7#include "core/fxcodec/jpeg/jpegmodule.h"
16#include "build/build_config.h"
17#include "core/fxcodec/cfx_codec_memory.h"
18#include "core/fxcodec/jpeg/jpeg_common.h"
19#include "core/fxcodec/scanlinedecoder.h"
20#include "core/fxcrt/data_vector.h"
21#include "core/fxcrt/fx_safe_types.h"
22#include "core/fxge/dib/cfx_dibbase.h"
23#include "core/fxge/dib/fx_dib.h"
24#include "third_party/abseil-cpp/absl/types/optional.h"
25#include "third_party/base/check.h"
26#include "third_party/base/check_op.h"
29 pdfium::span<
const uint8_t> src_span) {
30 DCHECK(!src_span.empty());
32 for (size_t offset = 0; offset + 1 < src_span.size(); ++offset) {
33 if (src_span[offset] == 0xff && src_span[offset + 1] == 0xd8)
34 return src_span.subspan(offset);
42 longjmp(*(jmp_buf*)cinfo->client_data, -1);
46 if (num > (
long)cinfo->src->bytes_in_buffer) {
47 error_fatal((j_common_ptr)cinfo);
49 cinfo->src->next_input_byte += num;
50 cinfo->src->bytes_in_buffer -= num;
54static void dest_do_nothing(j_compress_ptr cinfo) {}
56static boolean dest_empty(j_compress_ptr cinfo) {
65 src_span = JpegScanSOI(src_span);
66 jpeg_decompress_struct cinfo;
68 jerr.error_exit = error_fatal;
69 jerr.emit_message = error_do_nothing_int;
70 jerr.output_message = error_do_nothing;
71 jerr.format_message = error_do_nothing_char;
72 jerr.reset_error_mgr = error_do_nothing;
76 cinfo.client_data = &mark;
77 if (setjmp(mark) == -1)
80 jpeg_create_decompress(&cinfo);
82 src.init_source = src_do_nothing;
83 src.term_source = src_do_nothing;
84 src.skip_input_data = src_skip_data;
85 src.fill_input_buffer = src_fill_buffer;
86 src.resync_to_restart = src_resync;
87 src.bytes_in_buffer = src_span.size();
88 src.next_input_byte = src_span.data();
90 if (setjmp(mark) == -1) {
91 jpeg_destroy_decompress(&cinfo);
94 int ret = jpeg_read_header(&cinfo, TRUE);
95 if (ret != JPEG_HEADER_OK) {
96 jpeg_destroy_decompress(&cinfo);
99 pInfo
->width = cinfo.image_width;
102 pInfo->color_transform =
103 cinfo.jpeg_color_space == JCS_YCbCr || cinfo.jpeg_color_space == JCS_YCCK;
105 jpeg_destroy_decompress(&cinfo);
113constexpr size_t kKnownBadHeaderWithInvalidHeightByteOffsetStarts[] = {94, 163};
118 ~JpegDecoder()
override;
120 bool Create(pdfium::span<
const uint8_t> src_span,
124 bool ColorTransform);
127 bool Rewind()
override;
128 pdfium::span<uint8_t> GetNextLine()
override;
129 uint32_t GetSrcOffset()
override;
131 bool InitDecode(
bool bAcceptKnownBadHeader);
135 void InitDecompressSrc();
138 bool HasKnownBadHeaderWithInvalidHeight(size_t dimension_offset)
const;
141 bool IsSofSegment(size_t marker_offset)
const;
144 void PatchUpKnownBadHeaderWithInvalidHeight(size_t dimension_offset);
147 void PatchUpTrailer();
149 uint8_t* GetWritableSrcData();
154 static constexpr size_t kSofMarkerByteOffset = 5;
157 jpeg_decompress_struct m_Cinfo;
158 jpeg_error_mgr m_Jerr;
159 jpeg_source_mgr m_Src;
160 pdfium::span<
const uint8_t> m_SrcSpan;
161 DataVector<uint8_t> m_ScanlineBuf;
162 bool m_bInited =
false;
163 bool m_bStarted =
false;
164 bool m_bJpegTransform =
false;
165 uint32_t m_nDefaultScaleDenom = 1;
168JpegDecoder::JpegDecoder() {
169 memset(&m_Cinfo, 0,
sizeof(m_Cinfo));
170 memset(&m_Jerr, 0,
sizeof(m_Jerr));
171 memset(&m_Src, 0,
sizeof(m_Src));
174JpegDecoder::~JpegDecoder() {
176 jpeg_destroy_decompress(&m_Cinfo);
179 m_pLastScanline = pdfium::span<uint8_t>();
182bool JpegDecoder::InitDecode(
bool bAcceptKnownBadHeader) {
183 m_Cinfo.err = &m_Jerr;
184 m_Cinfo.client_data = &m_JmpBuf;
185 if (setjmp(m_JmpBuf) == -1)
188 jpeg_create_decompress(&m_Cinfo);
192 if (setjmp(m_JmpBuf) == -1) {
193 absl::optional<size_t> known_bad_header_offset;
194 if (bAcceptKnownBadHeader) {
195 for (size_t offset : kKnownBadHeaderWithInvalidHeightByteOffsetStarts) {
196 if (HasKnownBadHeaderWithInvalidHeight(offset)) {
197 known_bad_header_offset = offset;
202 jpeg_destroy_decompress(&m_Cinfo);
203 if (!known_bad_header_offset.has_value()) {
208 PatchUpKnownBadHeaderWithInvalidHeight(known_bad_header_offset.value());
210 jpeg_create_decompress(&m_Cinfo);
213 m_Cinfo.image_width = m_OrigWidth;
214 m_Cinfo.image_height = m_OrigHeight;
215 int ret = jpeg_read_header(&m_Cinfo, TRUE);
216 if (ret != JPEG_HEADER_OK)
219 if (m_Cinfo.saw_Adobe_marker)
220 m_bJpegTransform =
true;
222 if (m_Cinfo.num_components == 3 && !m_bJpegTransform)
223 m_Cinfo.out_color_space = m_Cinfo.jpeg_color_space;
225 m_OrigWidth = m_Cinfo.image_width;
226 m_OrigHeight = m_Cinfo.image_height;
229 m_nDefaultScaleDenom = m_Cinfo.scale_denom;
233bool JpegDecoder::Create(pdfium::span<
const uint8_t> src_span,
237 bool ColorTransform) {
238 m_SrcSpan = JpegScanSOI(src_span);
239 if (m_SrcSpan.size() < 2)
244 m_Jerr.error_exit = error_fatal;
245 m_Jerr.emit_message = error_do_nothing_int;
246 m_Jerr.output_message = error_do_nothing;
247 m_Jerr.format_message = error_do_nothing_char;
248 m_Jerr.reset_error_mgr = error_do_nothing;
249 m_Src.init_source = src_do_nothing;
250 m_Src.term_source = src_do_nothing;
251 m_Src.skip_input_data = src_skip_data;
252 m_Src.fill_input_buffer = src_fill_buffer;
253 m_Src.resync_to_restart = src_resync;
254 m_bJpegTransform = ColorTransform;
257 if (!InitDecode(
true))
260 if (m_Cinfo.num_components < nComps)
263 if (m_Cinfo.image_width < width)
267 m_ScanlineBuf = DataVector<uint8_t>(m_Pitch);
268 m_nComps = m_Cinfo.num_components;
274bool JpegDecoder::Rewind() {
276 jpeg_destroy_decompress(&m_Cinfo);
277 if (!InitDecode(
false)) {
281 if (setjmp(m_JmpBuf) == -1) {
284 m_Cinfo.scale_denom = m_nDefaultScaleDenom;
287 if (!jpeg_start_decompress(&m_Cinfo)) {
288 jpeg_destroy_decompress(&m_Cinfo);
291 CHECK_LE(
static_cast<
int>(m_Cinfo.output_width), m_OrigWidth);
296pdfium::span<uint8_t> JpegDecoder::GetNextLine() {
297 if (setjmp(m_JmpBuf) == -1)
298 return pdfium::span<uint8_t>();
300 uint8_t* row_array[] = {m_ScanlineBuf.data()};
301 int nlines = jpeg_read_scanlines(&m_Cinfo, row_array, 1);
303 return pdfium::span<uint8_t>();
305 return m_ScanlineBuf;
308uint32_t JpegDecoder::GetSrcOffset() {
309 return static_cast<uint32_t>(m_SrcSpan.size() - m_Src.bytes_in_buffer);
312void JpegDecoder::CalcPitch() {
313 m_Pitch =
static_cast<uint32_t>(m_Cinfo.image_width) * m_Cinfo.num_components;
319void JpegDecoder::InitDecompressSrc() {
320 m_Cinfo.src = &m_Src;
321 m_Src.bytes_in_buffer = m_SrcSpan.size();
322 m_Src.next_input_byte = m_SrcSpan.data();
325bool JpegDecoder::HasKnownBadHeaderWithInvalidHeight(
326 size_t dimension_offset)
const {
329 bool bDimensionChecks = m_Cinfo.err->msg_code == JERR_IMAGE_TOO_BIG &&
330 m_Cinfo.image_width < JPEG_MAX_DIMENSION &&
331 m_Cinfo.image_height == 0xffff && m_OrigWidth > 0 &&
332 m_OrigWidth <= JPEG_MAX_DIMENSION &&
334 m_OrigHeight <= JPEG_MAX_DIMENSION;
335 if (!bDimensionChecks)
338 if (m_SrcSpan.size() <= dimension_offset + 3u)
341 if (!IsSofSegment(dimension_offset - kSofMarkerByteOffset))
344 const uint8_t* pHeaderDimensions = &m_SrcSpan[dimension_offset];
345 uint8_t nExpectedWidthByte1 = (
m_OrigWidth >> 8) & 0xff;
348 return pHeaderDimensions[0] == 0xff && pHeaderDimensions[1] == 0xff &&
349 pHeaderDimensions[2] == nExpectedWidthByte1 &&
350 pHeaderDimensions[3] == nExpectedWidthByte2;
353bool JpegDecoder::IsSofSegment(size_t marker_offset)
const {
354 const uint8_t* pHeaderMarker = &m_SrcSpan[marker_offset];
355 return pHeaderMarker[0] == 0xff && pHeaderMarker[1] >= 0xc0 &&
356 pHeaderMarker[1] <= 0xcf;
359void JpegDecoder::PatchUpKnownBadHeaderWithInvalidHeight(
360 size_t dimension_offset) {
361 DCHECK(m_SrcSpan.size() > dimension_offset + 1u);
362 uint8_t* pData = GetWritableSrcData() + dimension_offset;
367void JpegDecoder::PatchUpTrailer() {
368 uint8_t* pData = GetWritableSrcData();
369 pData[m_SrcSpan.size() - 2] = 0xff;
370 pData[m_SrcSpan.size() - 1] = 0xd9;
373uint8_t* JpegDecoder::GetWritableSrcData() {
374 return const_cast<uint8_t*>(m_SrcSpan.data());
381 pdfium::span<
const uint8_t> src_span,
385 bool ColorTransform) {
386 DCHECK(!src_span.empty());
388 auto pDecoder =
std::make_unique<JpegDecoder>();
389 if (!pDecoder->Create(src_span, width, height, nComps, ColorTransform))
392 return std::move(pDecoder);
397 pdfium::span<
const uint8_t> src_span) {
399 if (!JpegLoadInfo(src_span, &info))
400 return absl::nullopt;
static void src_skip_data(jpeg_decompress_struct *cinfo, long num)
static pdfium::span< const uint8_t > JpegScanSOI(pdfium::span< const uint8_t > src_span)
static bool JpegLoadInfo(pdfium::span< const uint8_t > src_span, JpegModule::ImageInfo *pInfo)
static void error_fatal(j_common_ptr cinfo)