1 /*
2  * jdmarker.c
3  *
4  * This file was part of the Independent JPEG Group's software:
5  * Copyright (C) 1991-1998, Thomas G. Lane.
6  * libjpeg-turbo Modifications:
7  * Copyright (C) 2012, 2015, D. R. Commander.
8  * For conditions of distribution and use, see the accompanying README.ijg
9  * file.
10  *
11  * This file contains routines to decode JPEG datastream markers.
12  * Most of the complexity arises from our desire to support input
13  * suspension: if not all of the data for a marker is available,
14  * we must exit back to the application.  On resumption, we reprocess
15  * the marker.
16  */
17 
18 #define JPEG_INTERNALS
19 #include "jinclude.h"
20 #include "jpeglib.h"
21 
22 
23 typedef enum {                  /* JPEG marker codes */
24   M_SOF0  = 0xc0,
25   M_SOF1  = 0xc1,
26   M_SOF2  = 0xc2,
27   M_SOF3  = 0xc3,
28 
29   M_SOF5  = 0xc5,
30   M_SOF6  = 0xc6,
31   M_SOF7  = 0xc7,
32 
33   M_JPG   = 0xc8,
34   M_SOF9  = 0xc9,
35   M_SOF10 = 0xca,
36   M_SOF11 = 0xcb,
37 
38   M_SOF13 = 0xcd,
39   M_SOF14 = 0xce,
40   M_SOF15 = 0xcf,
41 
42   M_DHT   = 0xc4,
43 
44   M_DAC   = 0xcc,
45 
46   M_RST0  = 0xd0,
47   M_RST1  = 0xd1,
48   M_RST2  = 0xd2,
49   M_RST3  = 0xd3,
50   M_RST4  = 0xd4,
51   M_RST5  = 0xd5,
52   M_RST6  = 0xd6,
53   M_RST7  = 0xd7,
54 
55   M_SOI   = 0xd8,
56   M_EOI   = 0xd9,
57   M_SOS   = 0xda,
58   M_DQT   = 0xdb,
59   M_DNL   = 0xdc,
60   M_DRI   = 0xdd,
61   M_DHP   = 0xde,
62   M_EXP   = 0xdf,
63 
64   M_APP0  = 0xe0,
65   M_APP1  = 0xe1,
66   M_APP2  = 0xe2,
67   M_APP3  = 0xe3,
68   M_APP4  = 0xe4,
69   M_APP5  = 0xe5,
70   M_APP6  = 0xe6,
71   M_APP7  = 0xe7,
72   M_APP8  = 0xe8,
73   M_APP9  = 0xe9,
74   M_APP10 = 0xea,
75   M_APP11 = 0xeb,
76   M_APP12 = 0xec,
77   M_APP13 = 0xed,
78   M_APP14 = 0xee,
79   M_APP15 = 0xef,
80 
81   M_JPG0  = 0xf0,
82   M_JPG13 = 0xfd,
83   M_COM   = 0xfe,
84 
85   M_TEM   = 0x01,
86 
87   M_ERROR = 0x100
88 } JPEG_MARKER;
89 
90 
91 /* Private state */
92 
93 typedef struct {
94   struct jpeg_marker_reader pub; /* public fields */
95 
96   /* Application-overridable marker processing methods */
97   jpeg_marker_parser_method process_COM;
98   jpeg_marker_parser_method process_APPn[16];
99 
100   /* Limit on marker data length to save for each marker type */
101   unsigned int length_limit_COM;
102   unsigned int length_limit_APPn[16];
103 
104   /* Status of COM/APPn marker saving */
105   jpeg_saved_marker_ptr cur_marker;     /* NULL if not processing a marker */
106   unsigned int bytes_read;              /* data bytes read so far in marker */
107   /* Note: cur_marker is not linked into marker_list until it's all read. */
108 } my_marker_reader;
109 
110 typedef my_marker_reader *my_marker_ptr;
111 
112 
113 /*
114  * Macros for fetching data from the data source module.
115  *
116  * At all times, cinfo->src->next_input_byte and ->bytes_in_buffer reflect
117  * the current restart point; we update them only when we have reached a
118  * suitable place to restart if a suspension occurs.
119  */
120 
121 /* Declare and initialize local copies of input pointer/count */
122 #define INPUT_VARS(cinfo) \
123   struct jpeg_source_mgr *datasrc = (cinfo)->src; \
124   const JOCTET *next_input_byte = datasrc->next_input_byte; \
125   size_t bytes_in_buffer = datasrc->bytes_in_buffer
126 
127 /* Unload the local copies --- do this only at a restart boundary */
128 #define INPUT_SYNC(cinfo) \
129   ( datasrc->next_input_byte = next_input_byte, \
130     datasrc->bytes_in_buffer = bytes_in_buffer )
131 
132 /* Reload the local copies --- used only in MAKE_BYTE_AVAIL */
133 #define INPUT_RELOAD(cinfo) \
134   ( next_input_byte = datasrc->next_input_byte, \
135     bytes_in_buffer = datasrc->bytes_in_buffer )
136 
137 /* Internal macro for INPUT_BYTE and INPUT_2BYTES: make a byte available.
138  * Note we do *not* do INPUT_SYNC before calling fill_input_buffer,
139  * but we must reload the local copies after a successful fill.
140  */
141 #define MAKE_BYTE_AVAIL(cinfo, action) \
142   if (bytes_in_buffer == 0) { \
143     if (!(*datasrc->fill_input_buffer) (cinfo)) \
144       { action; } \
145     INPUT_RELOAD(cinfo); \
146   }
147 
148 /* Read a byte into variable V.
149  * If must suspend, take the specified action (typically "return FALSE").
150  */
151 #define INPUT_BYTE(cinfo, V, action) \
152   MAKESTMT( MAKE_BYTE_AVAIL(cinfo, action); \
153             bytes_in_buffer--; \
154             V = *next_input_byte++; )
155 
156 /* As above, but read two bytes interpreted as an unsigned 16-bit integer.
157  * V should be declared unsigned int or perhaps JLONG.
158  */
159 #define INPUT_2BYTES(cinfo, V, action) \
160   MAKESTMT( MAKE_BYTE_AVAIL(cinfo, action); \
161             bytes_in_buffer--; \
162             V = ((unsigned int)(*next_input_byte++)) << 8; \
163             MAKE_BYTE_AVAIL(cinfo, action); \
164             bytes_in_buffer--; \
165             V += *next_input_byte++; )
166 
167 
168 /*
169  * Routines to process JPEG markers.
170  *
171  * Entry condition: JPEG marker itself has been read and its code saved
172  *   in cinfo->unread_marker; input restart point is just after the marker.
173  *
174  * Exit: if return TRUE, have read and processed any parameters, and have
175  *   updated the restart point to point after the parameters.
176  *   If return FALSE, was forced to suspend before reaching end of
177  *   marker parameters; restart point has not been moved.  Same routine
178  *   will be called again after application supplies more input data.
179  *
180  * This approach to suspension assumes that all of a marker's parameters
181  * can fit into a single input bufferload.  This should hold for "normal"
182  * markers.  Some COM/APPn markers might have large parameter segments
183  * that might not fit.  If we are simply dropping such a marker, we use
184  * skip_input_data to get past it, and thereby put the problem on the
185  * source manager's shoulders.  If we are saving the marker's contents
186  * into memory, we use a slightly different convention: when forced to
187  * suspend, the marker processor updates the restart point to the end of
188  * what it's consumed (ie, the end of the buffer) before returning FALSE.
189  * On resumption, cinfo->unread_marker still contains the marker code,
190  * but the data source will point to the next chunk of marker data.
191  * The marker processor must retain internal state to deal with this.
192  *
193  * Note that we don't bother to avoid duplicate trace messages if a
194  * suspension occurs within marker parameters.  Other side effects
195  * require more care.
196  */
197 
198 
199 LOCAL(boolean)
get_soi(j_decompress_ptr cinfo)200 get_soi(j_decompress_ptr cinfo)
201 /* Process an SOI marker */
202 {
203   int i;
204 
205   TRACEMS(cinfo, 1, JTRC_SOI);
206 
207   if (cinfo->marker->saw_SOI)
208     ERREXIT(cinfo, JERR_SOI_DUPLICATE);
209 
210   /* Reset all parameters that are defined to be reset by SOI */
211 
212   for (i = 0; i < NUM_ARITH_TBLS; i++) {
213     cinfo->arith_dc_L[i] = 0;
214     cinfo->arith_dc_U[i] = 1;
215     cinfo->arith_ac_K[i] = 5;
216   }
217   cinfo->restart_interval = 0;
218 
219   /* Set initial assumptions for colorspace etc */
220 
221   cinfo->jpeg_color_space = JCS_UNKNOWN;
222   cinfo->CCIR601_sampling = FALSE; /* Assume non-CCIR sampling??? */
223 
224   cinfo->saw_JFIF_marker = FALSE;
225   cinfo->JFIF_major_version = 1; /* set default JFIF APP0 values */
226   cinfo->JFIF_minor_version = 1;
227   cinfo->density_unit = 0;
228   cinfo->X_density = 1;
229   cinfo->Y_density = 1;
230   cinfo->saw_Adobe_marker = FALSE;
231   cinfo->Adobe_transform = 0;
232 
233   cinfo->marker->saw_SOI = TRUE;
234 
235   return TRUE;
236 }
237 
238 
239 LOCAL(boolean)
get_sof(j_decompress_ptr cinfo,boolean is_prog,boolean is_arith)240 get_sof(j_decompress_ptr cinfo, boolean is_prog, boolean is_arith)
241 /* Process a SOFn marker */
242 {
243   JLONG length;
244   int c, ci;
245   jpeg_component_info *compptr;
246   INPUT_VARS(cinfo);
247 
248   cinfo->progressive_mode = is_prog;
249   cinfo->arith_code = is_arith;
250 
251   INPUT_2BYTES(cinfo, length, return FALSE);
252 
253   INPUT_BYTE(cinfo, cinfo->data_precision, return FALSE);
254   INPUT_2BYTES(cinfo, cinfo->image_height, return FALSE);
255   INPUT_2BYTES(cinfo, cinfo->image_width, return FALSE);
256   INPUT_BYTE(cinfo, cinfo->num_components, return FALSE);
257 
258   length -= 8;
259 
260   TRACEMS4(cinfo, 1, JTRC_SOF, cinfo->unread_marker,
261            (int)cinfo->image_width, (int)cinfo->image_height,
262            cinfo->num_components);
263 
264   if (cinfo->marker->saw_SOF)
265     ERREXIT(cinfo, JERR_SOF_DUPLICATE);
266 
267   /* We don't support files in which the image height is initially specified */
268   /* as 0 and is later redefined by DNL.  As long as we have to check that,  */
269   /* might as well have a general sanity check. */
270   if (cinfo->image_height <= 0 || cinfo->image_width <= 0 ||
271       cinfo->num_components <= 0)
272     ERREXIT(cinfo, JERR_EMPTY_IMAGE);
273 
274   if (length != (cinfo->num_components * 3))
275     ERREXIT(cinfo, JERR_BAD_LENGTH);
276 
277   if (cinfo->comp_info == NULL) /* do only once, even if suspend */
278     cinfo->comp_info = (jpeg_component_info *)(*cinfo->mem->alloc_small)
279                         ((j_common_ptr)cinfo, JPOOL_IMAGE,
280                          cinfo->num_components * sizeof(jpeg_component_info));
281 
282   for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
283        ci++, compptr++) {
284     compptr->component_index = ci;
285     INPUT_BYTE(cinfo, compptr->component_id, return FALSE);
286     INPUT_BYTE(cinfo, c, return FALSE);
287     compptr->h_samp_factor = (c >> 4) & 15;
288     compptr->v_samp_factor = (c     ) & 15;
289     INPUT_BYTE(cinfo, compptr->quant_tbl_no, return FALSE);
290 
291     TRACEMS4(cinfo, 1, JTRC_SOF_COMPONENT,
292              compptr->component_id, compptr->h_samp_factor,
293              compptr->v_samp_factor, compptr->quant_tbl_no);
294   }
295 
296   cinfo->marker->saw_SOF = TRUE;
297 
298   INPUT_SYNC(cinfo);
299   return TRUE;
300 }
301 
302 
303 LOCAL(boolean)
get_sos(j_decompress_ptr cinfo)304 get_sos(j_decompress_ptr cinfo)
305 /* Process a SOS marker */
306 {
307   JLONG length;
308   int i, ci, n, c, cc, pi;
309   jpeg_component_info *compptr;
310   INPUT_VARS(cinfo);
311 
312   if (!cinfo->marker->saw_SOF)
313     ERREXIT(cinfo, JERR_SOS_NO_SOF);
314 
315   INPUT_2BYTES(cinfo, length, return FALSE);
316 
317   INPUT_BYTE(cinfo, n, return FALSE); /* Number of components */
318 
319   TRACEMS1(cinfo, 1, JTRC_SOS, n);
320 
321   if (length != (n * 2 + 6) || n < 1 || n > MAX_COMPS_IN_SCAN)
322     ERREXIT(cinfo, JERR_BAD_LENGTH);
323 
324   cinfo->comps_in_scan = n;
325 
326   /* Collect the component-spec parameters */
327 
328   for (i = 0; i < MAX_COMPS_IN_SCAN; i++)
329     cinfo->cur_comp_info[i] = NULL;
330 
331   for (i = 0; i < n; i++) {
332     INPUT_BYTE(cinfo, cc, return FALSE);
333     INPUT_BYTE(cinfo, c, return FALSE);
334 
335     for (ci = 0, compptr = cinfo->comp_info;
336          ci < cinfo->num_components && ci < MAX_COMPS_IN_SCAN;
337          ci++, compptr++) {
338       if (cc == compptr->component_id && !cinfo->cur_comp_info[ci])
339         goto id_found;
340     }
341 
342     ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
343 
344 id_found:
345 
346     cinfo->cur_comp_info[i] = compptr;
347     compptr->dc_tbl_no = (c >> 4) & 15;
348     compptr->ac_tbl_no = (c     ) & 15;
349 
350     TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, cc,
351              compptr->dc_tbl_no, compptr->ac_tbl_no);
352 
353     /* This CSi (cc) should differ from the previous CSi */
354     for (pi = 0; pi < i; pi++) {
355       if (cinfo->cur_comp_info[pi] == compptr) {
356         ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
357       }
358     }
359   }
360 
361   /* Collect the additional scan parameters Ss, Se, Ah/Al. */
362   INPUT_BYTE(cinfo, c, return FALSE);
363   cinfo->Ss = c;
364   INPUT_BYTE(cinfo, c, return FALSE);
365   cinfo->Se = c;
366   INPUT_BYTE(cinfo, c, return FALSE);
367   cinfo->Ah = (c >> 4) & 15;
368   cinfo->Al = (c     ) & 15;
369 
370   TRACEMS4(cinfo, 1, JTRC_SOS_PARAMS, cinfo->Ss, cinfo->Se,
371            cinfo->Ah, cinfo->Al);
372 
373   /* Prepare to scan data & restart markers */
374   cinfo->marker->next_restart_num = 0;
375 
376   /* Count another SOS marker */
377   cinfo->input_scan_number++;
378 
379   INPUT_SYNC(cinfo);
380   return TRUE;
381 }
382 
383 
384 #ifdef D_ARITH_CODING_SUPPORTED
385 
386 LOCAL(boolean)
get_dac(j_decompress_ptr cinfo)387 get_dac(j_decompress_ptr cinfo)
388 /* Process a DAC marker */
389 {
390   JLONG length;
391   int index, val;
392   INPUT_VARS(cinfo);
393 
394   INPUT_2BYTES(cinfo, length, return FALSE);
395   length -= 2;
396 
397   while (length > 0) {
398     INPUT_BYTE(cinfo, index, return FALSE);
399     INPUT_BYTE(cinfo, val, return FALSE);
400 
401     length -= 2;
402 
403     TRACEMS2(cinfo, 1, JTRC_DAC, index, val);
404 
405     if (index < 0 || index >= (2 * NUM_ARITH_TBLS))
406       ERREXIT1(cinfo, JERR_DAC_INDEX, index);
407 
408     if (index >= NUM_ARITH_TBLS) { /* define AC table */
409       cinfo->arith_ac_K[index - NUM_ARITH_TBLS] = (UINT8)val;
410     } else {                    /* define DC table */
411       cinfo->arith_dc_L[index] = (UINT8)(val & 0x0F);
412       cinfo->arith_dc_U[index] = (UINT8)(val >> 4);
413       if (cinfo->arith_dc_L[index] > cinfo->arith_dc_U[index])
414         ERREXIT1(cinfo, JERR_DAC_VALUE, val);
415     }
416   }
417 
418   if (length != 0)
419     ERREXIT(cinfo, JERR_BAD_LENGTH);
420 
421   INPUT_SYNC(cinfo);
422   return TRUE;
423 }
424 
425 #else /* !D_ARITH_CODING_SUPPORTED */
426 
427 #define get_dac(cinfo)  skip_variable(cinfo)
428 
429 #endif /* D_ARITH_CODING_SUPPORTED */
430 
431 
432 LOCAL(boolean)
get_dht(j_decompress_ptr cinfo)433 get_dht(j_decompress_ptr cinfo)
434 /* Process a DHT marker */
435 {
436   JLONG length;
437   UINT8 bits[17];
438   UINT8 huffval[256];
439   int i, index, count;
440   JHUFF_TBL **htblptr;
441   INPUT_VARS(cinfo);
442 
443   INPUT_2BYTES(cinfo, length, return FALSE);
444   length -= 2;
445 
446   while (length > 16) {
447     INPUT_BYTE(cinfo, index, return FALSE);
448 
449     TRACEMS1(cinfo, 1, JTRC_DHT, index);
450 
451     bits[0] = 0;
452     count = 0;
453     for (i = 1; i <= 16; i++) {
454       INPUT_BYTE(cinfo, bits[i], return FALSE);
455       count += bits[i];
456     }
457 
458     length -= 1 + 16;
459 
460     TRACEMS8(cinfo, 2, JTRC_HUFFBITS,
461              bits[1], bits[2], bits[3], bits[4],
462              bits[5], bits[6], bits[7], bits[8]);
463     TRACEMS8(cinfo, 2, JTRC_HUFFBITS,
464              bits[9], bits[10], bits[11], bits[12],
465              bits[13], bits[14], bits[15], bits[16]);
466 
467     /* Here we just do minimal validation of the counts to avoid walking
468      * off the end of our table space.  jdhuff.c will check more carefully.
469      */
470     if (count > 256 || ((JLONG)count) > length)
471       ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
472 
473     for (i = 0; i < count; i++)
474       INPUT_BYTE(cinfo, huffval[i], return FALSE);
475 
476     MEMZERO(&huffval[count], (256 - count) * sizeof(UINT8));
477 
478     length -= count;
479 
480     if (index & 0x10) {         /* AC table definition */
481       index -= 0x10;
482       if (index < 0 || index >= NUM_HUFF_TBLS)
483         ERREXIT1(cinfo, JERR_DHT_INDEX, index);
484       htblptr = &cinfo->ac_huff_tbl_ptrs[index];
485     } else {                    /* DC table definition */
486       if (index < 0 || index >= NUM_HUFF_TBLS)
487         ERREXIT1(cinfo, JERR_DHT_INDEX, index);
488       htblptr = &cinfo->dc_huff_tbl_ptrs[index];
489     }
490 
491     if (*htblptr == NULL)
492       *htblptr = jpeg_alloc_huff_table((j_common_ptr)cinfo);
493 
494     MEMCOPY((*htblptr)->bits, bits, sizeof((*htblptr)->bits));
495     MEMCOPY((*htblptr)->huffval, huffval, sizeof((*htblptr)->huffval));
496   }
497 
498   if (length != 0)
499     ERREXIT(cinfo, JERR_BAD_LENGTH);
500 
501   INPUT_SYNC(cinfo);
502   return TRUE;
503 }
504 
505 
506 LOCAL(boolean)
get_dqt(j_decompress_ptr cinfo)507 get_dqt(j_decompress_ptr cinfo)
508 /* Process a DQT marker */
509 {
510   JLONG length;
511   int n, i, prec;
512   unsigned int tmp;
513   JQUANT_TBL *quant_ptr;
514   INPUT_VARS(cinfo);
515 
516   INPUT_2BYTES(cinfo, length, return FALSE);
517   length -= 2;
518 
519   while (length > 0) {
520     INPUT_BYTE(cinfo, n, return FALSE);
521     prec = n >> 4;
522     n &= 0x0F;
523 
524     TRACEMS2(cinfo, 1, JTRC_DQT, n, prec);
525 
526     if (n >= NUM_QUANT_TBLS)
527       ERREXIT1(cinfo, JERR_DQT_INDEX, n);
528 
529     if (cinfo->quant_tbl_ptrs[n] == NULL)
530       cinfo->quant_tbl_ptrs[n] = jpeg_alloc_quant_table((j_common_ptr)cinfo);
531     quant_ptr = cinfo->quant_tbl_ptrs[n];
532 
533     for (i = 0; i < DCTSIZE2; i++) {
534       if (prec)
535         INPUT_2BYTES(cinfo, tmp, return FALSE);
536       else
537         INPUT_BYTE(cinfo, tmp, return FALSE);
538       /* We convert the zigzag-order table to natural array order. */
539       quant_ptr->quantval[jpeg_natural_order[i]] = (UINT16)tmp;
540     }
541 
542     if (cinfo->err->trace_level >= 2) {
543       for (i = 0; i < DCTSIZE2; i += 8) {
544         TRACEMS8(cinfo, 2, JTRC_QUANTVALS,
545                  quant_ptr->quantval[i],     quant_ptr->quantval[i + 1],
546                  quant_ptr->quantval[i + 2], quant_ptr->quantval[i + 3],
547                  quant_ptr->quantval[i + 4], quant_ptr->quantval[i + 5],
548                  quant_ptr->quantval[i + 6], quant_ptr->quantval[i + 7]);
549       }
550     }
551 
552     length -= DCTSIZE2 + 1;
553     if (prec) length -= DCTSIZE2;
554   }
555 
556   if (length != 0)
557     ERREXIT(cinfo, JERR_BAD_LENGTH);
558 
559   INPUT_SYNC(cinfo);
560   return TRUE;
561 }
562 
563 
564 LOCAL(boolean)
get_dri(j_decompress_ptr cinfo)565 get_dri(j_decompress_ptr cinfo)
566 /* Process a DRI marker */
567 {
568   JLONG length;
569   unsigned int tmp;
570   INPUT_VARS(cinfo);
571 
572   INPUT_2BYTES(cinfo, length, return FALSE);
573 
574   if (length != 4)
575     ERREXIT(cinfo, JERR_BAD_LENGTH);
576 
577   INPUT_2BYTES(cinfo, tmp, return FALSE);
578 
579   TRACEMS1(cinfo, 1, JTRC_DRI, tmp);
580 
581   cinfo->restart_interval = tmp;
582 
583   INPUT_SYNC(cinfo);
584   return TRUE;
585 }
586 
587 
588 /*
589  * Routines for processing APPn and COM markers.
590  * These are either saved in memory or discarded, per application request.
591  * APP0 and APP14 are specially checked to see if they are
592  * JFIF and Adobe markers, respectively.
593  */
594 
595 #define APP0_DATA_LEN   14      /* Length of interesting data in APP0 */
596 #define APP14_DATA_LEN  12      /* Length of interesting data in APP14 */
597 #define APPN_DATA_LEN   14      /* Must be the largest of the above!! */
598 
599 
600 LOCAL(void)
examine_app0(j_decompress_ptr cinfo,JOCTET * data,unsigned int datalen,JLONG remaining)601 examine_app0(j_decompress_ptr cinfo, JOCTET *data, unsigned int datalen,
602              JLONG remaining)
603 /* Examine first few bytes from an APP0.
604  * Take appropriate action if it is a JFIF marker.
605  * datalen is # of bytes at data[], remaining is length of rest of marker data.
606  */
607 {
608   JLONG totallen = (JLONG)datalen + remaining;
609 
610   if (datalen >= APP0_DATA_LEN &&
611       data[0] == 0x4A &&
612       data[1] == 0x46 &&
613       data[2] == 0x49 &&
614       data[3] == 0x46 &&
615       data[4] == 0) {
616     /* Found JFIF APP0 marker: save info */
617     cinfo->saw_JFIF_marker = TRUE;
618     cinfo->JFIF_major_version = data[5];
619     cinfo->JFIF_minor_version = data[6];
620     cinfo->density_unit = data[7];
621     cinfo->X_density = (data[8] << 8) + data[9];
622     cinfo->Y_density = (data[10] << 8) + data[11];
623     /* Check version.
624      * Major version must be 1, anything else signals an incompatible change.
625      * (We used to treat this as an error, but now it's a nonfatal warning,
626      * because some bozo at Hijaak couldn't read the spec.)
627      * Minor version should be 0..2, but process anyway if newer.
628      */
629     if (cinfo->JFIF_major_version != 1)
630       WARNMS2(cinfo, JWRN_JFIF_MAJOR,
631               cinfo->JFIF_major_version, cinfo->JFIF_minor_version);
632     /* Generate trace messages */
633     TRACEMS5(cinfo, 1, JTRC_JFIF,
634              cinfo->JFIF_major_version, cinfo->JFIF_minor_version,
635              cinfo->X_density, cinfo->Y_density, cinfo->density_unit);
636     /* Validate thumbnail dimensions and issue appropriate messages */
637     if (data[12] | data[13])
638       TRACEMS2(cinfo, 1, JTRC_JFIF_THUMBNAIL, data[12], data[13]);
639     totallen -= APP0_DATA_LEN;
640     if (totallen != ((JLONG)data[12] * (JLONG)data[13] * (JLONG)3))
641       TRACEMS1(cinfo, 1, JTRC_JFIF_BADTHUMBNAILSIZE, (int)totallen);
642   } else if (datalen >= 6 &&
643              data[0] == 0x4A &&
644              data[1] == 0x46 &&
645              data[2] == 0x58 &&
646              data[3] == 0x58 &&
647              data[4] == 0) {
648     /* Found JFIF "JFXX" extension APP0 marker */
649     /* The library doesn't actually do anything with these,
650      * but we try to produce a helpful trace message.
651      */
652     switch (data[5]) {
653     case 0x10:
654       TRACEMS1(cinfo, 1, JTRC_THUMB_JPEG, (int)totallen);
655       break;
656     case 0x11:
657       TRACEMS1(cinfo, 1, JTRC_THUMB_PALETTE, (int)totallen);
658       break;
659     case 0x13:
660       TRACEMS1(cinfo, 1, JTRC_THUMB_RGB, (int)totallen);
661       break;
662     default:
663       TRACEMS2(cinfo, 1, JTRC_JFIF_EXTENSION, data[5], (int)totallen);
664       break;
665     }
666   } else {
667     /* Start of APP0 does not match "JFIF" or "JFXX", or too short */
668     TRACEMS1(cinfo, 1, JTRC_APP0, (int)totallen);
669   }
670 }
671 
672 
673 LOCAL(void)
examine_app14(j_decompress_ptr cinfo,JOCTET * data,unsigned int datalen,JLONG remaining)674 examine_app14(j_decompress_ptr cinfo, JOCTET *data, unsigned int datalen,
675               JLONG remaining)
676 /* Examine first few bytes from an APP14.
677  * Take appropriate action if it is an Adobe marker.
678  * datalen is # of bytes at data[], remaining is length of rest of marker data.
679  */
680 {
681   unsigned int version, flags0, flags1, transform;
682 
683   if (datalen >= APP14_DATA_LEN &&
684       data[0] == 0x41 &&
685       data[1] == 0x64 &&
686       data[2] == 0x6F &&
687       data[3] == 0x62 &&
688       data[4] == 0x65) {
689     /* Found Adobe APP14 marker */
690     version = (data[5] << 8) + data[6];
691     flags0 = (data[7] << 8) + data[8];
692     flags1 = (data[9] << 8) + data[10];
693     transform = data[11];
694     TRACEMS4(cinfo, 1, JTRC_ADOBE, version, flags0, flags1, transform);
695     cinfo->saw_Adobe_marker = TRUE;
696     cinfo->Adobe_transform = (UINT8)transform;
697   } else {
698     /* Start of APP14 does not match "Adobe", or too short */
699     TRACEMS1(cinfo, 1, JTRC_APP14, (int)(datalen + remaining));
700   }
701 }
702 
703 
704 METHODDEF(boolean)
get_interesting_appn(j_decompress_ptr cinfo)705 get_interesting_appn(j_decompress_ptr cinfo)
706 /* Process an APP0 or APP14 marker without saving it */
707 {
708   JLONG length;
709   JOCTET b[APPN_DATA_LEN];
710   unsigned int i, numtoread;
711   INPUT_VARS(cinfo);
712 
713   INPUT_2BYTES(cinfo, length, return FALSE);
714   length -= 2;
715 
716   /* get the interesting part of the marker data */
717   if (length >= APPN_DATA_LEN)
718     numtoread = APPN_DATA_LEN;
719   else if (length > 0)
720     numtoread = (unsigned int)length;
721   else
722     numtoread = 0;
723   for (i = 0; i < numtoread; i++)
724     INPUT_BYTE(cinfo, b[i], return FALSE);
725   length -= numtoread;
726 
727   /* process it */
728   switch (cinfo->unread_marker) {
729   case M_APP0:
730     examine_app0(cinfo, (JOCTET *)b, numtoread, length);
731     break;
732   case M_APP14:
733     examine_app14(cinfo, (JOCTET *)b, numtoread, length);
734     break;
735   default:
736     /* can't get here unless jpeg_save_markers chooses wrong processor */
737     ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
738     break;
739   }
740 
741   /* skip any remaining data -- could be lots */
742   INPUT_SYNC(cinfo);
743   if (length > 0)
744     (*cinfo->src->skip_input_data) (cinfo, (long)length);
745 
746   return TRUE;
747 }
748 
749 
750 #ifdef SAVE_MARKERS_SUPPORTED
751 
752 METHODDEF(boolean)
save_marker(j_decompress_ptr cinfo)753 save_marker(j_decompress_ptr cinfo)
754 /* Save an APPn or COM marker into the marker list */
755 {
756   my_marker_ptr marker = (my_marker_ptr)cinfo->marker;
757   jpeg_saved_marker_ptr cur_marker = marker->cur_marker;
758   unsigned int bytes_read, data_length;
759   JOCTET *data;
760   JLONG length = 0;
761   INPUT_VARS(cinfo);
762 
763   if (cur_marker == NULL) {
764     /* begin reading a marker */
765     INPUT_2BYTES(cinfo, length, return FALSE);
766     length -= 2;
767     if (length >= 0) {          /* watch out for bogus length word */
768       /* figure out how much we want to save */
769       unsigned int limit;
770       if (cinfo->unread_marker == (int)M_COM)
771         limit = marker->length_limit_COM;
772       else
773         limit = marker->length_limit_APPn[cinfo->unread_marker - (int)M_APP0];
774       if ((unsigned int)length < limit)
775         limit = (unsigned int)length;
776       /* allocate and initialize the marker item */
777       cur_marker = (jpeg_saved_marker_ptr)
778         (*cinfo->mem->alloc_large) ((j_common_ptr)cinfo, JPOOL_IMAGE,
779                                     sizeof(struct jpeg_marker_struct) + limit);
780       cur_marker->next = NULL;
781       cur_marker->marker = (UINT8)cinfo->unread_marker;
782       cur_marker->original_length = (unsigned int)length;
783       cur_marker->data_length = limit;
784       /* data area is just beyond the jpeg_marker_struct */
785       data = cur_marker->data = (JOCTET *)(cur_marker + 1);
786       marker->cur_marker = cur_marker;
787       marker->bytes_read = 0;
788       bytes_read = 0;
789       data_length = limit;
790     } else {
791       /* deal with bogus length word */
792       bytes_read = data_length = 0;
793       data = NULL;
794     }
795   } else {
796     /* resume reading a marker */
797     bytes_read = marker->bytes_read;
798     data_length = cur_marker->data_length;
799     data = cur_marker->data + bytes_read;
800   }
801 
802   while (bytes_read < data_length) {
803     INPUT_SYNC(cinfo);          /* move the restart point to here */
804     marker->bytes_read = bytes_read;
805     /* If there's not at least one byte in buffer, suspend */
806     MAKE_BYTE_AVAIL(cinfo, return FALSE);
807     /* Copy bytes with reasonable rapidity */
808     while (bytes_read < data_length && bytes_in_buffer > 0) {
809       *data++ = *next_input_byte++;
810       bytes_in_buffer--;
811       bytes_read++;
812     }
813   }
814 
815   /* Done reading what we want to read */
816   if (cur_marker != NULL) {     /* will be NULL if bogus length word */
817     /* Add new marker to end of list */
818     if (cinfo->marker_list == NULL) {
819       cinfo->marker_list = cur_marker;
820     } else {
821       jpeg_saved_marker_ptr prev = cinfo->marker_list;
822       while (prev->next != NULL)
823         prev = prev->next;
824       prev->next = cur_marker;
825     }
826     /* Reset pointer & calc remaining data length */
827     data = cur_marker->data;
828     length = cur_marker->original_length - data_length;
829   }
830   /* Reset to initial state for next marker */
831   marker->cur_marker = NULL;
832 
833   /* Process the marker if interesting; else just make a generic trace msg */
834   switch (cinfo->unread_marker) {
835   case M_APP0:
836     examine_app0(cinfo, data, data_length, length);
837     break;
838   case M_APP14:
839     examine_app14(cinfo, data, data_length, length);
840     break;
841   default:
842     TRACEMS2(cinfo, 1, JTRC_MISC_MARKER, cinfo->unread_marker,
843              (int)(data_length + length));
844     break;
845   }
846 
847   /* skip any remaining data -- could be lots */
848   INPUT_SYNC(cinfo);            /* do before skip_input_data */
849   if (length > 0)
850     (*cinfo->src->skip_input_data) (cinfo, (long)length);
851 
852   return TRUE;
853 }
854 
855 #endif /* SAVE_MARKERS_SUPPORTED */
856 
857 
858 METHODDEF(boolean)
skip_variable(j_decompress_ptr cinfo)859 skip_variable(j_decompress_ptr cinfo)
860 /* Skip over an unknown or uninteresting variable-length marker */
861 {
862   JLONG length;
863   INPUT_VARS(cinfo);
864 
865   INPUT_2BYTES(cinfo, length, return FALSE);
866   length -= 2;
867 
868   TRACEMS2(cinfo, 1, JTRC_MISC_MARKER, cinfo->unread_marker, (int)length);
869 
870   INPUT_SYNC(cinfo);            /* do before skip_input_data */
871   if (length > 0)
872     (*cinfo->src->skip_input_data) (cinfo, (long)length);
873 
874   return TRUE;
875 }
876 
877 
878 /*
879  * Find the next JPEG marker, save it in cinfo->unread_marker.
880  * Returns FALSE if had to suspend before reaching a marker;
881  * in that case cinfo->unread_marker is unchanged.
882  *
883  * Note that the result might not be a valid marker code,
884  * but it will never be 0 or FF.
885  */
886 
887 LOCAL(boolean)
next_marker(j_decompress_ptr cinfo)888 next_marker(j_decompress_ptr cinfo)
889 {
890   int c;
891   INPUT_VARS(cinfo);
892 
893   for (;;) {
894     INPUT_BYTE(cinfo, c, return FALSE);
895     /* Skip any non-FF bytes.
896      * This may look a bit inefficient, but it will not occur in a valid file.
897      * We sync after each discarded byte so that a suspending data source
898      * can discard the byte from its buffer.
899      */
900     while (c != 0xFF) {
901       cinfo->marker->discarded_bytes++;
902       INPUT_SYNC(cinfo);
903       INPUT_BYTE(cinfo, c, return FALSE);
904     }
905     /* This loop swallows any duplicate FF bytes.  Extra FFs are legal as
906      * pad bytes, so don't count them in discarded_bytes.  We assume there
907      * will not be so many consecutive FF bytes as to overflow a suspending
908      * data source's input buffer.
909      */
910     do {
911       INPUT_BYTE(cinfo, c, return FALSE);
912     } while (c == 0xFF);
913     if (c != 0)
914       break;                    /* found a valid marker, exit loop */
915     /* Reach here if we found a stuffed-zero data sequence (FF/00).
916      * Discard it and loop back to try again.
917      */
918     cinfo->marker->discarded_bytes += 2;
919     INPUT_SYNC(cinfo);
920   }
921 
922   if (cinfo->marker->discarded_bytes != 0) {
923     WARNMS2(cinfo, JWRN_EXTRANEOUS_DATA, cinfo->marker->discarded_bytes, c);
924     cinfo->marker->discarded_bytes = 0;
925   }
926 
927   cinfo->unread_marker = c;
928 
929   INPUT_SYNC(cinfo);
930   return TRUE;
931 }
932 
933 
934 LOCAL(boolean)
first_marker(j_decompress_ptr cinfo)935 first_marker(j_decompress_ptr cinfo)
936 /* Like next_marker, but used to obtain the initial SOI marker. */
937 /* For this marker, we do not allow preceding garbage or fill; otherwise,
938  * we might well scan an entire input file before realizing it ain't JPEG.
939  * If an application wants to process non-JFIF files, it must seek to the
940  * SOI before calling the JPEG library.
941  */
942 {
943   int c, c2;
944   INPUT_VARS(cinfo);
945 
946   INPUT_BYTE(cinfo, c, return FALSE);
947   INPUT_BYTE(cinfo, c2, return FALSE);
948   if (c != 0xFF || c2 != (int)M_SOI)
949     ERREXIT2(cinfo, JERR_NO_SOI, c, c2);
950 
951   cinfo->unread_marker = c2;
952 
953   INPUT_SYNC(cinfo);
954   return TRUE;
955 }
956 
957 
958 /*
959  * Read markers until SOS or EOI.
960  *
961  * Returns same codes as are defined for jpeg_consume_input:
962  * JPEG_SUSPENDED, JPEG_REACHED_SOS, or JPEG_REACHED_EOI.
963  */
964 
965 METHODDEF(int)
read_markers(j_decompress_ptr cinfo)966 read_markers(j_decompress_ptr cinfo)
967 {
968   /* Outer loop repeats once for each marker. */
969   for (;;) {
970     /* Collect the marker proper, unless we already did. */
971     /* NB: first_marker() enforces the requirement that SOI appear first. */
972     if (cinfo->unread_marker == 0) {
973       if (!cinfo->marker->saw_SOI) {
974         if (!first_marker(cinfo))
975           return JPEG_SUSPENDED;
976       } else {
977         if (!next_marker(cinfo))
978           return JPEG_SUSPENDED;
979       }
980     }
981     /* At this point cinfo->unread_marker contains the marker code and the
982      * input point is just past the marker proper, but before any parameters.
983      * A suspension will cause us to return with this state still true.
984      */
985     switch (cinfo->unread_marker) {
986     case M_SOI:
987       if (!get_soi(cinfo))
988         return JPEG_SUSPENDED;
989       break;
990 
991     case M_SOF0:                /* Baseline */
992     case M_SOF1:                /* Extended sequential, Huffman */
993       if (!get_sof(cinfo, FALSE, FALSE))
994         return JPEG_SUSPENDED;
995       break;
996 
997     case M_SOF2:                /* Progressive, Huffman */
998       if (!get_sof(cinfo, TRUE, FALSE))
999         return JPEG_SUSPENDED;
1000       break;
1001 
1002     case M_SOF9:                /* Extended sequential, arithmetic */
1003       if (!get_sof(cinfo, FALSE, TRUE))
1004         return JPEG_SUSPENDED;
1005       break;
1006 
1007     case M_SOF10:               /* Progressive, arithmetic */
1008       if (!get_sof(cinfo, TRUE, TRUE))
1009         return JPEG_SUSPENDED;
1010       break;
1011 
1012     /* Currently unsupported SOFn types */
1013     case M_SOF3:                /* Lossless, Huffman */
1014     case M_SOF5:                /* Differential sequential, Huffman */
1015     case M_SOF6:                /* Differential progressive, Huffman */
1016     case M_SOF7:                /* Differential lossless, Huffman */
1017     case M_JPG:                 /* Reserved for JPEG extensions */
1018     case M_SOF11:               /* Lossless, arithmetic */
1019     case M_SOF13:               /* Differential sequential, arithmetic */
1020     case M_SOF14:               /* Differential progressive, arithmetic */
1021     case M_SOF15:               /* Differential lossless, arithmetic */
1022       ERREXIT1(cinfo, JERR_SOF_UNSUPPORTED, cinfo->unread_marker);
1023       break;
1024 
1025     case M_SOS:
1026       if (!get_sos(cinfo))
1027         return JPEG_SUSPENDED;
1028       cinfo->unread_marker = 0; /* processed the marker */
1029       return JPEG_REACHED_SOS;
1030 
1031     case M_EOI:
1032       TRACEMS(cinfo, 1, JTRC_EOI);
1033       cinfo->unread_marker = 0; /* processed the marker */
1034       return JPEG_REACHED_EOI;
1035 
1036     case M_DAC:
1037       if (!get_dac(cinfo))
1038         return JPEG_SUSPENDED;
1039       break;
1040 
1041     case M_DHT:
1042       if (!get_dht(cinfo))
1043         return JPEG_SUSPENDED;
1044       break;
1045 
1046     case M_DQT:
1047       if (!get_dqt(cinfo))
1048         return JPEG_SUSPENDED;
1049       break;
1050 
1051     case M_DRI:
1052       if (!get_dri(cinfo))
1053         return JPEG_SUSPENDED;
1054       break;
1055 
1056     case M_APP0:
1057     case M_APP1:
1058     case M_APP2:
1059     case M_APP3:
1060     case M_APP4:
1061     case M_APP5:
1062     case M_APP6:
1063     case M_APP7:
1064     case M_APP8:
1065     case M_APP9:
1066     case M_APP10:
1067     case M_APP11:
1068     case M_APP12:
1069     case M_APP13:
1070     case M_APP14:
1071     case M_APP15:
1072       if (!(*((my_marker_ptr)cinfo->marker)->process_APPn[
1073                cinfo->unread_marker - (int)M_APP0]) (cinfo))
1074         return JPEG_SUSPENDED;
1075       break;
1076 
1077     case M_COM:
1078       if (!(*((my_marker_ptr)cinfo->marker)->process_COM) (cinfo))
1079         return JPEG_SUSPENDED;
1080       break;
1081 
1082     case M_RST0:                /* these are all parameterless */
1083     case M_RST1:
1084     case M_RST2:
1085     case M_RST3:
1086     case M_RST4:
1087     case M_RST5:
1088     case M_RST6:
1089     case M_RST7:
1090     case M_TEM:
1091       TRACEMS1(cinfo, 1, JTRC_PARMLESS_MARKER, cinfo->unread_marker);
1092       break;
1093 
1094     case M_DNL:                 /* Ignore DNL ... perhaps the wrong thing */
1095       if (!skip_variable(cinfo))
1096         return JPEG_SUSPENDED;
1097       break;
1098 
1099     default:                    /* must be DHP, EXP, JPGn, or RESn */
1100       /* For now, we treat the reserved markers as fatal errors since they are
1101        * likely to be used to signal incompatible JPEG Part 3 extensions.
1102        * Once the JPEG 3 version-number marker is well defined, this code
1103        * ought to change!
1104        */
1105       ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
1106       break;
1107     }
1108     /* Successfully processed marker, so reset state variable */
1109     cinfo->unread_marker = 0;
1110   } /* end loop */
1111 }
1112 
1113 
1114 /*
1115  * Read a restart marker, which is expected to appear next in the datastream;
1116  * if the marker is not there, take appropriate recovery action.
1117  * Returns FALSE if suspension is required.
1118  *
1119  * This is called by the entropy decoder after it has read an appropriate
1120  * number of MCUs.  cinfo->unread_marker may be nonzero if the entropy decoder
1121  * has already read a marker from the data source.  Under normal conditions
1122  * cinfo->unread_marker will be reset to 0 before returning; if not reset,
1123  * it holds a marker which the decoder will be unable to read past.
1124  */
1125 
1126 METHODDEF(boolean)
read_restart_marker(j_decompress_ptr cinfo)1127 read_restart_marker(j_decompress_ptr cinfo)
1128 {
1129   /* Obtain a marker unless we already did. */
1130   /* Note that next_marker will complain if it skips any data. */
1131   if (cinfo->unread_marker == 0) {
1132     if (!next_marker(cinfo))
1133       return FALSE;
1134   }
1135 
1136   if (cinfo->unread_marker ==
1137       ((int)M_RST0 + cinfo->marker->next_restart_num)) {
1138     /* Normal case --- swallow the marker and let entropy decoder continue */
1139     TRACEMS1(cinfo, 3, JTRC_RST, cinfo->marker->next_restart_num);
1140     cinfo->unread_marker = 0;
1141   } else {
1142     /* Uh-oh, the restart markers have been messed up. */
1143     /* Let the data source manager determine how to resync. */
1144     if (!(*cinfo->src->resync_to_restart) (cinfo,
1145                                            cinfo->marker->next_restart_num))
1146       return FALSE;
1147   }
1148 
1149   /* Update next-restart state */
1150   cinfo->marker->next_restart_num = (cinfo->marker->next_restart_num + 1) & 7;
1151 
1152   return TRUE;
1153 }
1154 
1155 
1156 /*
1157  * This is the default resync_to_restart method for data source managers
1158  * to use if they don't have any better approach.  Some data source managers
1159  * may be able to back up, or may have additional knowledge about the data
1160  * which permits a more intelligent recovery strategy; such managers would
1161  * presumably supply their own resync method.
1162  *
1163  * read_restart_marker calls resync_to_restart if it finds a marker other than
1164  * the restart marker it was expecting.  (This code is *not* used unless
1165  * a nonzero restart interval has been declared.)  cinfo->unread_marker is
1166  * the marker code actually found (might be anything, except 0 or FF).
1167  * The desired restart marker number (0..7) is passed as a parameter.
1168  * This routine is supposed to apply whatever error recovery strategy seems
1169  * appropriate in order to position the input stream to the next data segment.
1170  * Note that cinfo->unread_marker is treated as a marker appearing before
1171  * the current data-source input point; usually it should be reset to zero
1172  * before returning.
1173  * Returns FALSE if suspension is required.
1174  *
1175  * This implementation is substantially constrained by wanting to treat the
1176  * input as a data stream; this means we can't back up.  Therefore, we have
1177  * only the following actions to work with:
1178  *   1. Simply discard the marker and let the entropy decoder resume at next
1179  *      byte of file.
1180  *   2. Read forward until we find another marker, discarding intervening
1181  *      data.  (In theory we could look ahead within the current bufferload,
1182  *      without having to discard data if we don't find the desired marker.
1183  *      This idea is not implemented here, in part because it makes behavior
1184  *      dependent on buffer size and chance buffer-boundary positions.)
1185  *   3. Leave the marker unread (by failing to zero cinfo->unread_marker).
1186  *      This will cause the entropy decoder to process an empty data segment,
1187  *      inserting dummy zeroes, and then we will reprocess the marker.
1188  *
1189  * #2 is appropriate if we think the desired marker lies ahead, while #3 is
1190  * appropriate if the found marker is a future restart marker (indicating
1191  * that we have missed the desired restart marker, probably because it got
1192  * corrupted).
1193  * We apply #2 or #3 if the found marker is a restart marker no more than
1194  * two counts behind or ahead of the expected one.  We also apply #2 if the
1195  * found marker is not a legal JPEG marker code (it's certainly bogus data).
1196  * If the found marker is a restart marker more than 2 counts away, we do #1
1197  * (too much risk that the marker is erroneous; with luck we will be able to
1198  * resync at some future point).
1199  * For any valid non-restart JPEG marker, we apply #3.  This keeps us from
1200  * overrunning the end of a scan.  An implementation limited to single-scan
1201  * files might find it better to apply #2 for markers other than EOI, since
1202  * any other marker would have to be bogus data in that case.
1203  */
1204 
1205 GLOBAL(boolean)
jpeg_resync_to_restart(j_decompress_ptr cinfo,int desired)1206 jpeg_resync_to_restart(j_decompress_ptr cinfo, int desired)
1207 {
1208   int marker = cinfo->unread_marker;
1209   int action = 1;
1210 
1211   /* Always put up a warning. */
1212   WARNMS2(cinfo, JWRN_MUST_RESYNC, marker, desired);
1213 
1214   /* Outer loop handles repeated decision after scanning forward. */
1215   for (;;) {
1216     if (marker < (int)M_SOF0)
1217       action = 2;               /* invalid marker */
1218     else if (marker < (int)M_RST0 || marker > (int)M_RST7)
1219       action = 3;               /* valid non-restart marker */
1220     else {
1221       if (marker == ((int)M_RST0 + ((desired + 1) & 7)) ||
1222           marker == ((int)M_RST0 + ((desired + 2) & 7)))
1223         action = 3;             /* one of the next two expected restarts */
1224       else if (marker == ((int)M_RST0 + ((desired - 1) & 7)) ||
1225                marker == ((int)M_RST0 + ((desired - 2) & 7)))
1226         action = 2;             /* a prior restart, so advance */
1227       else
1228         action = 1;             /* desired restart or too far away */
1229     }
1230     TRACEMS2(cinfo, 4, JTRC_RECOVERY_ACTION, marker, action);
1231     switch (action) {
1232     case 1:
1233       /* Discard marker and let entropy decoder resume processing. */
1234       cinfo->unread_marker = 0;
1235       return TRUE;
1236     case 2:
1237       /* Scan to the next marker, and repeat the decision loop. */
1238       if (!next_marker(cinfo))
1239         return FALSE;
1240       marker = cinfo->unread_marker;
1241       break;
1242     case 3:
1243       /* Return without advancing past this marker. */
1244       /* Entropy decoder will be forced to process an empty segment. */
1245       return TRUE;
1246     }
1247   } /* end loop */
1248 }
1249 
1250 
1251 /*
1252  * Reset marker processing state to begin a fresh datastream.
1253  */
1254 
1255 METHODDEF(void)
reset_marker_reader(j_decompress_ptr cinfo)1256 reset_marker_reader(j_decompress_ptr cinfo)
1257 {
1258   my_marker_ptr marker = (my_marker_ptr)cinfo->marker;
1259 
1260   cinfo->comp_info = NULL;              /* until allocated by get_sof */
1261   cinfo->input_scan_number = 0;         /* no SOS seen yet */
1262   cinfo->unread_marker = 0;             /* no pending marker */
1263   marker->pub.saw_SOI = FALSE;          /* set internal state too */
1264   marker->pub.saw_SOF = FALSE;
1265   marker->pub.discarded_bytes = 0;
1266   marker->cur_marker = NULL;
1267 }
1268 
1269 
1270 /*
1271  * Initialize the marker reader module.
1272  * This is called only once, when the decompression object is created.
1273  */
1274 
1275 GLOBAL(void)
jinit_marker_reader(j_decompress_ptr cinfo)1276 jinit_marker_reader(j_decompress_ptr cinfo)
1277 {
1278   my_marker_ptr marker;
1279   int i;
1280 
1281   /* Create subobject in permanent pool */
1282   marker = (my_marker_ptr)
1283     (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_PERMANENT,
1284                                 sizeof(my_marker_reader));
1285   cinfo->marker = (struct jpeg_marker_reader *)marker;
1286   /* Initialize public method pointers */
1287   marker->pub.reset_marker_reader = reset_marker_reader;
1288   marker->pub.read_markers = read_markers;
1289   marker->pub.read_restart_marker = read_restart_marker;
1290   /* Initialize COM/APPn processing.
1291    * By default, we examine and then discard APP0 and APP14,
1292    * but simply discard COM and all other APPn.
1293    */
1294   marker->process_COM = skip_variable;
1295   marker->length_limit_COM = 0;
1296   for (i = 0; i < 16; i++) {
1297     marker->process_APPn[i] = skip_variable;
1298     marker->length_limit_APPn[i] = 0;
1299   }
1300   marker->process_APPn[0] = get_interesting_appn;
1301   marker->process_APPn[14] = get_interesting_appn;
1302   /* Reset marker processing state */
1303   reset_marker_reader(cinfo);
1304 }
1305 
1306 
1307 /*
1308  * Control saving of COM and APPn markers into marker_list.
1309  */
1310 
1311 #ifdef SAVE_MARKERS_SUPPORTED
1312 
1313 GLOBAL(void)
jpeg_save_markers(j_decompress_ptr cinfo,int marker_code,unsigned int length_limit)1314 jpeg_save_markers(j_decompress_ptr cinfo, int marker_code,
1315                   unsigned int length_limit)
1316 {
1317   my_marker_ptr marker = (my_marker_ptr)cinfo->marker;
1318   long maxlength;
1319   jpeg_marker_parser_method processor;
1320 
1321   /* Length limit mustn't be larger than what we can allocate
1322    * (should only be a concern in a 16-bit environment).
1323    */
1324   maxlength = cinfo->mem->max_alloc_chunk - sizeof(struct jpeg_marker_struct);
1325   if (((long)length_limit) > maxlength)
1326     length_limit = (unsigned int)maxlength;
1327 
1328   /* Choose processor routine to use.
1329    * APP0/APP14 have special requirements.
1330    */
1331   if (length_limit) {
1332     processor = save_marker;
1333     /* If saving APP0/APP14, save at least enough for our internal use. */
1334     if (marker_code == (int)M_APP0 && length_limit < APP0_DATA_LEN)
1335       length_limit = APP0_DATA_LEN;
1336     else if (marker_code == (int)M_APP14 && length_limit < APP14_DATA_LEN)
1337       length_limit = APP14_DATA_LEN;
1338   } else {
1339     processor = skip_variable;
1340     /* If discarding APP0/APP14, use our regular on-the-fly processor. */
1341     if (marker_code == (int)M_APP0 || marker_code == (int)M_APP14)
1342       processor = get_interesting_appn;
1343   }
1344 
1345   if (marker_code == (int)M_COM) {
1346     marker->process_COM = processor;
1347     marker->length_limit_COM = length_limit;
1348   } else if (marker_code >= (int)M_APP0 && marker_code <= (int)M_APP15) {
1349     marker->process_APPn[marker_code - (int)M_APP0] = processor;
1350     marker->length_limit_APPn[marker_code - (int)M_APP0] = length_limit;
1351   } else
1352     ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
1353 }
1354 
1355 #endif /* SAVE_MARKERS_SUPPORTED */
1356 
1357 
1358 /*
1359  * Install a special processing method for COM or APPn markers.
1360  */
1361 
1362 GLOBAL(void)
jpeg_set_marker_processor(j_decompress_ptr cinfo,int marker_code,jpeg_marker_parser_method routine)1363 jpeg_set_marker_processor(j_decompress_ptr cinfo, int marker_code,
1364                           jpeg_marker_parser_method routine)
1365 {
1366   my_marker_ptr marker = (my_marker_ptr)cinfo->marker;
1367 
1368   if (marker_code == (int)M_COM)
1369     marker->process_COM = routine;
1370   else if (marker_code >= (int)M_APP0 && marker_code <= (int)M_APP15)
1371     marker->process_APPn[marker_code - (int)M_APP0] = routine;
1372   else
1373     ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
1374 }
1375