXTRANEOUS_DATA, cinfo->marker->discarded_bytes, c);
1043 cinfo->marker->discarded_bytes = 0;
1044 }
1045
1046 cinfo->unread_marker = c;
1047
1048 INPUT_SYNC(cinfo);
1049 return TRUE;
1050 }
1051
1052
1053 LOCAL(boolean)
first_marker(j_decompress_ptr cinfo)1054 first_marker (j_decompress_ptr cinfo)
1055 /* Like next_marker, but used to obtain the initial SOI marker. */
1056 /* For this marker, we do not allow preceding garbage or fill; otherwise,
1057 * we might well scan an entire input file before realizing it ain't JPEG.
1058 * If an application wants to process non-JFIF files, it must seek to the
1059 * SOI before calling the JPEG library.
1060 */
1061 {
1062 int c, c2;
1063 INPUT_VARS(cinfo);
1064
1065 INPUT_BYTE(cinfo, c, return FALSE);
1066 INPUT_BYTE(cinfo, c2, return FALSE);
1067 if (c != 0xFF || c2 != (int) M_SOI)
1068 ERREXIT2(cinfo, JERR_NO_SOI, c, c2);
1069
1070 cinfo->unread_marker = c2;
1071
1072 INPUT_SYNC(cinfo);
1073 return TRUE;
1074 }
1075
1076
1077 /*
1078 * Read markers until SOS or EOI.
1079 *
1080 * Returns same codes as are defined for jpeg_consume_input:
1081 * JPEG_SUSPENDED, JPEG_REACHED_SOS, or JPEG_REACHED_EOI.
1082 *
1083 * Note: This function may return a pseudo SOS marker (with zero
1084 * component number) for treat by input controller's consume_input.
1085 * consume_input itself should filter out (skip) the pseudo marker
1086 * after processing for the caller.
1087 */
1088
1089 METHODDEF(int)
read_markers(j_decompress_ptr cinfo)1090 read_markers (j_decompress_ptr cinfo)
1091 {
1092 /* Outer loop repeats once for each marker. */
1093 for (;;) {
1094 /* Collect the marker proper, unless we already did. */
1095 /* NB: first_marker() enforces the requirement that SOI appear first. */
1096 if (cinfo->unread_marker == 0) {
1097 if (! cinfo->marker->saw_SOI) {
1098 if (! first_marker(cinfo))
1099 return JPEG_SUSPENDED;
1100 } else {
1101 if (! next_marker(cinfo))
1102 return JPEG_SUSPENDED;
1103 }
1104 }
1105 /* At this point cinfo->unread_marker contains the marker code and the
1106 * input point is just past the marker proper, but before any parameters.
1107 * A suspension will cause us to return with this state still true.
1108 */
1109 switch (cinfo->unread_marker) {
1110 case M_SOI:
1111 if (! get_soi(cinfo))
1112 return JPEG_SUSPENDED;
1113 break;
1114
1115 case M_SOF0: /* Baseline */
1116 if (! get_sof(cinfo, TRUE, FALSE, FALSE))
1117 return JPEG_SUSPENDED;
1118 break;
1119
1120 case M_SOF1: /* Extended sequential, Huffman */
1121 if (! get_sof(cinfo, FALSE, FALSE, FALSE))
1122 return JPEG_SUSPENDED;
1123 break;
1124
1125 case M_SOF2: /* Progressive, Huffman */
1126 if (! get_sof(cinfo, FALSE, TRUE, FALSE))
1127 return JPEG_SUSPENDED;
1128 break;
1129
1130 case M_SOF9: /* Extended sequential, arithmetic */
1131 if (! get_sof(cinfo, FALSE, FALSE, TRUE))
1132 return JPEG_SUSPENDED;
1133 break;
1134
1135 case M_SOF10: /* Progressive, arithmetic */
1136 if (! get_sof(cinfo, FALSE, TRUE, TRUE))
1137 return JPEG_SUSPENDED;
1138 break;
1139
1140 /* Currently unsupported SOFn types */
1141 case M_SOF3: /* Lossless, Huffman */
1142 case M_SOF5: /* Differential sequential, Huffman */
1143 case M_SOF6: /* Differential progressive, Huffman */
1144 case M_SOF7: /* Differential lossless, Huffman */
1145 case M_JPG: /* Reserved for JPEG extensions */
1146 case M_SOF11: /* Lossless, arithmetic */
1147 case M_SOF13: /* Differential sequential, arithmetic */
1148 case M_SOF14: /* Differential progressive, arithmetic */
1149 case M_SOF15: /* Differential lossless, arithmetic */
1150 ERREXIT1(cinfo, JERR_SOF_UNSUPPORTED, cinfo->unread_marker);
1151 break;
1152
1153 case M_SOS:
1154 if (! get_sos(cinfo))
1155 return JPEG_SUSPENDED;
1156 cinfo->unread_marker = 0; /* processed the marker */
1157 return JPEG_REACHED_SOS;
1158
1159 case M_EOI:
1160 TRACEMS(cinfo, 1, JTRC_EOI);
1161 cinfo->unread_marker = 0; /* processed the marker */
1162 return JPEG_REACHED_EOI;
1163
1164 case M_DAC:
1165 if (! get_dac(cinfo))
1166 return JPEG_SUSPENDED;
1167 break;
1168
1169 case M_DHT:
1170 if (! get_dht(cinfo))
1171 return JPEG_SUSPENDED;
1172 break;
1173
1174 case M_DQT:
1175 if (! get_dqt(cinfo))
1176 return JPEG_SUSPENDED;
1177 break;
1178
1179 case M_DRI:
1180 if (! get_dri(cinfo))
1181 return JPEG_SUSPENDED;
1182 break;
1183
1184 case M_JPG8:
1185 if (! get_lse(cinfo))
1186 return JPEG_SUSPENDED;
1187 break;
1188
1189 case M_APP0:
1190 case M_APP1:
1191 case M_APP2:
1192 case M_APP3:
1193 case M_APP4:
1194 case M_APP5:
1195 case M_APP6:
1196 case M_APP7:
1197 case M_APP8:
1198 case M_APP9:
1199 case M_APP10:
1200 case M_APP11:
1201 case M_APP12:
1202 case M_APP13:
1203 case M_APP14:
1204 case M_APP15:
1205 if (! (*((my_marker_ptr) cinfo->marker)->process_APPn[
1206 cinfo->unread_marker - (int) M_APP0]) (cinfo))
1207 return JPEG_SUSPENDED;
1208 break;
1209
1210 case M_COM:
1211 if (! (*((my_marker_ptr) cinfo->marker)->process_COM) (cinfo))
1212 return JPEG_SUSPENDED;
1213 break;
1214
1215 case M_RST0: /* these are all parameterless */
1216 case M_RST1:
1217 case M_RST2:
1218 case M_RST3:
1219 case M_RST4:
1220 case M_RST5:
1221 case M_RST6:
1222 case M_RST7:
1223 case M_TEM:
1224 TRACEMS1(cinfo, 1, JTRC_PARMLESS_MARKER, cinfo->unread_marker);
1225 break;
1226
1227 case M_DNL: /* Ignore DNL ... perhaps the wrong thing */
1228 if (! skip_variable(cinfo))
1229 return JPEG_SUSPENDED;
1230 break;
1231
1232 default: /* must be DHP, EXP, JPGn, or RESn */
1233 /* For now, we treat the reserved markers as fatal errors since they are
1234 * likely to be used to signal incompatible JPEG Part 3 extensions.
1235 * Once the JPEG 3 version-number marker is well defined, this code
1236 * ought to change!
1237 */
1238 ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
1239 }
1240 /* Successfully processed marker, so reset state variable */
1241 cinfo->unread_marker = 0;
1242 } /* end loop */
1243 }
1244
1245
1246 /*
1247 * Read a restart marker, which is expected to appear next in the datastream;
1248 * if the marker is not there, take appropriate recovery action.
1249 * Returns FALSE if suspension is required.
1250 *
1251 * This is called by the entropy decoder after it has read an appropriate
1252 * number of MCUs. cinfo->unread_marker may be nonzero if the entropy decoder
1253 * has already read a marker from the data source. Under normal conditions
1254 * cinfo->unread_marker will be reset to 0 before returning; if not reset,
1255 * it holds a marker which the decoder will be unable to read past.
1256 */
1257
1258 METHODDEF(boolean)
read_restart_marker(j_decompress_ptr cinfo)1259 read_restart_marker (j_decompress_ptr cinfo)
1260 {
1261 /* Obtain a marker unless we already did. */
1262 /* Note that next_marker will complain if it skips any data. */
1263 if (cinfo->unread_marker == 0) {
1264 if (! next_marker(cinfo))
1265 return FALSE;
1266 }
1267
1268 if (cinfo->unread_marker ==
1269 ((int) M_RST0 + cinfo->marker->next_restart_num)) {
1270 /* Normal case --- swallow the marker and let entropy decoder continue */
1271 TRACEMS1(cinfo, 3, JTRC_RST, cinfo->marker->next_restart_num);
1272 cinfo->unread_marker = 0;
1273 } else {
1274 /* Uh-oh, the restart markers have been messed up. */
1275 /* Let the data source manager determine how to resync. */
1276 if (! (*cinfo->src->resync_to_restart) (cinfo,
1277 cinfo->marker->next_restart_num))
1278 return FALSE;
1279 }
1280
1281 /* Update next-restart state */
1282 cinfo->marker->next_restart_num = (cinfo->marker->next_restart_num + 1) & 7;
1283
1284 return TRUE;
1285 }
1286
1287
1288 /*
1289 * This is the default resync_to_restart method for data source managers
1290 * to use if they don't have any better approach. Some data source managers
1291 * may be able to back up, or may have additional knowledge about the data
1292 * which permits a more intelligent recovery strategy; such managers would
1293 * presumably supply their own resync method.
1294 *
1295 * read_restart_marker calls resync_to_restart if it finds a marker other than
1296 * the restart marker it was expecting. (This code is *not* used unless
1297 * a nonzero restart interval has been declared.) cinfo->unread_marker is
1298 * the marker code actually found (might be anything, except 0 or FF).
1299 * The desired restart marker number (0..7) is passed as a parameter.
1300 * This routine is supposed to apply whatever error recovery strategy seems
1301 * appropriate in order to position the input stream to the next data segment.
1302 * Note that cinfo->unread_marker is treated as a marker appearing before
1303 * the current data-source input point; usually it should be reset to zero
1304 * before returning.
1305 * Returns FALSE if suspension is required.
1306 *
1307 * This implementation is substantially constrained by wanting to treat the
1308 * input as a data stream; this means we can't back up. Therefore, we have
1309 * only the following actions to work with:
1310 * 1. Simply discard the marker and let the entropy decoder resume at next
1311 * byte of file.
1312 * 2. Read forward until we find another marker, discarding intervening
1313 * data. (In theory we could look ahead within the current bufferload,
1314 * without having to discard data if we don't find the desired marker.
1315 * This idea is not implemented here, in part because it makes behavior
1316 * dependent on buffer size and chance buffer-boundary positions.)
1317 * 3. Leave the marker unread (by failing to zero cinfo->unread_marker).
1318 * This will cause the entropy decoder to process an empty data segment,
1319 * inserting dummy zeroes, and then we will reprocess the marker.
1320 *
1321 * #2 is appropriate if we think the desired marker lies ahead, while #3 is
1322 * appropriate if the found marker is a future restart marker (indicating
1323 * that we have missed the desired restart marker, probably because it got
1324 * corrupted).
1325 * We apply #2 or #3 if the found marker is a restart marker no more than
1326 * two counts behind or ahead of the expected one. We also apply #2 if the
1327 * found marker is not a legal JPEG marker code (it's certainly bogus data).
1328 * If the found marker is a restart marker more than 2 counts away, we do #1
1329 * (too much risk that the marker is erroneous; with luck we will be able to
1330 * resync at some future point).
1331 * For any valid non-restart JPEG marker, we apply #3. This keeps us from
1332 * overrunning the end of a scan. An implementation limited to single-scan
1333 * files might find it better to apply #2 for markers other than EOI, since
1334 * any other marker would have to be bogus data in that case.
1335 */
1336
1337 GLOBAL(boolean)
jpeg_resync_to_restart(j_decompress_ptr cinfo,int desired)1338 jpeg_resync_to_restart (j_decompress_ptr cinfo, int desired)
1339 {
1340 int marker = cinfo->unread_marker;
1341 int action = 1;
1342
1343 /* Always put up a warning. */
1344 WARNMS2(cinfo, JWRN_MUST_RESYNC, marker, desired);
1345
1346 /* Outer loop handles repeated decision after scanning forward. */
1347 for (;;) {
1348 if (marker < (int) M_SOF0)
1349 action = 2; /* invalid marker */
1350 else if (marker < (int) M_RST0 || marker > (int) M_RST7)
1351 action = 3; /* valid non-restart marker */
1352 else {
1353 if (marker == ((int) M_RST0 + ((desired+1) & 7)) ||
1354 marker == ((int) M_RST0 + ((desired+2) & 7)))
1355 action = 3; /* one of the next two expected restarts */
1356 else if (marker == ((int) M_RST0 + ((desired-1) & 7)) ||
1357 marker == ((int) M_RST0 + ((desired-2) & 7)))
1358 action = 2; /* a prior restart, so advance */
1359 else
1360 action = 1; /* desired restart or too far away */
1361 }
1362 TRACEMS2(cinfo, 4, JTRC_RECOVERY_ACTION, marker, action);
1363 switch (action) {
1364 case 1:
1365 /* Discard marker and let entropy decoder resume processing. */
1366 cinfo->unread_marker = 0;
1367 return TRUE;
1368 case 2:
1369 /* Scan to the next marker, and repeat the decision loop. */
1370 if (! next_marker(cinfo))
1371 return FALSE;
1372 marker = cinfo->unread_marker;
1373 break;
1374 case 3:
1375 /* Return without advancing past this marker. */
1376 /* Entropy decoder will be forced to process an empty segment. */
1377 return TRUE;
1378 }
1379 } /* end loop */
1380 }
1381
1382
1383 /*
1384 * Reset marker processing state to begin a fresh datastream.
1385 */
1386
1387 METHODDEF(void)
reset_marker_reader(j_decompress_ptr cinfo)1388 reset_marker_reader (j_decompress_ptr cinfo)
1389 {
1390 my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
1391
1392 cinfo->comp_info = NULL; /* until allocated by get_sof */
1393 cinfo->input_scan_number = 0; /* no SOS seen yet */
1394 cinfo->unread_marker = 0; /* no pending marker */
1395 marker->pub.saw_SOI = FALSE; /* set internal state too */
1396 marker->pub.saw_SOF = FALSE;
1397 marker->pub.discarded_bytes = 0;
1398 marker->cur_marker = NULL;
1399 }
1400
1401
1402 /*
1403 * Initialize the marker reader module.
1404 * This is called only once, when the decompression object is created.
1405 */
1406
1407 GLOBAL(void)
jinit_marker_reader(j_decompress_ptr cinfo)1408 jinit_marker_reader (j_decompress_ptr cinfo)
1409 {
1410 my_marker_ptr marker;
1411 int i;
1412
1413 /* Create subobject in permanent pool */
1414 marker = (my_marker_ptr) (*cinfo->mem->alloc_small)
1415 ((j_common_ptr) cinfo, JPOOL_PERMANENT, SIZEOF(my_marker_reader));
1416 cinfo->marker = &marker->pub;
1417 /* Initialize public method pointers */
1418 marker->pub.reset_marker_reader = reset_marker_reader;
1419 marker->pub.read_markers = read_markers;
1420 marker->pub.read_restart_marker = read_restart_marker;
1421 /* Initialize COM/APPn processing.
1422 * By default, we examine and then discard APP0 and APP14,
1423 * but simply discard COM and all other APPn.
1424 */
1425 marker->process_COM = skip_variable;
1426 marker->length_limit_COM = 0;
1427 for (i = 0; i < 16; i++) {
1428 marker->process_APPn[i] = skip_variable;
1429 marker->length_limit_APPn[i] = 0;
1430 }
1431 marker->process_APPn[0] = get_interesting_appn;
1432 marker->process_APPn[14] = get_interesting_appn;
1433 /* Reset marker processing state */
1434 reset_marker_reader(cinfo);
1435 }
1436
1437
1438 /*
1439 * Control saving of COM and APPn markers into marker_list.
1440 */
1441
1442 #ifdef SAVE_MARKERS_SUPPORTED
1443
1444 GLOBAL(void)
jpeg_save_markers(j_decompress_ptr cinfo,int marker_code,unsigned int length_limit)1445 jpeg_save_markers (j_decompress_ptr cinfo, int marker_code,
1446 unsigned int length_limit)
1447 {
1448 my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
1449 long maxlength;
1450 jpeg_marker_parser_method processor;
1451
1452 /* Length limit mustn't be larger than what we can allocate
1453 * (should only be a concern in a 16-bit environment).
1454 */
1455 maxlength = cinfo->mem->max_alloc_chunk - SIZEOF(struct jpeg_marker_struct);
1456 if (((long) length_limit) > maxlength)
1457 length_limit = (unsigned int) maxlength;
1458
1459 /* Choose processor routine to use.
1460 * APP0/APP14 have special requirements.
1461 */
1462 if (length_limit) {
1463 processor = save_marker;
1464 /* If saving APP0/APP14, save at least enough for our internal use. */
1465 if (marker_code == (int) M_APP0 && length_limit < APP0_DATA_LEN)
1466 length_limit = APP0_DATA_LEN;
1467 else if (marker_code == (int) M_APP14 && length_limit < APP14_DATA_LEN)
1468 length_limit = APP14_DATA_LEN;
1469 } else {
1470 processor = skip_variable;
1471 /* If discarding APP0/APP14, use our regular on-the-fly processor. */
1472 if (marker_code == (int) M_APP0 || marker_code == (int) M_APP14)
1473 processor = get_interesting_appn;
1474 }
1475
1476 if (marker_code == (int) M_COM) {
1477 marker->process_COM = processor;
1478 marker->length_limit_COM = length_limit;
1479 } else if (marker_code >= (int) M_APP0 && marker_code <= (int) M_APP15) {
1480 marker->process_APPn[marker_code - (int) M_APP0] = processor;
1481 marker->length_limit_APPn[marker_code - (int) M_APP0] = length_limit;
1482 } else
1483 ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
1484 }
1485
1486 #endif /* SAVE_MARKERS_SUPPORTED */
1487
1488
1489 /*
1490 * Install a special processing method for COM or APPn markers.
1491 */
1492
1493 GLOBAL(void)
jpeg_set_marker_processor(j_decompress_ptr cinfo,int marker_code,jpeg_marker_parser_method routine)1494 jpeg_set_marker_processor (j_decompress_ptr cinfo, int marker_code,
1495 jpeg_marker_parser_method routine)
1496 {
1497 my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
1498
1499 if (marker_code == (int) M_COM)
1500 marker->process_COM = routine;
1501 else if (marker_code >= (int) M_APP0 && marker_code <= (int) M_APP15)
1502 marker->process_APPn[marker_code - (int) M_APP0] = routine;
1503 else
1504 ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
1505 }
1506