xref: /reactos/dll/3rdparty/libjpeg/jdmarker.c (revision c2c66aff)
1 /*
2  * jdmarker.c
3  *
4  * Copyright (C) 1991-1998, Thomas G. Lane.
5  * Modified 2009-2013 by Guido Vollbeding.
6  * This file is part of the Independent JPEG Group's software.
7  * For conditions of distribution and use, see the accompanying README file.
8  *
9  * This file contains routines to decode JPEG datastream markers.
10  * Most of the complexity arises from our desire to support input
11  * suspension: if not all of the data for a marker is available,
12  * we must exit back to the application.  On resumption, we reprocess
13  * the marker.
14  */
15 
16 #define JPEG_INTERNALS
17 #include "jinclude.h"
18 #include "jpeglib.h"
19 
20 
21 typedef enum {			/* JPEG marker codes */
22   M_SOF0  = 0xc0,
23   M_SOF1  = 0xc1,
24   M_SOF2  = 0xc2,
25   M_SOF3  = 0xc3,
26 
27   M_SOF5  = 0xc5,
28   M_SOF6  = 0xc6,
29   M_SOF7  = 0xc7,
30 
31   M_JPG   = 0xc8,
32   M_SOF9  = 0xc9,
33   M_SOF10 = 0xca,
34   M_SOF11 = 0xcb,
35 
36   M_SOF13 = 0xcd,
37   M_SOF14 = 0xce,
38   M_SOF15 = 0xcf,
39 
40   M_DHT   = 0xc4,
41 
42   M_DAC   = 0xcc,
43 
44   M_RST0  = 0xd0,
45   M_RST1  = 0xd1,
46   M_RST2  = 0xd2,
47   M_RST3  = 0xd3,
48   M_RST4  = 0xd4,
49   M_RST5  = 0xd5,
50   M_RST6  = 0xd6,
51   M_RST7  = 0xd7,
52 
53   M_SOI   = 0xd8,
54   M_EOI   = 0xd9,
55   M_SOS   = 0xda,
56   M_DQT   = 0xdb,
57   M_DNL   = 0xdc,
58   M_DRI   = 0xdd,
59   M_DHP   = 0xde,
60   M_EXP   = 0xdf,
61 
62   M_APP0  = 0xe0,
63   M_APP1  = 0xe1,
64   M_APP2  = 0xe2,
65   M_APP3  = 0xe3,
66   M_APP4  = 0xe4,
67   M_APP5  = 0xe5,
68   M_APP6  = 0xe6,
69   M_APP7  = 0xe7,
70   M_APP8  = 0xe8,
71   M_APP9  = 0xe9,
72   M_APP10 = 0xea,
73   M_APP11 = 0xeb,
74   M_APP12 = 0xec,
75   M_APP13 = 0xed,
76   M_APP14 = 0xee,
77   M_APP15 = 0xef,
78 
79   M_JPG0  = 0xf0,
80   M_JPG8  = 0xf8,
81   M_JPG13 = 0xfd,
82   M_COM   = 0xfe,
83 
84   M_TEM   = 0x01,
85 
86   M_ERROR = 0x100
87 } JPEG_MARKER;
88 
89 
90 /* Private state */
91 
92 typedef struct {
93   struct jpeg_marker_reader pub; /* public fields */
94 
95   /* Application-overridable marker processing methods */
96   jpeg_marker_parser_method process_COM;
97   jpeg_marker_parser_method process_APPn[16];
98 
99   /* Limit on marker data length to save for each marker type */
100   unsigned int length_limit_COM;
101   unsigned int length_limit_APPn[16];
102 
103   /* Status of COM/APPn marker saving */
104   jpeg_saved_marker_ptr cur_marker;	/* NULL if not processing a marker */
105   unsigned int bytes_read;		/* data bytes read so far in marker */
106   /* Note: cur_marker is not linked into marker_list until it's all read. */
107 } my_marker_reader;
108 
109 typedef my_marker_reader * my_marker_ptr;
110 
111 
112 /*
113  * Macros for fetching data from the data source module.
114  *
115  * At all times, cinfo->src->next_input_byte and ->bytes_in_buffer reflect
116  * the current restart point; we update them only when we have reached a
117  * suitable place to restart if a suspension occurs.
118  */
119 
120 /* Declare and initialize local copies of input pointer/count */
121 #define INPUT_VARS(cinfo)  \
122 	struct jpeg_source_mgr * datasrc = (cinfo)->src;  \
123 	const JOCTET * next_input_byte = datasrc->next_input_byte;  \
124 	size_t bytes_in_buffer = datasrc->bytes_in_buffer
125 
126 /* Unload the local copies --- do this only at a restart boundary */
127 #define INPUT_SYNC(cinfo)  \
128 	( datasrc->next_input_byte = next_input_byte,  \
129 	  datasrc->bytes_in_buffer = bytes_in_buffer )
130 
131 /* Reload the local copies --- used only in MAKE_BYTE_AVAIL */
132 #define INPUT_RELOAD(cinfo)  \
133 	( next_input_byte = datasrc->next_input_byte,  \
134 	  bytes_in_buffer = datasrc->bytes_in_buffer )
135 
136 /* Internal macro for INPUT_BYTE and INPUT_2BYTES: make a byte available.
137  * Note we do *not* do INPUT_SYNC before calling fill_input_buffer,
138  * but we must reload the local copies after a successful fill.
139  */
140 #define MAKE_BYTE_AVAIL(cinfo,action)  \
141 	if (bytes_in_buffer == 0) {  \
142 	  if (! (*datasrc->fill_input_buffer) (cinfo))  \
143 	    { action; }  \
144 	  INPUT_RELOAD(cinfo);  \
145 	}
146 
147 /* Read a byte into variable V.
148  * If must suspend, take the specified action (typically "return FALSE").
149  */
150 #define INPUT_BYTE(cinfo,V,action)  \
151 	MAKESTMT( MAKE_BYTE_AVAIL(cinfo,action); \
152 		  bytes_in_buffer--; \
153 		  V = GETJOCTET(*next_input_byte++); )
154 
155 /* As above, but read two bytes interpreted as an unsigned 16-bit integer.
156  * V should be declared unsigned int or perhaps INT32.
157  */
158 #define INPUT_2BYTES(cinfo,V,action)  \
159 	MAKESTMT( MAKE_BYTE_AVAIL(cinfo,action); \
160 		  bytes_in_buffer--; \
161 		  V = ((unsigned int) GETJOCTET(*next_input_byte++)) << 8; \
162 		  MAKE_BYTE_AVAIL(cinfo,action); \
163 		  bytes_in_buffer--; \
164 		  V += GETJOCTET(*next_input_byte++); )
165 
166 
167 /*
168  * Routines to process JPEG markers.
169  *
170  * Entry condition: JPEG marker itself has been read and its code saved
171  *   in cinfo->unread_marker; input restart point is just after the marker.
172  *
173  * Exit: if return TRUE, have read and processed any parameters, and have
174  *   updated the restart point to point after the parameters.
175  *   If return FALSE, was forced to suspend before reaching end of
176  *   marker parameters; restart point has not been moved.  Same routine
177  *   will be called again after application supplies more input data.
178  *
179  * This approach to suspension assumes that all of a marker's parameters
180  * can fit into a single input bufferload.  This should hold for "normal"
181  * markers.  Some COM/APPn markers might have large parameter segments
182  * that might not fit.  If we are simply dropping such a marker, we use
183  * skip_input_data to get past it, and thereby put the problem on the
184  * source manager's shoulders.  If we are saving the marker's contents
185  * into memory, we use a slightly different convention: when forced to
186  * suspend, the marker processor updates the restart point to the end of
187  * what it's consumed (ie, the end of the buffer) before returning FALSE.
188  * On resumption, cinfo->unread_marker still contains the marker code,
189  * but the data source will point to the next chunk of marker data.
190  * The marker processor must retain internal state to deal with this.
191  *
192  * Note that we don't bother to avoid duplicate trace messages if a
193  * suspension occurs within marker parameters.  Other side effects
194  * require more care.
195  */
196 
197 
198 LOCAL(boolean)
199 get_soi (j_decompress_ptr cinfo)
200 /* Process an SOI marker */
201 {
202   int i;
203 
204   TRACEMS(cinfo, 1, JTRC_SOI);
205 
206   if (cinfo->marker->saw_SOI)
207     ERREXIT(cinfo, JERR_SOI_DUPLICATE);
208 
209   /* Reset all parameters that are defined to be reset by SOI */
210 
211   for (i = 0; i < NUM_ARITH_TBLS; i++) {
212     cinfo->arith_dc_L[i] = 0;
213     cinfo->arith_dc_U[i] = 1;
214     cinfo->arith_ac_K[i] = 5;
215   }
216   cinfo->restart_interval = 0;
217 
218   /* Set initial assumptions for colorspace etc */
219 
220   cinfo->jpeg_color_space = JCS_UNKNOWN;
221   cinfo->color_transform = JCT_NONE;
222   cinfo->CCIR601_sampling = FALSE; /* Assume non-CCIR sampling??? */
223 
224   cinfo->saw_JFIF_marker = FALSE;
225   cinfo->JFIF_major_version = 1; /* set default JFIF APP0 values */
226   cinfo->JFIF_minor_version = 1;
227   cinfo->density_unit = 0;
228   cinfo->X_density = 1;
229   cinfo->Y_density = 1;
230   cinfo->saw_Adobe_marker = FALSE;
231   cinfo->Adobe_transform = 0;
232 
233   cinfo->marker->saw_SOI = TRUE;
234 
235   return TRUE;
236 }
237 
238 
239 LOCAL(boolean)
240 get_sof (j_decompress_ptr cinfo, boolean is_baseline, boolean is_prog,
241 	 boolean is_arith)
242 /* Process a SOFn marker */
243 {
244   INT32 length;
245   int c, ci, i;
246   jpeg_component_info * compptr;
247   INPUT_VARS(cinfo);
248 
249   cinfo->is_baseline = is_baseline;
250   cinfo->progressive_mode = is_prog;
251   cinfo->arith_code = is_arith;
252 
253   INPUT_2BYTES(cinfo, length, return FALSE);
254 
255   INPUT_BYTE(cinfo, cinfo->data_precision, return FALSE);
256   INPUT_2BYTES(cinfo, cinfo->image_height, return FALSE);
257   INPUT_2BYTES(cinfo, cinfo->image_width, return FALSE);
258   INPUT_BYTE(cinfo, cinfo->num_components, return FALSE);
259 
260   length -= 8;
261 
262   TRACEMS4(cinfo, 1, JTRC_SOF, cinfo->unread_marker,
263 	   (int) cinfo->image_width, (int) cinfo->image_height,
264 	   cinfo->num_components);
265 
266   if (cinfo->marker->saw_SOF)
267     ERREXIT(cinfo, JERR_SOF_DUPLICATE);
268 
269   /* We don't support files in which the image height is initially specified */
270   /* as 0 and is later redefined by DNL.  As long as we have to check that,  */
271   /* might as well have a general sanity check. */
272   if (cinfo->image_height <= 0 || cinfo->image_width <= 0 ||
273       cinfo->num_components <= 0)
274     ERREXIT(cinfo, JERR_EMPTY_IMAGE);
275 
276   if (length != (cinfo->num_components * 3))
277     ERREXIT(cinfo, JERR_BAD_LENGTH);
278 
279   if (cinfo->comp_info == NULL)	/* do only once, even if suspend */
280     cinfo->comp_info = (jpeg_component_info *) (*cinfo->mem->alloc_small)
281 			((j_common_ptr) cinfo, JPOOL_IMAGE,
282 			 cinfo->num_components * SIZEOF(jpeg_component_info));
283 
284   for (ci = 0; ci < cinfo->num_components; ci++) {
285     INPUT_BYTE(cinfo, c, return FALSE);
286     /* Check to see whether component id has already been seen   */
287     /* (in violation of the spec, but unfortunately seen in some */
288     /* files).  If so, create "fake" component id equal to the   */
289     /* max id seen so far + 1. */
290     for (i = 0, compptr = cinfo->comp_info; i < ci; i++, compptr++) {
291       if (c == compptr->component_id) {
292 	compptr = cinfo->comp_info;
293 	c = compptr->component_id;
294 	compptr++;
295 	for (i = 1; i < ci; i++, compptr++) {
296 	  if (compptr->component_id > c) c = compptr->component_id;
297 	}
298 	c++;
299 	break;
300       }
301     }
302     compptr->component_id = c;
303     compptr->component_index = ci;
304     INPUT_BYTE(cinfo, c, return FALSE);
305     compptr->h_samp_factor = (c >> 4) & 15;
306     compptr->v_samp_factor = (c     ) & 15;
307     INPUT_BYTE(cinfo, compptr->quant_tbl_no, return FALSE);
308 
309     TRACEMS4(cinfo, 1, JTRC_SOF_COMPONENT,
310 	     compptr->component_id, compptr->h_samp_factor,
311 	     compptr->v_samp_factor, compptr->quant_tbl_no);
312   }
313 
314   cinfo->marker->saw_SOF = TRUE;
315 
316   INPUT_SYNC(cinfo);
317   return TRUE;
318 }
319 
320 
321 LOCAL(boolean)
322 get_sos (j_decompress_ptr cinfo)
323 /* Process a SOS marker */
324 {
325   INT32 length;
326   int c, ci, i, n;
327   jpeg_component_info * compptr;
328   INPUT_VARS(cinfo);
329 
330   if (! cinfo->marker->saw_SOF)
331     ERREXITS(cinfo, JERR_SOF_BEFORE, "SOS");
332 
333   INPUT_2BYTES(cinfo, length, return FALSE);
334 
335   INPUT_BYTE(cinfo, n, return FALSE); /* Number of components */
336 
337   TRACEMS1(cinfo, 1, JTRC_SOS, n);
338 
339   if (length != (n * 2 + 6) || n > MAX_COMPS_IN_SCAN ||
340       (n == 0 && !cinfo->progressive_mode))
341       /* pseudo SOS marker only allowed in progressive mode */
342     ERREXIT(cinfo, JERR_BAD_LENGTH);
343 
344   cinfo->comps_in_scan = n;
345 
346   /* Collect the component-spec parameters */
347 
348   for (i = 0; i < n; i++) {
349     INPUT_BYTE(cinfo, c, return FALSE);
350 
351     /* Detect the case where component id's are not unique, and, if so, */
352     /* create a fake component id using the same logic as in get_sof.   */
353     /* Note:  This also ensures that all of the SOF components are      */
354     /* referenced in the single scan case, which prevents access to     */
355     /* uninitialized memory in later decoding stages. */
356     for (ci = 0; ci < i; ci++) {
357       if (c == cinfo->cur_comp_info[ci]->component_id) {
358 	c = cinfo->cur_comp_info[0]->component_id;
359 	for (ci = 1; ci < i; ci++) {
360 	  compptr = cinfo->cur_comp_info[ci];
361 	  if (compptr->component_id > c) c = compptr->component_id;
362 	}
363 	c++;
364 	break;
365       }
366     }
367 
368     for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
369 	 ci++, compptr++) {
370       if (c == compptr->component_id)
371 	goto id_found;
372     }
373 
374     ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, c);
375 
376   id_found:
377 
378     cinfo->cur_comp_info[i] = compptr;
379     INPUT_BYTE(cinfo, c, return FALSE);
380     compptr->dc_tbl_no = (c >> 4) & 15;
381     compptr->ac_tbl_no = (c     ) & 15;
382 
383     TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, compptr->component_id,
384 	     compptr->dc_tbl_no, compptr->ac_tbl_no);
385   }
386 
387   /* Collect the additional scan parameters Ss, Se, Ah/Al. */
388   INPUT_BYTE(cinfo, c, return FALSE);
389   cinfo->Ss = c;
390   INPUT_BYTE(cinfo, c, return FALSE);
391   cinfo->Se = c;
392   INPUT_BYTE(cinfo, c, return FALSE);
393   cinfo->Ah = (c >> 4) & 15;
394   cinfo->Al = (c     ) & 15;
395 
396   TRACEMS4(cinfo, 1, JTRC_SOS_PARAMS, cinfo->Ss, cinfo->Se,
397 	   cinfo->Ah, cinfo->Al);
398 
399   /* Prepare to scan data & restart markers */
400   cinfo->marker->next_restart_num = 0;
401 
402   /* Count another (non-pseudo) SOS marker */
403   if (n) cinfo->input_scan_number++;
404 
405   INPUT_SYNC(cinfo);
406   return TRUE;
407 }
408 
409 
410 #ifdef D_ARITH_CODING_SUPPORTED
411 
412 LOCAL(boolean)
413 get_dac (j_decompress_ptr cinfo)
414 /* Process a DAC marker */
415 {
416   INT32 length;
417   int index, val;
418   INPUT_VARS(cinfo);
419 
420   INPUT_2BYTES(cinfo, length, return FALSE);
421   length -= 2;
422 
423   while (length > 0) {
424     INPUT_BYTE(cinfo, index, return FALSE);
425     INPUT_BYTE(cinfo, val, return FALSE);
426 
427     length -= 2;
428 
429     TRACEMS2(cinfo, 1, JTRC_DAC, index, val);
430 
431     if (index < 0 || index >= (2*NUM_ARITH_TBLS))
432       ERREXIT1(cinfo, JERR_DAC_INDEX, index);
433 
434     if (index >= NUM_ARITH_TBLS) { /* define AC table */
435       cinfo->arith_ac_K[index-NUM_ARITH_TBLS] = (UINT8) val;
436     } else {			/* define DC table */
437       cinfo->arith_dc_L[index] = (UINT8) (val & 0x0F);
438       cinfo->arith_dc_U[index] = (UINT8) (val >> 4);
439       if (cinfo->arith_dc_L[index] > cinfo->arith_dc_U[index])
440 	ERREXIT1(cinfo, JERR_DAC_VALUE, val);
441     }
442   }
443 
444   if (length != 0)
445     ERREXIT(cinfo, JERR_BAD_LENGTH);
446 
447   INPUT_SYNC(cinfo);
448   return TRUE;
449 }
450 
451 #else /* ! D_ARITH_CODING_SUPPORTED */
452 
453 #define get_dac(cinfo)  skip_variable(cinfo)
454 
455 #endif /* D_ARITH_CODING_SUPPORTED */
456 
457 
458 LOCAL(boolean)
459 get_dht (j_decompress_ptr cinfo)
460 /* Process a DHT marker */
461 {
462   INT32 length;
463   UINT8 bits[17];
464   UINT8 huffval[256];
465   int i, index, count;
466   JHUFF_TBL **htblptr;
467   INPUT_VARS(cinfo);
468 
469   INPUT_2BYTES(cinfo, length, return FALSE);
470   length -= 2;
471 
472   while (length > 16) {
473     INPUT_BYTE(cinfo, index, return FALSE);
474 
475     TRACEMS1(cinfo, 1, JTRC_DHT, index);
476 
477     bits[0] = 0;
478     count = 0;
479     for (i = 1; i <= 16; i++) {
480       INPUT_BYTE(cinfo, bits[i], return FALSE);
481       count += bits[i];
482     }
483 
484     length -= 1 + 16;
485 
486     TRACEMS8(cinfo, 2, JTRC_HUFFBITS,
487 	     bits[1], bits[2], bits[3], bits[4],
488 	     bits[5], bits[6], bits[7], bits[8]);
489     TRACEMS8(cinfo, 2, JTRC_HUFFBITS,
490 	     bits[9], bits[10], bits[11], bits[12],
491 	     bits[13], bits[14], bits[15], bits[16]);
492 
493     /* Here we just do minimal validation of the counts to avoid walking
494      * off the end of our table space.  jdhuff.c will check more carefully.
495      */
496     if (count > 256 || ((INT32) count) > length)
497       ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
498 
499     MEMZERO(huffval, SIZEOF(huffval)); /* pre-zero array for later copy */
500 
501     for (i = 0; i < count; i++)
502       INPUT_BYTE(cinfo, huffval[i], return FALSE);
503 
504     length -= count;
505 
506     if (index & 0x10) {		/* AC table definition */
507       index -= 0x10;
508       htblptr = &cinfo->ac_huff_tbl_ptrs[index];
509     } else {			/* DC table definition */
510       htblptr = &cinfo->dc_huff_tbl_ptrs[index];
511     }
512 
513     if (index < 0 || index >= NUM_HUFF_TBLS)
514       ERREXIT1(cinfo, JERR_DHT_INDEX, index);
515 
516     if (*htblptr == NULL)
517       *htblptr = jpeg_alloc_huff_table((j_common_ptr) cinfo);
518 
519     MEMCOPY((*htblptr)->bits, bits, SIZEOF((*htblptr)->bits));
520     MEMCOPY((*htblptr)->huffval, huffval, SIZEOF((*htblptr)->huffval));
521   }
522 
523   if (length != 0)
524     ERREXIT(cinfo, JERR_BAD_LENGTH);
525 
526   INPUT_SYNC(cinfo);
527   return TRUE;
528 }
529 
530 
531 LOCAL(boolean)
532 get_dqt (j_decompress_ptr cinfo)
533 /* Process a DQT marker */
534 {
535   INT32 length, count, i;
536   int n, prec;
537   unsigned int tmp;
538   JQUANT_TBL *quant_ptr;
539   const int *natural_order;
540   INPUT_VARS(cinfo);
541 
542   INPUT_2BYTES(cinfo, length, return FALSE);
543   length -= 2;
544 
545   while (length > 0) {
546     length--;
547     INPUT_BYTE(cinfo, n, return FALSE);
548     prec = n >> 4;
549     n &= 0x0F;
550 
551     TRACEMS2(cinfo, 1, JTRC_DQT, n, prec);
552 
553     if (n >= NUM_QUANT_TBLS)
554       ERREXIT1(cinfo, JERR_DQT_INDEX, n);
555 
556     if (cinfo->quant_tbl_ptrs[n] == NULL)
557       cinfo->quant_tbl_ptrs[n] = jpeg_alloc_quant_table((j_common_ptr) cinfo);
558     quant_ptr = cinfo->quant_tbl_ptrs[n];
559 
560     if (prec) {
561       if (length < DCTSIZE2 * 2) {
562 	/* Initialize full table for safety. */
563 	for (i = 0; i < DCTSIZE2; i++) {
564 	  quant_ptr->quantval[i] = 1;
565 	}
566 	count = length >> 1;
567       } else
568 	count = DCTSIZE2;
569     } else {
570       if (length < DCTSIZE2) {
571 	/* Initialize full table for safety. */
572 	for (i = 0; i < DCTSIZE2; i++) {
573 	  quant_ptr->quantval[i] = 1;
574 	}
575 	count = length;
576       } else
577 	count = DCTSIZE2;
578     }
579 
580     switch (count) {
581     case (2*2): natural_order = jpeg_natural_order2; break;
582     case (3*3): natural_order = jpeg_natural_order3; break;
583     case (4*4): natural_order = jpeg_natural_order4; break;
584     case (5*5): natural_order = jpeg_natural_order5; break;
585     case (6*6): natural_order = jpeg_natural_order6; break;
586     case (7*7): natural_order = jpeg_natural_order7; break;
587     default:    natural_order = jpeg_natural_order;  break;
588     }
589 
590     for (i = 0; i < count; i++) {
591       if (prec)
592 	INPUT_2BYTES(cinfo, tmp, return FALSE);
593       else
594 	INPUT_BYTE(cinfo, tmp, return FALSE);
595       /* We convert the zigzag-order table to natural array order. */
596       quant_ptr->quantval[natural_order[i]] = (UINT16) tmp;
597     }
598 
599     if (cinfo->err->trace_level >= 2) {
600       for (i = 0; i < DCTSIZE2; i += 8) {
601 	TRACEMS8(cinfo, 2, JTRC_QUANTVALS,
602 		 quant_ptr->quantval[i],   quant_ptr->quantval[i+1],
603 		 quant_ptr->quantval[i+2], quant_ptr->quantval[i+3],
604 		 quant_ptr->quantval[i+4], quant_ptr->quantval[i+5],
605 		 quant_ptr->quantval[i+6], quant_ptr->quantval[i+7]);
606       }
607     }
608 
609     length -= count;
610     if (prec) length -= count;
611   }
612 
613   if (length != 0)
614     ERREXIT(cinfo, JERR_BAD_LENGTH);
615 
616   INPUT_SYNC(cinfo);
617   return TRUE;
618 }
619 
620 
621 LOCAL(boolean)
622 get_dri (j_decompress_ptr cinfo)
623 /* Process a DRI marker */
624 {
625   INT32 length;
626   unsigned int tmp;
627   INPUT_VARS(cinfo);
628 
629   INPUT_2BYTES(cinfo, length, return FALSE);
630 
631   if (length != 4)
632     ERREXIT(cinfo, JERR_BAD_LENGTH);
633 
634   INPUT_2BYTES(cinfo, tmp, return FALSE);
635 
636   TRACEMS1(cinfo, 1, JTRC_DRI, tmp);
637 
638   cinfo->restart_interval = tmp;
639 
640   INPUT_SYNC(cinfo);
641   return TRUE;
642 }
643 
644 
645 LOCAL(boolean)
646 get_lse (j_decompress_ptr cinfo)
647 /* Process an LSE marker */
648 {
649   INT32 length;
650   unsigned int tmp;
651   int cid;
652   INPUT_VARS(cinfo);
653 
654   if (! cinfo->marker->saw_SOF)
655     ERREXITS(cinfo, JERR_SOF_BEFORE, "LSE");
656 
657   if (cinfo->num_components < 3) goto bad;
658 
659   INPUT_2BYTES(cinfo, length, return FALSE);
660 
661   if (length != 24)
662     ERREXIT(cinfo, JERR_BAD_LENGTH);
663 
664   INPUT_BYTE(cinfo, tmp, return FALSE);
665   if (tmp != 0x0D)	/* ID inverse transform specification */
666     ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
667   INPUT_2BYTES(cinfo, tmp, return FALSE);
668   if (tmp != MAXJSAMPLE) goto bad;		/* MAXTRANS */
669   INPUT_BYTE(cinfo, tmp, return FALSE);
670   if (tmp != 3) goto bad;			/* Nt=3 */
671   INPUT_BYTE(cinfo, cid, return FALSE);
672   if (cid != cinfo->comp_info[1].component_id) goto bad;
673   INPUT_BYTE(cinfo, cid, return FALSE);
674   if (cid != cinfo->comp_info[0].component_id) goto bad;
675   INPUT_BYTE(cinfo, cid, return FALSE);
676   if (cid != cinfo->comp_info[2].component_id) goto bad;
677   INPUT_BYTE(cinfo, tmp, return FALSE);
678   if (tmp != 0x80) goto bad;		/* F1: CENTER1=1, NORM1=0 */
679   INPUT_2BYTES(cinfo, tmp, return FALSE);
680   if (tmp != 0) goto bad;			/* A(1,1)=0 */
681   INPUT_2BYTES(cinfo, tmp, return FALSE);
682   if (tmp != 0) goto bad;			/* A(1,2)=0 */
683   INPUT_BYTE(cinfo, tmp, return FALSE);
684   if (tmp != 0) goto bad;		/* F2: CENTER2=0, NORM2=0 */
685   INPUT_2BYTES(cinfo, tmp, return FALSE);
686   if (tmp != 1) goto bad;			/* A(2,1)=1 */
687   INPUT_2BYTES(cinfo, tmp, return FALSE);
688   if (tmp != 0) goto bad;			/* A(2,2)=0 */
689   INPUT_BYTE(cinfo, tmp, return FALSE);
690   if (tmp != 0) goto bad;		/* F3: CENTER3=0, NORM3=0 */
691   INPUT_2BYTES(cinfo, tmp, return FALSE);
692   if (tmp != 1) goto bad;			/* A(3,1)=1 */
693   INPUT_2BYTES(cinfo, tmp, return FALSE);
694   if (tmp != 0) {				/* A(3,2)=0 */
695     bad:
696     ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
697   }
698 
699   /* OK, valid transform that we can handle. */
700   cinfo->color_transform = JCT_SUBTRACT_GREEN;
701 
702   INPUT_SYNC(cinfo);
703   return TRUE;
704 }
705 
706 
707 /*
708  * Routines for processing APPn and COM markers.
709  * These are either saved in memory or discarded, per application request.
710  * APP0 and APP14 are specially checked to see if they are
711  * JFIF and Adobe markers, respectively.
712  */
713 
714 #define APP0_DATA_LEN	14	/* Length of interesting data in APP0 */
715 #define APP14_DATA_LEN	12	/* Length of interesting data in APP14 */
716 #define APPN_DATA_LEN	14	/* Must be the largest of the above!! */
717 
718 
719 LOCAL(void)
720 examine_app0 (j_decompress_ptr cinfo, JOCTET FAR * data,
721 	      unsigned int datalen, INT32 remaining)
722 /* Examine first few bytes from an APP0.
723  * Take appropriate action if it is a JFIF marker.
724  * datalen is # of bytes at data[], remaining is length of rest of marker data.
725  */
726 {
727   INT32 totallen = (INT32) datalen + remaining;
728 
729   if (datalen >= APP0_DATA_LEN &&
730       GETJOCTET(data[0]) == 0x4A &&
731       GETJOCTET(data[1]) == 0x46 &&
732       GETJOCTET(data[2]) == 0x49 &&
733       GETJOCTET(data[3]) == 0x46 &&
734       GETJOCTET(data[4]) == 0) {
735     /* Found JFIF APP0 marker: save info */
736     cinfo->saw_JFIF_marker = TRUE;
737     cinfo->JFIF_major_version = GETJOCTET(data[5]);
738     cinfo->JFIF_minor_version = GETJOCTET(data[6]);
739     cinfo->density_unit = GETJOCTET(data[7]);
740     cinfo->X_density = (GETJOCTET(data[8]) << 8) + GETJOCTET(data[9]);
741     cinfo->Y_density = (GETJOCTET(data[10]) << 8) + GETJOCTET(data[11]);
742     /* Check version.
743      * Major version must be 1 or 2, anything else signals an incompatible
744      * change.
745      * (We used to treat this as an error, but now it's a nonfatal warning,
746      * because some bozo at Hijaak couldn't read the spec.)
747      * Minor version should be 0..2, but process anyway if newer.
748      */
749     if (cinfo->JFIF_major_version != 1 && cinfo->JFIF_major_version != 2)
750       WARNMS2(cinfo, JWRN_JFIF_MAJOR,
751 	      cinfo->JFIF_major_version, cinfo->JFIF_minor_version);
752     /* Generate trace messages */
753     TRACEMS5(cinfo, 1, JTRC_JFIF,
754 	     cinfo->JFIF_major_version, cinfo->JFIF_minor_version,
755 	     cinfo->X_density, cinfo->Y_density, cinfo->density_unit);
756     /* Validate thumbnail dimensions and issue appropriate messages */
757     if (GETJOCTET(data[12]) | GETJOCTET(data[13]))
758       TRACEMS2(cinfo, 1, JTRC_JFIF_THUMBNAIL,
759 	       GETJOCTET(data[12]), GETJOCTET(data[13]));
760     totallen -= APP0_DATA_LEN;
761     if (totallen !=
762 	((INT32)GETJOCTET(data[12]) * (INT32)GETJOCTET(data[13]) * (INT32) 3))
763       TRACEMS1(cinfo, 1, JTRC_JFIF_BADTHUMBNAILSIZE, (int) totallen);
764   } else if (datalen >= 6 &&
765       GETJOCTET(data[0]) == 0x4A &&
766       GETJOCTET(data[1]) == 0x46 &&
767       GETJOCTET(data[2]) == 0x58 &&
768       GETJOCTET(data[3]) == 0x58 &&
769       GETJOCTET(data[4]) == 0) {
770     /* Found JFIF "JFXX" extension APP0 marker */
771     /* The library doesn't actually do anything with these,
772      * but we try to produce a helpful trace message.
773      */
774     switch (GETJOCTET(data[5])) {
775     case 0x10:
776       TRACEMS1(cinfo, 1, JTRC_THUMB_JPEG, (int) totallen);
777       break;
778     case 0x11:
779       TRACEMS1(cinfo, 1, JTRC_THUMB_PALETTE, (int) totallen);
780       break;
781     case 0x13:
782       TRACEMS1(cinfo, 1, JTRC_THUMB_RGB, (int) totallen);
783       break;
784     default:
785       TRACEMS2(cinfo, 1, JTRC_JFIF_EXTENSION,
786 	       GETJOCTET(data[5]), (int) totallen);
787       break;
788     }
789   } else {
790     /* Start of APP0 does not match "JFIF" or "JFXX", or too short */
791     TRACEMS1(cinfo, 1, JTRC_APP0, (int) totallen);
792   }
793 }
794 
795 
796 LOCAL(void)
797 examine_app14 (j_decompress_ptr cinfo, JOCTET FAR * data,
798 	       unsigned int datalen, INT32 remaining)
799 /* Examine first few bytes from an APP14.
800  * Take appropriate action if it is an Adobe marker.
801  * datalen is # of bytes at data[], remaining is length of rest of marker data.
802  */
803 {
804   unsigned int version, flags0, flags1, transform;
805 
806   if (datalen >= APP14_DATA_LEN &&
807       GETJOCTET(data[0]) == 0x41 &&
808       GETJOCTET(data[1]) == 0x64 &&
809       GETJOCTET(data[2]) == 0x6F &&
810       GETJOCTET(data[3]) == 0x62 &&
811       GETJOCTET(data[4]) == 0x65) {
812     /* Found Adobe APP14 marker */
813     version = (GETJOCTET(data[5]) << 8) + GETJOCTET(data[6]);
814     flags0 = (GETJOCTET(data[7]) << 8) + GETJOCTET(data[8]);
815     flags1 = (GETJOCTET(data[9]) << 8) + GETJOCTET(data[10]);
816     transform = GETJOCTET(data[11]);
817     TRACEMS4(cinfo, 1, JTRC_ADOBE, version, flags0, flags1, transform);
818     cinfo->saw_Adobe_marker = TRUE;
819     cinfo->Adobe_transform = (UINT8) transform;
820   } else {
821     /* Start of APP14 does not match "Adobe", or too short */
822     TRACEMS1(cinfo, 1, JTRC_APP14, (int) (datalen + remaining));
823   }
824 }
825 
826 
827 METHODDEF(boolean)
828 get_interesting_appn (j_decompress_ptr cinfo)
829 /* Process an APP0 or APP14 marker without saving it */
830 {
831   INT32 length;
832   JOCTET b[APPN_DATA_LEN];
833   unsigned int i, numtoread;
834   INPUT_VARS(cinfo);
835 
836   INPUT_2BYTES(cinfo, length, return FALSE);
837   length -= 2;
838 
839   /* get the interesting part of the marker data */
840   if (length >= APPN_DATA_LEN)
841     numtoread = APPN_DATA_LEN;
842   else if (length > 0)
843     numtoread = (unsigned int) length;
844   else
845     numtoread = 0;
846   for (i = 0; i < numtoread; i++)
847     INPUT_BYTE(cinfo, b[i], return FALSE);
848   length -= numtoread;
849 
850   /* process it */
851   switch (cinfo->unread_marker) {
852   case M_APP0:
853     examine_app0(cinfo, (JOCTET FAR *) b, numtoread, length);
854     break;
855   case M_APP14:
856     examine_app14(cinfo, (JOCTET FAR *) b, numtoread, length);
857     break;
858   default:
859     /* can't get here unless jpeg_save_markers chooses wrong processor */
860     ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
861     break;
862   }
863 
864   /* skip any remaining data -- could be lots */
865   INPUT_SYNC(cinfo);
866   if (length > 0)
867     (*cinfo->src->skip_input_data) (cinfo, (long) length);
868 
869   return TRUE;
870 }
871 
872 
873 #ifdef SAVE_MARKERS_SUPPORTED
874 
875 METHODDEF(boolean)
876 save_marker (j_decompress_ptr cinfo)
877 /* Save an APPn or COM marker into the marker list */
878 {
879   my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
880   jpeg_saved_marker_ptr cur_marker = marker->cur_marker;
881   unsigned int bytes_read, data_length;
882   JOCTET FAR * data;
883   INT32 length = 0;
884   INPUT_VARS(cinfo);
885 
886   if (cur_marker == NULL) {
887     /* begin reading a marker */
888     INPUT_2BYTES(cinfo, length, return FALSE);
889     length -= 2;
890     if (length >= 0) {		/* watch out for bogus length word */
891       /* figure out how much we want to save */
892       unsigned int limit;
893       if (cinfo->unread_marker == (int) M_COM)
894 	limit = marker->length_limit_COM;
895       else
896 	limit = marker->length_limit_APPn[cinfo->unread_marker - (int) M_APP0];
897       if ((unsigned int) length < limit)
898 	limit = (unsigned int) length;
899       /* allocate and initialize the marker item */
900       cur_marker = (jpeg_saved_marker_ptr)
901 	(*cinfo->mem->alloc_large) ((j_common_ptr) cinfo, JPOOL_IMAGE,
902 				    SIZEOF(struct jpeg_marker_struct) + limit);
903       cur_marker->next = NULL;
904       cur_marker->marker = (UINT8) cinfo->unread_marker;
905       cur_marker->original_length = (unsigned int) length;
906       cur_marker->data_length = limit;
907       /* data area is just beyond the jpeg_marker_struct */
908       data = cur_marker->data = (JOCTET FAR *) (cur_marker + 1);
909       marker->cur_marker = cur_marker;
910       marker->bytes_read = 0;
911       bytes_read = 0;
912       data_length = limit;
913     } else {
914       /* deal with bogus length word */
915       bytes_read = data_length = 0;
916       data = NULL;
917     }
918   } else {
919     /* resume reading a marker */
920     bytes_read = marker->bytes_read;
921     data_length = cur_marker->data_length;
922     data = cur_marker->data + bytes_read;
923   }
924 
925   while (bytes_read < data_length) {
926     INPUT_SYNC(cinfo);		/* move the restart point to here */
927     marker->bytes_read = bytes_read;
928     /* If there's not at least one byte in buffer, suspend */
929     MAKE_BYTE_AVAIL(cinfo, return FALSE);
930     /* Copy bytes with reasonable rapidity */
931     while (bytes_read < data_length && bytes_in_buffer > 0) {
932       *data++ = *next_input_byte++;
933       bytes_in_buffer--;
934       bytes_read++;
935     }
936   }
937 
938   /* Done reading what we want to read */
939   if (cur_marker != NULL) {	/* will be NULL if bogus length word */
940     /* Add new marker to end of list */
941     if (cinfo->marker_list == NULL) {
942       cinfo->marker_list = cur_marker;
943     } else {
944       jpeg_saved_marker_ptr prev = cinfo->marker_list;
945       while (prev->next != NULL)
946 	prev = prev->next;
947       prev->next = cur_marker;
948     }
949     /* Reset pointer & calc remaining data length */
950     data = cur_marker->data;
951     length = cur_marker->original_length - data_length;
952   }
953   /* Reset to initial state for next marker */
954   marker->cur_marker = NULL;
955 
956   /* Process the marker if interesting; else just make a generic trace msg */
957   switch (cinfo->unread_marker) {
958   case M_APP0:
959     examine_app0(cinfo, data, data_length, length);
960     break;
961   case M_APP14:
962     examine_app14(cinfo, data, data_length, length);
963     break;
964   default:
965     TRACEMS2(cinfo, 1, JTRC_MISC_MARKER, cinfo->unread_marker,
966 	     (int) (data_length + length));
967     break;
968   }
969 
970   /* skip any remaining data -- could be lots */
971   INPUT_SYNC(cinfo);		/* do before skip_input_data */
972   if (length > 0)
973     (*cinfo->src->skip_input_data) (cinfo, (long) length);
974 
975   return TRUE;
976 }
977 
978 #endif /* SAVE_MARKERS_SUPPORTED */
979 
980 
981 METHODDEF(boolean)
982 skip_variable (j_decompress_ptr cinfo)
983 /* Skip over an unknown or uninteresting variable-length marker */
984 {
985   INT32 length;
986   INPUT_VARS(cinfo);
987 
988   INPUT_2BYTES(cinfo, length, return FALSE);
989   length -= 2;
990 
991   TRACEMS2(cinfo, 1, JTRC_MISC_MARKER, cinfo->unread_marker, (int) length);
992 
993   INPUT_SYNC(cinfo);		/* do before skip_input_data */
994   if (length > 0)
995     (*cinfo->src->skip_input_data) (cinfo, (long) length);
996 
997   return TRUE;
998 }
999 
1000 
1001 /*
1002  * Find the next JPEG marker, save it in cinfo->unread_marker.
1003  * Returns FALSE if had to suspend before reaching a marker;
1004  * in that case cinfo->unread_marker is unchanged.
1005  *
1006  * Note that the result might not be a valid marker code,
1007  * but it will never be 0 or FF.
1008  */
1009 
1010 LOCAL(boolean)
1011 next_marker (j_decompress_ptr cinfo)
1012 {
1013   int c;
1014   INPUT_VARS(cinfo);
1015 
1016   for (;;) {
1017     INPUT_BYTE(cinfo, c, return FALSE);
1018     /* Skip any non-FF bytes.
1019      * This may look a bit inefficient, but it will not occur in a valid file.
1020      * We sync after each discarded byte so that a suspending data source
1021      * can discard the byte from its buffer.
1022      */
1023     while (c != 0xFF) {
1024       cinfo->marker->discarded_bytes++;
1025       INPUT_SYNC(cinfo);
1026       INPUT_BYTE(cinfo, c, return FALSE);
1027     }
1028     /* This loop swallows any duplicate FF bytes.  Extra FFs are legal as
1029      * pad bytes, so don't count them in discarded_bytes.  We assume there
1030      * will not be so many consecutive FF bytes as to overflow a suspending
1031      * data source's input buffer.
1032      */
1033     do {
1034       INPUT_BYTE(cinfo, c, return FALSE);
1035     } while (c == 0xFF);
1036     if (c != 0)
1037       break;			/* found a valid marker, exit loop */
1038     /* Reach here if we found a stuffed-zero data sequence (FF/00).
1039      * Discard it and loop back to try again.
1040      */
1041     cinfo->marker->discarded_bytes += 2;
1042     INPUT_SYNC(cinfo);
1043   }
1044 
1045   if (cinfo->marker->discarded_bytes != 0) {
1046     WARNMS2(cinfo, JWRN_EXTRANEOUS_DATA, cinfo->marker->discarded_bytes, c);
1047     cinfo->marker->discarded_bytes = 0;
1048   }
1049 
1050   cinfo->unread_marker = c;
1051 
1052   INPUT_SYNC(cinfo);
1053   return TRUE;
1054 }
1055 
1056 
1057 LOCAL(boolean)
1058 first_marker (j_decompress_ptr cinfo)
1059 /* Like next_marker, but used to obtain the initial SOI marker. */
1060 /* For this marker, we do not allow preceding garbage or fill; otherwise,
1061  * we might well scan an entire input file before realizing it ain't JPEG.
1062  * If an application wants to process non-JFIF files, it must seek to the
1063  * SOI before calling the JPEG library.
1064  */
1065 {
1066   int c, c2;
1067   INPUT_VARS(cinfo);
1068 
1069   INPUT_BYTE(cinfo, c, return FALSE);
1070   INPUT_BYTE(cinfo, c2, return FALSE);
1071   if (c != 0xFF || c2 != (int) M_SOI)
1072     ERREXIT2(cinfo, JERR_NO_SOI, c, c2);
1073 
1074   cinfo->unread_marker = c2;
1075 
1076   INPUT_SYNC(cinfo);
1077   return TRUE;
1078 }
1079 
1080 
1081 /*
1082  * Read markers until SOS or EOI.
1083  *
1084  * Returns same codes as are defined for jpeg_consume_input:
1085  * JPEG_SUSPENDED, JPEG_REACHED_SOS, or JPEG_REACHED_EOI.
1086  *
1087  * Note: This function may return a pseudo SOS marker (with zero
1088  * component number) for treat by input controller's consume_input.
1089  * consume_input itself should filter out (skip) the pseudo marker
1090  * after processing for the caller.
1091  */
1092 
1093 METHODDEF(int)
1094 read_markers (j_decompress_ptr cinfo)
1095 {
1096   /* Outer loop repeats once for each marker. */
1097   for (;;) {
1098     /* Collect the marker proper, unless we already did. */
1099     /* NB: first_marker() enforces the requirement that SOI appear first. */
1100     if (cinfo->unread_marker == 0) {
1101       if (! cinfo->marker->saw_SOI) {
1102 	if (! first_marker(cinfo))
1103 	  return JPEG_SUSPENDED;
1104       } else {
1105 	if (! next_marker(cinfo))
1106 	  return JPEG_SUSPENDED;
1107       }
1108     }
1109     /* At this point cinfo->unread_marker contains the marker code and the
1110      * input point is just past the marker proper, but before any parameters.
1111      * A suspension will cause us to return with this state still true.
1112      */
1113     switch (cinfo->unread_marker) {
1114     case M_SOI:
1115       if (! get_soi(cinfo))
1116 	return JPEG_SUSPENDED;
1117       break;
1118 
1119     case M_SOF0:		/* Baseline */
1120       if (! get_sof(cinfo, TRUE, FALSE, FALSE))
1121 	return JPEG_SUSPENDED;
1122       break;
1123 
1124     case M_SOF1:		/* Extended sequential, Huffman */
1125       if (! get_sof(cinfo, FALSE, FALSE, FALSE))
1126 	return JPEG_SUSPENDED;
1127       break;
1128 
1129     case M_SOF2:		/* Progressive, Huffman */
1130       if (! get_sof(cinfo, FALSE, TRUE, FALSE))
1131 	return JPEG_SUSPENDED;
1132       break;
1133 
1134     case M_SOF9:		/* Extended sequential, arithmetic */
1135       if (! get_sof(cinfo, FALSE, FALSE, TRUE))
1136 	return JPEG_SUSPENDED;
1137       break;
1138 
1139     case M_SOF10:		/* Progressive, arithmetic */
1140       if (! get_sof(cinfo, FALSE, TRUE, TRUE))
1141 	return JPEG_SUSPENDED;
1142       break;
1143 
1144     /* Currently unsupported SOFn types */
1145     case M_SOF3:		/* Lossless, Huffman */
1146     case M_SOF5:		/* Differential sequential, Huffman */
1147     case M_SOF6:		/* Differential progressive, Huffman */
1148     case M_SOF7:		/* Differential lossless, Huffman */
1149     case M_JPG:			/* Reserved for JPEG extensions */
1150     case M_SOF11:		/* Lossless, arithmetic */
1151     case M_SOF13:		/* Differential sequential, arithmetic */
1152     case M_SOF14:		/* Differential progressive, arithmetic */
1153     case M_SOF15:		/* Differential lossless, arithmetic */
1154       ERREXIT1(cinfo, JERR_SOF_UNSUPPORTED, cinfo->unread_marker);
1155       break;
1156 
1157     case M_SOS:
1158       if (! get_sos(cinfo))
1159 	return JPEG_SUSPENDED;
1160       cinfo->unread_marker = 0;	/* processed the marker */
1161       return JPEG_REACHED_SOS;
1162 
1163     case M_EOI:
1164       TRACEMS(cinfo, 1, JTRC_EOI);
1165       cinfo->unread_marker = 0;	/* processed the marker */
1166       return JPEG_REACHED_EOI;
1167 
1168     case M_DAC:
1169       if (! get_dac(cinfo))
1170 	return JPEG_SUSPENDED;
1171       break;
1172 
1173     case M_DHT:
1174       if (! get_dht(cinfo))
1175 	return JPEG_SUSPENDED;
1176       break;
1177 
1178     case M_DQT:
1179       if (! get_dqt(cinfo))
1180 	return JPEG_SUSPENDED;
1181       break;
1182 
1183     case M_DRI:
1184       if (! get_dri(cinfo))
1185 	return JPEG_SUSPENDED;
1186       break;
1187 
1188     case M_JPG8:
1189       if (! get_lse(cinfo))
1190 	return JPEG_SUSPENDED;
1191       break;
1192 
1193     case M_APP0:
1194     case M_APP1:
1195     case M_APP2:
1196     case M_APP3:
1197     case M_APP4:
1198     case M_APP5:
1199     case M_APP6:
1200     case M_APP7:
1201     case M_APP8:
1202     case M_APP9:
1203     case M_APP10:
1204     case M_APP11:
1205     case M_APP12:
1206     case M_APP13:
1207     case M_APP14:
1208     case M_APP15:
1209       if (! (*((my_marker_ptr) cinfo->marker)->process_APPn[
1210 		cinfo->unread_marker - (int) M_APP0]) (cinfo))
1211 	return JPEG_SUSPENDED;
1212       break;
1213 
1214     case M_COM:
1215       if (! (*((my_marker_ptr) cinfo->marker)->process_COM) (cinfo))
1216 	return JPEG_SUSPENDED;
1217       break;
1218 
1219     case M_RST0:		/* these are all parameterless */
1220     case M_RST1:
1221     case M_RST2:
1222     case M_RST3:
1223     case M_RST4:
1224     case M_RST5:
1225     case M_RST6:
1226     case M_RST7:
1227     case M_TEM:
1228       TRACEMS1(cinfo, 1, JTRC_PARMLESS_MARKER, cinfo->unread_marker);
1229       break;
1230 
1231     case M_DNL:			/* Ignore DNL ... perhaps the wrong thing */
1232       if (! skip_variable(cinfo))
1233 	return JPEG_SUSPENDED;
1234       break;
1235 
1236     default:			/* must be DHP, EXP, JPGn, or RESn */
1237       /* For now, we treat the reserved markers as fatal errors since they are
1238        * likely to be used to signal incompatible JPEG Part 3 extensions.
1239        * Once the JPEG 3 version-number marker is well defined, this code
1240        * ought to change!
1241        */
1242       ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
1243       break;
1244     }
1245     /* Successfully processed marker, so reset state variable */
1246     cinfo->unread_marker = 0;
1247   } /* end loop */
1248 }
1249 
1250 
1251 /*
1252  * Read a restart marker, which is expected to appear next in the datastream;
1253  * if the marker is not there, take appropriate recovery action.
1254  * Returns FALSE if suspension is required.
1255  *
1256  * This is called by the entropy decoder after it has read an appropriate
1257  * number of MCUs.  cinfo->unread_marker may be nonzero if the entropy decoder
1258  * has already read a marker from the data source.  Under normal conditions
1259  * cinfo->unread_marker will be reset to 0 before returning; if not reset,
1260  * it holds a marker which the decoder will be unable to read past.
1261  */
1262 
1263 METHODDEF(boolean)
1264 read_restart_marker (j_decompress_ptr cinfo)
1265 {
1266   /* Obtain a marker unless we already did. */
1267   /* Note that next_marker will complain if it skips any data. */
1268   if (cinfo->unread_marker == 0) {
1269     if (! next_marker(cinfo))
1270       return FALSE;
1271   }
1272 
1273   if (cinfo->unread_marker ==
1274       ((int) M_RST0 + cinfo->marker->next_restart_num)) {
1275     /* Normal case --- swallow the marker and let entropy decoder continue */
1276     TRACEMS1(cinfo, 3, JTRC_RST, cinfo->marker->next_restart_num);
1277     cinfo->unread_marker = 0;
1278   } else {
1279     /* Uh-oh, the restart markers have been messed up. */
1280     /* Let the data source manager determine how to resync. */
1281     if (! (*cinfo->src->resync_to_restart) (cinfo,
1282 					    cinfo->marker->next_restart_num))
1283       return FALSE;
1284   }
1285 
1286   /* Update next-restart state */
1287   cinfo->marker->next_restart_num = (cinfo->marker->next_restart_num + 1) & 7;
1288 
1289   return TRUE;
1290 }
1291 
1292 
1293 /*
1294  * This is the default resync_to_restart method for data source managers
1295  * to use if they don't have any better approach.  Some data source managers
1296  * may be able to back up, or may have additional knowledge about the data
1297  * which permits a more intelligent recovery strategy; such managers would
1298  * presumably supply their own resync method.
1299  *
1300  * read_restart_marker calls resync_to_restart if it finds a marker other than
1301  * the restart marker it was expecting.  (This code is *not* used unless
1302  * a nonzero restart interval has been declared.)  cinfo->unread_marker is
1303  * the marker code actually found (might be anything, except 0 or FF).
1304  * The desired restart marker number (0..7) is passed as a parameter.
1305  * This routine is supposed to apply whatever error recovery strategy seems
1306  * appropriate in order to position the input stream to the next data segment.
1307  * Note that cinfo->unread_marker is treated as a marker appearing before
1308  * the current data-source input point; usually it should be reset to zero
1309  * before returning.
1310  * Returns FALSE if suspension is required.
1311  *
1312  * This implementation is substantially constrained by wanting to treat the
1313  * input as a data stream; this means we can't back up.  Therefore, we have
1314  * only the following actions to work with:
1315  *   1. Simply discard the marker and let the entropy decoder resume at next
1316  *      byte of file.
1317  *   2. Read forward until we find another marker, discarding intervening
1318  *      data.  (In theory we could look ahead within the current bufferload,
1319  *      without having to discard data if we don't find the desired marker.
1320  *      This idea is not implemented here, in part because it makes behavior
1321  *      dependent on buffer size and chance buffer-boundary positions.)
1322  *   3. Leave the marker unread (by failing to zero cinfo->unread_marker).
1323  *      This will cause the entropy decoder to process an empty data segment,
1324  *      inserting dummy zeroes, and then we will reprocess the marker.
1325  *
1326  * #2 is appropriate if we think the desired marker lies ahead, while #3 is
1327  * appropriate if the found marker is a future restart marker (indicating
1328  * that we have missed the desired restart marker, probably because it got
1329  * corrupted).
1330  * We apply #2 or #3 if the found marker is a restart marker no more than
1331  * two counts behind or ahead of the expected one.  We also apply #2 if the
1332  * found marker is not a legal JPEG marker code (it's certainly bogus data).
1333  * If the found marker is a restart marker more than 2 counts away, we do #1
1334  * (too much risk that the marker is erroneous; with luck we will be able to
1335  * resync at some future point).
1336  * For any valid non-restart JPEG marker, we apply #3.  This keeps us from
1337  * overrunning the end of a scan.  An implementation limited to single-scan
1338  * files might find it better to apply #2 for markers other than EOI, since
1339  * any other marker would have to be bogus data in that case.
1340  */
1341 
1342 GLOBAL(boolean)
1343 jpeg_resync_to_restart (j_decompress_ptr cinfo, int desired)
1344 {
1345   int marker = cinfo->unread_marker;
1346   int action = 1;
1347 
1348   /* Always put up a warning. */
1349   WARNMS2(cinfo, JWRN_MUST_RESYNC, marker, desired);
1350 
1351   /* Outer loop handles repeated decision after scanning forward. */
1352   for (;;) {
1353     if (marker < (int) M_SOF0)
1354       action = 2;		/* invalid marker */
1355     else if (marker < (int) M_RST0 || marker > (int) M_RST7)
1356       action = 3;		/* valid non-restart marker */
1357     else {
1358       if (marker == ((int) M_RST0 + ((desired+1) & 7)) ||
1359 	  marker == ((int) M_RST0 + ((desired+2) & 7)))
1360 	action = 3;		/* one of the next two expected restarts */
1361       else if (marker == ((int) M_RST0 + ((desired-1) & 7)) ||
1362 	       marker == ((int) M_RST0 + ((desired-2) & 7)))
1363 	action = 2;		/* a prior restart, so advance */
1364       else
1365 	action = 1;		/* desired restart or too far away */
1366     }
1367     TRACEMS2(cinfo, 4, JTRC_RECOVERY_ACTION, marker, action);
1368     switch (action) {
1369     case 1:
1370       /* Discard marker and let entropy decoder resume processing. */
1371       cinfo->unread_marker = 0;
1372       return TRUE;
1373     case 2:
1374       /* Scan to the next marker, and repeat the decision loop. */
1375       if (! next_marker(cinfo))
1376 	return FALSE;
1377       marker = cinfo->unread_marker;
1378       break;
1379     case 3:
1380       /* Return without advancing past this marker. */
1381       /* Entropy decoder will be forced to process an empty segment. */
1382       return TRUE;
1383     }
1384   } /* end loop */
1385 }
1386 
1387 
1388 /*
1389  * Reset marker processing state to begin a fresh datastream.
1390  */
1391 
1392 METHODDEF(void)
1393 reset_marker_reader (j_decompress_ptr cinfo)
1394 {
1395   my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
1396 
1397   cinfo->comp_info = NULL;		/* until allocated by get_sof */
1398   cinfo->input_scan_number = 0;		/* no SOS seen yet */
1399   cinfo->unread_marker = 0;		/* no pending marker */
1400   marker->pub.saw_SOI = FALSE;		/* set internal state too */
1401   marker->pub.saw_SOF = FALSE;
1402   marker->pub.discarded_bytes = 0;
1403   marker->cur_marker = NULL;
1404 }
1405 
1406 
1407 /*
1408  * Initialize the marker reader module.
1409  * This is called only once, when the decompression object is created.
1410  */
1411 
1412 GLOBAL(void)
1413 jinit_marker_reader (j_decompress_ptr cinfo)
1414 {
1415   my_marker_ptr marker;
1416   int i;
1417 
1418   /* Create subobject in permanent pool */
1419   marker = (my_marker_ptr)
1420     (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_PERMANENT,
1421 				SIZEOF(my_marker_reader));
1422   cinfo->marker = &marker->pub;
1423   /* Initialize public method pointers */
1424   marker->pub.reset_marker_reader = reset_marker_reader;
1425   marker->pub.read_markers = read_markers;
1426   marker->pub.read_restart_marker = read_restart_marker;
1427   /* Initialize COM/APPn processing.
1428    * By default, we examine and then discard APP0 and APP14,
1429    * but simply discard COM and all other APPn.
1430    */
1431   marker->process_COM = skip_variable;
1432   marker->length_limit_COM = 0;
1433   for (i = 0; i < 16; i++) {
1434     marker->process_APPn[i] = skip_variable;
1435     marker->length_limit_APPn[i] = 0;
1436   }
1437   marker->process_APPn[0] = get_interesting_appn;
1438   marker->process_APPn[14] = get_interesting_appn;
1439   /* Reset marker processing state */
1440   reset_marker_reader(cinfo);
1441 }
1442 
1443 
1444 /*
1445  * Control saving of COM and APPn markers into marker_list.
1446  */
1447 
1448 #ifdef SAVE_MARKERS_SUPPORTED
1449 
1450 GLOBAL(void)
1451 jpeg_save_markers (j_decompress_ptr cinfo, int marker_code,
1452 		   unsigned int length_limit)
1453 {
1454   my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
1455   long maxlength;
1456   jpeg_marker_parser_method processor;
1457 
1458   /* Length limit mustn't be larger than what we can allocate
1459    * (should only be a concern in a 16-bit environment).
1460    */
1461   maxlength = cinfo->mem->max_alloc_chunk - SIZEOF(struct jpeg_marker_struct);
1462   if (((long) length_limit) > maxlength)
1463     length_limit = (unsigned int) maxlength;
1464 
1465   /* Choose processor routine to use.
1466    * APP0/APP14 have special requirements.
1467    */
1468   if (length_limit) {
1469     processor = save_marker;
1470     /* If saving APP0/APP14, save at least enough for our internal use. */
1471     if (marker_code == (int) M_APP0 && length_limit < APP0_DATA_LEN)
1472       length_limit = APP0_DATA_LEN;
1473     else if (marker_code == (int) M_APP14 && length_limit < APP14_DATA_LEN)
1474       length_limit = APP14_DATA_LEN;
1475   } else {
1476     processor = skip_variable;
1477     /* If discarding APP0/APP14, use our regular on-the-fly processor. */
1478     if (marker_code == (int) M_APP0 || marker_code == (int) M_APP14)
1479       processor = get_interesting_appn;
1480   }
1481 
1482   if (marker_code == (int) M_COM) {
1483     marker->process_COM = processor;
1484     marker->length_limit_COM = length_limit;
1485   } else if (marker_code >= (int) M_APP0 && marker_code <= (int) M_APP15) {
1486     marker->process_APPn[marker_code - (int) M_APP0] = processor;
1487     marker->length_limit_APPn[marker_code - (int) M_APP0] = length_limit;
1488   } else
1489     ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
1490 }
1491 
1492 #endif /* SAVE_MARKERS_SUPPORTED */
1493 
1494 
1495 /*
1496  * Install a special processing method for COM or APPn markers.
1497  */
1498 
1499 GLOBAL(void)
1500 jpeg_set_marker_processor (j_decompress_ptr cinfo, int marker_code,
1501 			   jpeg_marker_parser_method routine)
1502 {
1503   my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
1504 
1505   if (marker_code == (int) M_COM)
1506     marker->process_COM = routine;
1507   else if (marker_code >= (int) M_APP0 && marker_code <= (int) M_APP15)
1508     marker->process_APPn[marker_code - (int) M_APP0] = routine;
1509   else
1510     ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
1511 }
1512