1 #if !defined(_FX_JPEG_TURBO_)
2 /*
3  * jdmarker.c
4  *
5  * Copyright (C) 1991-1998, Thomas G. Lane.
6  * This file is part of the Independent JPEG Group's software.
7  * For conditions of distribution and use, see the accompanying README file.
8  *
9  * This file contains routines to decode JPEG datastream markers.
10  * Most of the complexity arises from our desire to support input
11  * suspension: if not all of the data for a marker is available,
12  * we must exit back to the application.  On resumption, we reprocess
13  * the marker.
14  */
15 
16 #define JPEG_INTERNALS
17 #include "jinclude.h"
18 #include "jpeglib.h"
19 
20 
21 typedef enum {			/* JPEG marker codes */
22   M_SOF0  = 0xc0,
23   M_SOF1  = 0xc1,
24   M_SOF2  = 0xc2,
25   M_SOF3  = 0xc3,
26 
27   M_SOF5  = 0xc5,
28   M_SOF6  = 0xc6,
29   M_SOF7  = 0xc7,
30 
31   M_JPG   = 0xc8,
32   M_SOF9  = 0xc9,
33   M_SOF10 = 0xca,
34   M_SOF11 = 0xcb,
35 
36   M_SOF13 = 0xcd,
37   M_SOF14 = 0xce,
38   M_SOF15 = 0xcf,
39 
40   M_DHT   = 0xc4,
41 
42   M_DAC   = 0xcc,
43 
44   M_RST0  = 0xd0,
45   M_RST1  = 0xd1,
46   M_RST2  = 0xd2,
47   M_RST3  = 0xd3,
48   M_RST4  = 0xd4,
49   M_RST5  = 0xd5,
50   M_RST6  = 0xd6,
51   M_RST7  = 0xd7,
52 
53   M_SOI   = 0xd8,
54   M_EOI   = 0xd9,
55   M_SOS   = 0xda,
56   M_DQT   = 0xdb,
57   M_DNL   = 0xdc,
58   M_DRI   = 0xdd,
59   M_DHP   = 0xde,
60   M_EXP   = 0xdf,
61 
62   M_APP0  = 0xe0,
63   M_APP1  = 0xe1,
64   M_APP2  = 0xe2,
65   M_APP3  = 0xe3,
66   M_APP4  = 0xe4,
67   M_APP5  = 0xe5,
68   M_APP6  = 0xe6,
69   M_APP7  = 0xe7,
70   M_APP8  = 0xe8,
71   M_APP9  = 0xe9,
72   M_APP10 = 0xea,
73   M_APP11 = 0xeb,
74   M_APP12 = 0xec,
75   M_APP13 = 0xed,
76   M_APP14 = 0xee,
77   M_APP15 = 0xef,
78 
79   M_JPG0  = 0xf0,
80   M_JPG13 = 0xfd,
81   M_COM   = 0xfe,
82 
83   M_TEM   = 0x01,
84 
85   M_ERROR = 0x100
86 } JPEG_MARKER;
87 
88 
89 /* Private state */
90 
91 typedef struct {
92   struct jpeg_marker_reader pub; /* public fields */
93 
94   /* Application-overridable marker processing methods */
95   jpeg_marker_parser_method process_COM;
96   jpeg_marker_parser_method process_APPn[16];
97 
98   /* Limit on marker data length to save for each marker type */
99   unsigned int length_limit_COM;
100   unsigned int length_limit_APPn[16];
101 
102   /* Status of COM/APPn marker saving */
103   jpeg_saved_marker_ptr cur_marker;	/* NULL if not processing a marker */
104   unsigned int bytes_read;		/* data bytes read so far in marker */
105   /* Note: cur_marker is not linked into marker_list until it's all read. */
106 } my_marker_reader;
107 
108 typedef my_marker_reader * my_marker_ptr;
109 
110 
111 /*
112  * Macros for fetching data from the data source module.
113  *
114  * At all times, cinfo->src->next_input_byte and ->bytes_in_buffer reflect
115  * the current restart point; we update them only when we have reached a
116  * suitable place to restart if a suspension occurs.
117  */
118 
119 /* Declare and initialize local copies of input pointer/count */
120 #define INPUT_VARS(cinfo)  \
121 	struct jpeg_source_mgr * datasrc = (cinfo)->src;  \
122 	const JOCTET * next_input_byte = datasrc->next_input_byte;  \
123 	size_t bytes_in_buffer = datasrc->bytes_in_buffer
124 
125 /* Unload the local copies --- do this only at a restart boundary */
126 #define INPUT_SYNC(cinfo)  \
127 	( datasrc->next_input_byte = next_input_byte,  \
128 	  datasrc->bytes_in_buffer = bytes_in_buffer )
129 
130 /* Reload the local copies --- used only in MAKE_BYTE_AVAIL */
131 #define INPUT_RELOAD(cinfo)  \
132 	( next_input_byte = datasrc->next_input_byte,  \
133 	  bytes_in_buffer = datasrc->bytes_in_buffer )
134 
135 /* Internal macro for INPUT_BYTE and INPUT_2BYTES: make a byte available.
136  * Note we do *not* do INPUT_SYNC before calling fill_input_buffer,
137  * but we must reload the local copies after a successful fill.
138  */
139 #define MAKE_BYTE_AVAIL(cinfo,action)  \
140 	if (bytes_in_buffer == 0) {  \
141 	  if (! (*datasrc->fill_input_buffer) (cinfo))  \
142 	    { action; }  \
143 	  INPUT_RELOAD(cinfo);  \
144 	}
145 
146 /* Read a byte into variable V.
147  * If must suspend, take the specified action (typically "return FALSE").
148  */
149 #define INPUT_BYTE(cinfo,V,action)  \
150 	MAKESTMT( MAKE_BYTE_AVAIL(cinfo,action); \
151 		  bytes_in_buffer--; \
152 		  V = GETJOCTET(*next_input_byte++); )
153 
154 /* As above, but read two bytes interpreted as an unsigned 16-bit integer.
155  * V should be declared unsigned int or perhaps INT32.
156  */
157 #define INPUT_2BYTES(cinfo,V,action)  \
158 	MAKESTMT( MAKE_BYTE_AVAIL(cinfo,action); \
159 		  bytes_in_buffer--; \
160 		  V = ((unsigned int) GETJOCTET(*next_input_byte++)) << 8; \
161 		  MAKE_BYTE_AVAIL(cinfo,action); \
162 		  bytes_in_buffer--; \
163 		  V += GETJOCTET(*next_input_byte++); )
164 
165 
166 /*
167  * Routines to process JPEG markers.
168  *
169  * Entry condition: JPEG marker itself has been read and its code saved
170  *   in cinfo->unread_marker; input restart point is just after the marker.
171  *
172  * Exit: if return TRUE, have read and processed any parameters, and have
173  *   updated the restart point to point after the parameters.
174  *   If return FALSE, was forced to suspend before reaching end of
175  *   marker parameters; restart point has not been moved.  Same routine
176  *   will be called again after application supplies more input data.
177  *
178  * This approach to suspension assumes that all of a marker's parameters
179  * can fit into a single input bufferload.  This should hold for "normal"
180  * markers.  Some COM/APPn markers might have large parameter segments
181  * that might not fit.  If we are simply dropping such a marker, we use
182  * skip_input_data to get past it, and thereby put the problem on the
183  * source manager's shoulders.  If we are saving the marker's contents
184  * into memory, we use a slightly different convention: when forced to
185  * suspend, the marker processor updates the restart point to the end of
186  * what it's consumed (ie, the end of the buffer) before returning FALSE.
187  * On resumption, cinfo->unread_marker still contains the marker code,
188  * but the data source will point to the next chunk of marker data.
189  * The marker processor must retain internal state to deal with this.
190  *
191  * Note that we don't bother to avoid duplicate trace messages if a
192  * suspension occurs within marker parameters.  Other side effects
193  * require more care.
194  */
195 
196 
197 LOCAL(boolean)
get_soi(j_decompress_ptr cinfo)198 get_soi (j_decompress_ptr cinfo)
199 /* Process an SOI marker */
200 {
201   int i;
202 
203   TRACEMS(cinfo, 1, JTRC_SOI);
204 
205   if (cinfo->marker->saw_SOI)
206     ERREXIT(cinfo, JERR_SOI_DUPLICATE);
207 
208   /* Reset all parameters that are defined to be reset by SOI */
209 
210   for (i = 0; i < NUM_ARITH_TBLS; i++) {
211     cinfo->arith_dc_L[i] = 0;
212     cinfo->arith_dc_U[i] = 1;
213     cinfo->arith_ac_K[i] = 5;
214   }
215   cinfo->restart_interval = 0;
216 
217   /* Set initial assumptions for colorspace etc */
218 
219   cinfo->jpeg_color_space = JCS_UNKNOWN;
220   cinfo->CCIR601_sampling = FALSE; /* Assume non-CCIR sampling??? */
221 
222   cinfo->saw_JFIF_marker = FALSE;
223   cinfo->JFIF_major_version = 1; /* set default JFIF APP0 values */
224   cinfo->JFIF_minor_version = 1;
225   cinfo->density_unit = 0;
226   cinfo->X_density = 1;
227   cinfo->Y_density = 1;
228   cinfo->saw_Adobe_marker = FALSE;
229   cinfo->Adobe_transform = 0;
230 
231   cinfo->marker->saw_SOI = TRUE;
232 
233   return TRUE;
234 }
235 
236 
237 LOCAL(boolean)
get_sof(j_decompress_ptr cinfo,boolean is_prog,boolean is_arith)238 get_sof (j_decompress_ptr cinfo, boolean is_prog, boolean is_arith)
239 /* Process a SOFn marker */
240 {
241   INT32 length;
242   int c, ci;
243   jpeg_component_info * compptr;
244   /* LiuSunliang added 20111209 */
245   JDIMENSION image_width, image_height;
246   INPUT_VARS(cinfo);
247 
248   cinfo->progressive_mode = is_prog;
249   cinfo->arith_code = is_arith;
250 
251   INPUT_2BYTES(cinfo, length, return FALSE);
252 
253   INPUT_BYTE(cinfo, cinfo->data_precision, return FALSE);
254   INPUT_2BYTES(cinfo, image_height, return FALSE);
255   INPUT_2BYTES(cinfo, image_width, return FALSE);
256   INPUT_BYTE(cinfo, cinfo->num_components, return FALSE);
257 
258   if (image_width <= JPEG_MAX_DIMENSION)
259 	  cinfo->image_width = image_width;
260 
261   if (image_height <= JPEG_MAX_DIMENSION)
262 	  cinfo->image_height = image_height;
263 
264   length -= 8;
265 
266   TRACEMS4(cinfo, 1, JTRC_SOF, cinfo->unread_marker,
267 	   (int) cinfo->image_width, (int) cinfo->image_height,
268 	   cinfo->num_components);
269 
270   if (cinfo->marker->saw_SOF)
271     ERREXIT(cinfo, JERR_SOF_DUPLICATE);
272 
273   /* We don't support files in which the image height is initially specified */
274   /* as 0 and is later redefined by DNL.  As long as we have to check that,  */
275   /* might as well have a general sanity check. */
276   if (cinfo->image_height <= 0 || cinfo->image_width <= 0
277       || cinfo->num_components <= 0)
278     ERREXIT(cinfo, JERR_EMPTY_IMAGE);
279 
280   if (length != (cinfo->num_components * 3))
281     ERREXIT(cinfo, JERR_BAD_LENGTH);
282 
283   if (cinfo->comp_info == NULL)	/* do only once, even if suspend */
284     cinfo->comp_info = (jpeg_component_info *) (*cinfo->mem->alloc_small)
285 			((j_common_ptr) cinfo, JPOOL_IMAGE,
286 			 cinfo->num_components * SIZEOF(jpeg_component_info));
287 
288   for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
289        ci++, compptr++) {
290     compptr->component_index = ci;
291     INPUT_BYTE(cinfo, compptr->component_id, return FALSE);
292 	/* XYQ 2008-03-25: Adobe CMYK JPEG has serious flaw: the K channel has same component id as C channel */
293 	{
294 		int i;
295 		for (i = 0; i < ci; i ++)
296 			if (compptr->component_id == cinfo->comp_info[i].component_id) break;
297 		if (i < ci)
298 			/* Found the error! We replace the id with something unlikely used elsewhere */
299 			compptr->component_id += 0xf0;
300 	}
301 	/* end of modification */
302     INPUT_BYTE(cinfo, c, return FALSE);
303     compptr->h_samp_factor = (c >> 4) & 15;
304     compptr->v_samp_factor = (c     ) & 15;
305     INPUT_BYTE(cinfo, compptr->quant_tbl_no, return FALSE);
306 
307     TRACEMS4(cinfo, 1, JTRC_SOF_COMPONENT,
308 	     compptr->component_id, compptr->h_samp_factor,
309 	     compptr->v_samp_factor, compptr->quant_tbl_no);
310   }
311 
312   cinfo->marker->saw_SOF = TRUE;
313 
314   INPUT_SYNC(cinfo);
315   return TRUE;
316 }
317 
318 
319 LOCAL(boolean)
get_sos(j_decompress_ptr cinfo)320 get_sos (j_decompress_ptr cinfo)
321 /* Process a SOS marker */
322 {
323   INT32 length;
324   int i, ci, n, c, cc;
325   jpeg_component_info * compptr;
326   INPUT_VARS(cinfo);
327 
328   if (! cinfo->marker->saw_SOF)
329     ERREXIT(cinfo, JERR_SOS_NO_SOF);
330 
331   INPUT_2BYTES(cinfo, length, return FALSE);
332 
333   INPUT_BYTE(cinfo, n, return FALSE); /* Number of components */
334 
335   TRACEMS1(cinfo, 1, JTRC_SOS, n);
336 
337   if (length != (n * 2 + 6) || n < 1 || n > MAX_COMPS_IN_SCAN)
338     ERREXIT(cinfo, JERR_BAD_LENGTH);
339 
340   cinfo->comps_in_scan = n;
341 
342   /* Collect the component-spec parameters */
343 
344   for (i = 0; i < n; i++) {
345     INPUT_BYTE(cinfo, cc, return FALSE);
346     INPUT_BYTE(cinfo, c, return FALSE);
347 
348 	/* XYQ 2008-03-25: Adobe CMYK JPEG has serious flaw: the K channel has same component id as C channel */
349 	{
350 		int j;
351 		for (j = 0; j < i; j ++)
352 			if (cc == cinfo->cur_comp_info[j]->component_id) break;
353 		if (j < i)
354 			/* found the error! */
355 			cc += 0xf0;
356 	}
357 	/* end of modification */
358     for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
359 	 ci++, compptr++) {
360       if (cc == compptr->component_id)
361 	goto id_found;
362     }
363 
364     ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
365 
366   id_found:
367 
368     cinfo->cur_comp_info[i] = compptr;
369     compptr->dc_tbl_no = (c >> 4) & 15;
370     compptr->ac_tbl_no = (c     ) & 15;
371 
372     TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, cc,
373 	     compptr->dc_tbl_no, compptr->ac_tbl_no);
374 	/* This CSi (cc) should differ from the previous CSi */
375     for (ci = 0; ci < i; ci++) {
376       if (cinfo->cur_comp_info[ci] == compptr)
377         ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
378     }
379   }
380 
381   /* Collect the additional scan parameters Ss, Se, Ah/Al. */
382   INPUT_BYTE(cinfo, c, return FALSE);
383   cinfo->Ss = c;
384   INPUT_BYTE(cinfo, c, return FALSE);
385   cinfo->Se = c;
386   INPUT_BYTE(cinfo, c, return FALSE);
387   cinfo->Ah = (c >> 4) & 15;
388   cinfo->Al = (c     ) & 15;
389 
390   TRACEMS4(cinfo, 1, JTRC_SOS_PARAMS, cinfo->Ss, cinfo->Se,
391 	   cinfo->Ah, cinfo->Al);
392 
393   /* Prepare to scan data & restart markers */
394   cinfo->marker->next_restart_num = 0;
395 
396   /* Count another SOS marker */
397   cinfo->input_scan_number++;
398 
399   INPUT_SYNC(cinfo);
400   return TRUE;
401 }
402 
403 
404 #ifdef D_ARITH_CODING_SUPPORTED
405 
406 LOCAL(boolean)
get_dac(j_decompress_ptr cinfo)407 get_dac (j_decompress_ptr cinfo)
408 /* Process a DAC marker */
409 {
410   INT32 length;
411   int index, val;
412   INPUT_VARS(cinfo);
413 
414   INPUT_2BYTES(cinfo, length, return FALSE);
415   length -= 2;
416 
417   while (length > 0) {
418     INPUT_BYTE(cinfo, index, return FALSE);
419     INPUT_BYTE(cinfo, val, return FALSE);
420 
421     length -= 2;
422 
423     TRACEMS2(cinfo, 1, JTRC_DAC, index, val);
424 
425     if (index < 0 || index >= (2*NUM_ARITH_TBLS))
426       ERREXIT1(cinfo, JERR_DAC_INDEX, index);
427 
428     if (index >= NUM_ARITH_TBLS) { /* define AC table */
429       cinfo->arith_ac_K[index-NUM_ARITH_TBLS] = (UINT8) val;
430     } else {			/* define DC table */
431       cinfo->arith_dc_L[index] = (UINT8) (val & 0x0F);
432       cinfo->arith_dc_U[index] = (UINT8) (val >> 4);
433       if (cinfo->arith_dc_L[index] > cinfo->arith_dc_U[index])
434 	ERREXIT1(cinfo, JERR_DAC_VALUE, val);
435     }
436   }
437 
438   if (length != 0)
439     ERREXIT(cinfo, JERR_BAD_LENGTH);
440 
441   INPUT_SYNC(cinfo);
442   return TRUE;
443 }
444 
445 #else /* ! D_ARITH_CODING_SUPPORTED */
446 
447 #define get_dac(cinfo)  skip_variable(cinfo)
448 
449 #endif /* D_ARITH_CODING_SUPPORTED */
450 
451 
452 LOCAL(boolean)
get_dht(j_decompress_ptr cinfo)453 get_dht (j_decompress_ptr cinfo)
454 /* Process a DHT marker */
455 {
456   INT32 length;
457   UINT8 bits[17];
458   UINT8 huffval[256];
459   int i, index, count;
460   JHUFF_TBL **htblptr;
461   INPUT_VARS(cinfo);
462 
463   INPUT_2BYTES(cinfo, length, return FALSE);
464   length -= 2;
465 
466   while (length > 16) {
467     INPUT_BYTE(cinfo, index, return FALSE);
468 
469     TRACEMS1(cinfo, 1, JTRC_DHT, index);
470 
471     bits[0] = 0;
472     count = 0;
473     for (i = 1; i <= 16; i++) {
474       INPUT_BYTE(cinfo, bits[i], return FALSE);
475       count += bits[i];
476     }
477 
478     length -= 1 + 16;
479 
480     TRACEMS8(cinfo, 2, JTRC_HUFFBITS,
481 	     bits[1], bits[2], bits[3], bits[4],
482 	     bits[5], bits[6], bits[7], bits[8]);
483     TRACEMS8(cinfo, 2, JTRC_HUFFBITS,
484 	     bits[9], bits[10], bits[11], bits[12],
485 	     bits[13], bits[14], bits[15], bits[16]);
486 
487     /* Here we just do minimal validation of the counts to avoid walking
488      * off the end of our table space.  jdhuff.c will check more carefully.
489      */
490     if (count > 256 || ((INT32) count) > length)
491       ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
492 
493     for (i = 0; i < count; i++)
494       INPUT_BYTE(cinfo, huffval[i], return FALSE);
495 
496     length -= count;
497 
498     if (index & 0x10) {		/* AC table definition */
499       index -= 0x10;
500       htblptr = &cinfo->ac_huff_tbl_ptrs[index];
501     } else {			/* DC table definition */
502       htblptr = &cinfo->dc_huff_tbl_ptrs[index];
503     }
504 
505     if (index < 0 || index >= NUM_HUFF_TBLS)
506       ERREXIT1(cinfo, JERR_DHT_INDEX, index);
507 
508     if (*htblptr == NULL)
509       *htblptr = jpeg_alloc_huff_table((j_common_ptr) cinfo);
510 
511     MEMCOPY((*htblptr)->bits, bits, SIZEOF((*htblptr)->bits));
512     MEMCOPY((*htblptr)->huffval, huffval, SIZEOF((*htblptr)->huffval));
513   }
514 
515   if (length != 0)
516     ERREXIT(cinfo, JERR_BAD_LENGTH);
517 
518   INPUT_SYNC(cinfo);
519   return TRUE;
520 }
521 
522 
523 LOCAL(boolean)
get_dqt(j_decompress_ptr cinfo)524 get_dqt (j_decompress_ptr cinfo)
525 /* Process a DQT marker */
526 {
527   INT32 length;
528   int n, i, prec;
529   unsigned int tmp;
530   JQUANT_TBL *quant_ptr;
531   INPUT_VARS(cinfo);
532 
533   INPUT_2BYTES(cinfo, length, return FALSE);
534   length -= 2;
535 
536   while (length > 0) {
537     INPUT_BYTE(cinfo, n, return FALSE);
538     prec = n >> 4;
539     n &= 0x0F;
540 
541     TRACEMS2(cinfo, 1, JTRC_DQT, n, prec);
542 
543     if (n >= NUM_QUANT_TBLS)
544       ERREXIT1(cinfo, JERR_DQT_INDEX, n);
545 
546     if (cinfo->quant_tbl_ptrs[n] == NULL)
547       cinfo->quant_tbl_ptrs[n] = jpeg_alloc_quant_table((j_common_ptr) cinfo);
548     quant_ptr = cinfo->quant_tbl_ptrs[n];
549 
550     for (i = 0; i < DCTSIZE2; i++) {
551       if (prec)
552 	INPUT_2BYTES(cinfo, tmp, return FALSE);
553       else
554 	INPUT_BYTE(cinfo, tmp, return FALSE);
555       /* We convert the zigzag-order table to natural array order. */
556       quant_ptr->quantval[jpeg_natural_order[i]] = (UINT16) tmp;
557     }
558 
559     if (cinfo->err->trace_level >= 2) {
560       for (i = 0; i < DCTSIZE2; i += 8) {
561 	TRACEMS8(cinfo, 2, JTRC_QUANTVALS,
562 		 quant_ptr->quantval[i],   quant_ptr->quantval[i+1],
563 		 quant_ptr->quantval[i+2], quant_ptr->quantval[i+3],
564 		 quant_ptr->quantval[i+4], quant_ptr->quantval[i+5],
565 		 quant_ptr->quantval[i+6], quant_ptr->quantval[i+7]);
566       }
567     }
568 
569     length -= DCTSIZE2+1;
570     if (prec) length -= DCTSIZE2;
571   }
572 
573   if (length != 0)
574     ERREXIT(cinfo, JERR_BAD_LENGTH);
575 
576   INPUT_SYNC(cinfo);
577   return TRUE;
578 }
579 
580 
581 LOCAL(boolean)
get_dri(j_decompress_ptr cinfo)582 get_dri (j_decompress_ptr cinfo)
583 /* Process a DRI marker */
584 {
585   INT32 length;
586   unsigned int tmp;
587   INPUT_VARS(cinfo);
588 
589   INPUT_2BYTES(cinfo, length, return FALSE);
590 
591   if (length != 4)
592     ERREXIT(cinfo, JERR_BAD_LENGTH);
593 
594   INPUT_2BYTES(cinfo, tmp, return FALSE);
595 
596   TRACEMS1(cinfo, 1, JTRC_DRI, tmp);
597 
598   cinfo->restart_interval = tmp;
599 
600   INPUT_SYNC(cinfo);
601   return TRUE;
602 }
603 
604 
605 /*
606  * Routines for processing APPn and COM markers.
607  * These are either saved in memory or discarded, per application request.
608  * APP0 and APP14 are specially checked to see if they are
609  * JFIF and Adobe markers, respectively.
610  */
611 
612 #define APP0_DATA_LEN	14	/* Length of interesting data in APP0 */
613 #define APP14_DATA_LEN	12	/* Length of interesting data in APP14 */
614 #define APPN_DATA_LEN	14	/* Must be the largest of the above!! */
615 
616 
617 LOCAL(void)
examine_app0(j_decompress_ptr cinfo,JOCTET FAR * data,unsigned int datalen,INT32 remaining)618 examine_app0 (j_decompress_ptr cinfo, JOCTET FAR * data,
619 	      unsigned int datalen, INT32 remaining)
620 /* Examine first few bytes from an APP0.
621  * Take appropriate action if it is a JFIF marker.
622  * datalen is # of bytes at data[], remaining is length of rest of marker data.
623  */
624 {
625   INT32 totallen = (INT32) datalen + remaining;
626 
627   if (datalen >= APP0_DATA_LEN &&
628       GETJOCTET(data[0]) == 0x4A &&
629       GETJOCTET(data[1]) == 0x46 &&
630       GETJOCTET(data[2]) == 0x49 &&
631       GETJOCTET(data[3]) == 0x46 &&
632       GETJOCTET(data[4]) == 0) {
633     /* Found JFIF APP0 marker: save info */
634     cinfo->saw_JFIF_marker = TRUE;
635     cinfo->JFIF_major_version = GETJOCTET(data[5]);
636     cinfo->JFIF_minor_version = GETJOCTET(data[6]);
637     cinfo->density_unit = GETJOCTET(data[7]);
638     cinfo->X_density = (GETJOCTET(data[8]) << 8) + GETJOCTET(data[9]);
639     cinfo->Y_density = (GETJOCTET(data[10]) << 8) + GETJOCTET(data[11]);
640     /* Check version.
641      * Major version must be 1, anything else signals an incompatible change.
642      * (We used to treat this as an error, but now it's a nonfatal warning,
643      * because some bozo at Hijaak couldn't read the spec.)
644      * Minor version should be 0..2, but process anyway if newer.
645      */
646     if (cinfo->JFIF_major_version != 1)
647       WARNMS2(cinfo, JWRN_JFIF_MAJOR,
648 	      cinfo->JFIF_major_version, cinfo->JFIF_minor_version);
649     /* Generate trace messages */
650     TRACEMS5(cinfo, 1, JTRC_JFIF,
651 	     cinfo->JFIF_major_version, cinfo->JFIF_minor_version,
652 	     cinfo->X_density, cinfo->Y_density, cinfo->density_unit);
653     /* Validate thumbnail dimensions and issue appropriate messages */
654     if (GETJOCTET(data[12]) | GETJOCTET(data[13]))
655       TRACEMS2(cinfo, 1, JTRC_JFIF_THUMBNAIL,
656 	       GETJOCTET(data[12]), GETJOCTET(data[13]));
657     totallen -= APP0_DATA_LEN;
658     if (totallen !=
659 	((INT32)GETJOCTET(data[12]) * (INT32)GETJOCTET(data[13]) * (INT32) 3))
660       TRACEMS1(cinfo, 1, JTRC_JFIF_BADTHUMBNAILSIZE, (int) totallen);
661   } else if (datalen >= 6 &&
662       GETJOCTET(data[0]) == 0x4A &&
663       GETJOCTET(data[1]) == 0x46 &&
664       GETJOCTET(data[2]) == 0x58 &&
665       GETJOCTET(data[3]) == 0x58 &&
666       GETJOCTET(data[4]) == 0) {
667     /* Found JFIF "JFXX" extension APP0 marker */
668     /* The library doesn't actually do anything with these,
669      * but we try to produce a helpful trace message.
670      */
671     switch (GETJOCTET(data[5])) {
672     case 0x10:
673       TRACEMS1(cinfo, 1, JTRC_THUMB_JPEG, (int) totallen);
674       break;
675     case 0x11:
676       TRACEMS1(cinfo, 1, JTRC_THUMB_PALETTE, (int) totallen);
677       break;
678     case 0x13:
679       TRACEMS1(cinfo, 1, JTRC_THUMB_RGB, (int) totallen);
680       break;
681     default:
682       TRACEMS2(cinfo, 1, JTRC_JFIF_EXTENSION,
683 	       GETJOCTET(data[5]), (int) totallen);
684       break;
685     }
686   } else {
687     /* Start of APP0 does not match "JFIF" or "JFXX", or too short */
688     TRACEMS1(cinfo, 1, JTRC_APP0, (int) totallen);
689   }
690 }
691 
692 
693 LOCAL(void)
examine_app14(j_decompress_ptr cinfo,JOCTET FAR * data,unsigned int datalen,INT32 remaining)694 examine_app14 (j_decompress_ptr cinfo, JOCTET FAR * data,
695 	       unsigned int datalen, INT32 remaining)
696 /* Examine first few bytes from an APP14.
697  * Take appropriate action if it is an Adobe marker.
698  * datalen is # of bytes at data[], remaining is length of rest of marker data.
699  */
700 {
701   unsigned int version, flags0, flags1, transform;
702 
703   if (datalen >= APP14_DATA_LEN &&
704       GETJOCTET(data[0]) == 0x41 &&
705       GETJOCTET(data[1]) == 0x64 &&
706       GETJOCTET(data[2]) == 0x6F &&
707       GETJOCTET(data[3]) == 0x62 &&
708       GETJOCTET(data[4]) == 0x65) {
709     /* Found Adobe APP14 marker */
710     version = (GETJOCTET(data[5]) << 8) + GETJOCTET(data[6]);
711     flags0 = (GETJOCTET(data[7]) << 8) + GETJOCTET(data[8]);
712     flags1 = (GETJOCTET(data[9]) << 8) + GETJOCTET(data[10]);
713     transform = GETJOCTET(data[11]);
714     TRACEMS4(cinfo, 1, JTRC_ADOBE, version, flags0, flags1, transform);
715     cinfo->saw_Adobe_marker = TRUE;
716     cinfo->Adobe_transform = (UINT8) transform;
717   } else {
718     /* Start of APP14 does not match "Adobe", or too short */
719     TRACEMS1(cinfo, 1, JTRC_APP14, (int) (datalen + remaining));
720   }
721 }
722 
723 
724 METHODDEF(boolean)
get_interesting_appn(j_decompress_ptr cinfo)725 get_interesting_appn (j_decompress_ptr cinfo)
726 /* Process an APP0 or APP14 marker without saving it */
727 {
728   INT32 length;
729   JOCTET b[APPN_DATA_LEN];
730   unsigned int i, numtoread;
731   INPUT_VARS(cinfo);
732 
733   INPUT_2BYTES(cinfo, length, return FALSE);
734   length -= 2;
735 
736   /* get the interesting part of the marker data */
737   if (length >= APPN_DATA_LEN)
738     numtoread = APPN_DATA_LEN;
739   else if (length > 0)
740     numtoread = (unsigned int) length;
741   else
742     numtoread = 0;
743   for (i = 0; i < numtoread; i++)
744     INPUT_BYTE(cinfo, b[i], return FALSE);
745   length -= numtoread;
746 
747   /* process it */
748   switch (cinfo->unread_marker) {
749   case M_APP0:
750     examine_app0(cinfo, (JOCTET FAR *) b, numtoread, length);
751     break;
752   case M_APP14:
753     examine_app14(cinfo, (JOCTET FAR *) b, numtoread, length);
754     break;
755   default:
756     /* can't get here unless jpeg_save_markers chooses wrong processor */
757     ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
758     break;
759   }
760 
761   /* skip any remaining data -- could be lots */
762   INPUT_SYNC(cinfo);
763   if (length > 0)
764     (*cinfo->src->skip_input_data) (cinfo, (long) length);
765 
766   return TRUE;
767 }
768 
769 
770 #ifdef SAVE_MARKERS_SUPPORTED
771 
772 METHODDEF(boolean)
save_marker(j_decompress_ptr cinfo)773 save_marker (j_decompress_ptr cinfo)
774 /* Save an APPn or COM marker into the marker list */
775 {
776   my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
777   jpeg_saved_marker_ptr cur_marker = marker->cur_marker;
778   unsigned int bytes_read, data_length;
779   JOCTET FAR * data;
780   INT32 length = 0;
781   INPUT_VARS(cinfo);
782 
783   if (cur_marker == NULL) {
784     /* begin reading a marker */
785     INPUT_2BYTES(cinfo, length, return FALSE);
786     length -= 2;
787     if (length >= 0) {		/* watch out for bogus length word */
788       /* figure out how much we want to save */
789       unsigned int limit;
790       if (cinfo->unread_marker == (int) M_COM)
791 	limit = marker->length_limit_COM;
792       else
793 	limit = marker->length_limit_APPn[cinfo->unread_marker - (int) M_APP0];
794       if ((unsigned int) length < limit)
795 	limit = (unsigned int) length;
796       /* allocate and initialize the marker item */
797       cur_marker = (jpeg_saved_marker_ptr)
798 	(*cinfo->mem->alloc_large) ((j_common_ptr) cinfo, JPOOL_IMAGE,
799 				    SIZEOF(struct jpeg_marker_struct) + limit);
800       cur_marker->next = NULL;
801       cur_marker->marker = (UINT8) cinfo->unread_marker;
802       cur_marker->original_length = (unsigned int) length;
803       cur_marker->data_length = limit;
804       /* data area is just beyond the jpeg_marker_struct */
805       data = cur_marker->data = (JOCTET FAR *) (cur_marker + 1);
806       marker->cur_marker = cur_marker;
807       marker->bytes_read = 0;
808       bytes_read = 0;
809       data_length = limit;
810     } else {
811       /* deal with bogus length word */
812       bytes_read = data_length = 0;
813       data = NULL;
814     }
815   } else {
816     /* resume reading a marker */
817     bytes_read = marker->bytes_read;
818     data_length = cur_marker->data_length;
819     data = cur_marker->data + bytes_read;
820   }
821 
822   while (bytes_read < data_length) {
823     INPUT_SYNC(cinfo);		/* move the restart point to here */
824     marker->bytes_read = bytes_read;
825     /* If there's not at least one byte in buffer, suspend */
826     MAKE_BYTE_AVAIL(cinfo, return FALSE);
827     /* Copy bytes with reasonable rapidity */
828     while (bytes_read < data_length && bytes_in_buffer > 0) {
829       *data++ = *next_input_byte++;
830       bytes_in_buffer--;
831       bytes_read++;
832     }
833   }
834 
835   /* Done reading what we want to read */
836   if (cur_marker != NULL) {	/* will be NULL if bogus length word */
837     /* Add new marker to end of list */
838     if (cinfo->marker_list == NULL) {
839       cinfo->marker_list = cur_marker;
840     } else {
841       jpeg_saved_marker_ptr prev = cinfo->marker_list;
842       while (prev->next != NULL)
843 	prev = prev->next;
844       prev->next = cur_marker;
845     }
846     /* Reset pointer & calc remaining data length */
847     data = cur_marker->data;
848     length = cur_marker->original_length - data_length;
849   }
850   /* Reset to initial state for next marker */
851   marker->cur_marker = NULL;
852 
853   /* Process the marker if interesting; else just make a generic trace msg */
854   switch (cinfo->unread_marker) {
855   case M_APP0:
856     examine_app0(cinfo, data, data_length, length);
857     break;
858   case M_APP14:
859     examine_app14(cinfo, data, data_length, length);
860     break;
861   default:
862     TRACEMS2(cinfo, 1, JTRC_MISC_MARKER, cinfo->unread_marker,
863 	     (int) (data_length + length));
864     break;
865   }
866 
867   /* skip any remaining data -- could be lots */
868   INPUT_SYNC(cinfo);		/* do before skip_input_data */
869   if (length > 0)
870     (*cinfo->src->skip_input_data) (cinfo, (long) length);
871 
872   return TRUE;
873 }
874 
875 #endif /* SAVE_MARKERS_SUPPORTED */
876 
877 
878 METHODDEF(boolean)
skip_variable(j_decompress_ptr cinfo)879 skip_variable (j_decompress_ptr cinfo)
880 /* Skip over an unknown or uninteresting variable-length marker */
881 {
882   INT32 length;
883   INPUT_VARS(cinfo);
884 
885   INPUT_2BYTES(cinfo, length, return FALSE);
886   length -= 2;
887 
888   TRACEMS2(cinfo, 1, JTRC_MISC_MARKER, cinfo->unread_marker, (int) length);
889 
890   INPUT_SYNC(cinfo);		/* do before skip_input_data */
891   if (length > 0)
892     (*cinfo->src->skip_input_data) (cinfo, (long) length);
893 
894   return TRUE;
895 }
896 
897 
898 /*
899  * Find the next JPEG marker, save it in cinfo->unread_marker.
900  * Returns FALSE if had to suspend before reaching a marker;
901  * in that case cinfo->unread_marker is unchanged.
902  *
903  * Note that the result might not be a valid marker code,
904  * but it will never be 0 or FF.
905  */
906 
907 LOCAL(boolean)
next_marker(j_decompress_ptr cinfo)908 next_marker (j_decompress_ptr cinfo)
909 {
910   int c;
911   INPUT_VARS(cinfo);
912 
913   for (;;) {
914     INPUT_BYTE(cinfo, c, return FALSE);
915     /* Skip any non-FF bytes.
916      * This may look a bit inefficient, but it will not occur in a valid file.
917      * We sync after each discarded byte so that a suspending data source
918      * can discard the byte from its buffer.
919      */
920     while (c != 0xFF) {
921       cinfo->marker->discarded_bytes++;
922       INPUT_SYNC(cinfo);
923       INPUT_BYTE(cinfo, c, return FALSE);
924     }
925     /* This loop swallows any duplicate FF bytes.  Extra FFs are legal as
926      * pad bytes, so don't count them in discarded_bytes.  We assume there
927      * will not be so many consecutive FF bytes as to overflow a suspending
928      * data source's input buffer.
929      */
930     do {
931       INPUT_BYTE(cinfo, c, return FALSE);
932     } while (c == 0xFF);
933     if (c != 0)
934       break;			/* found a valid marker, exit loop */
935     /* Reach here if we found a stuffed-zero data sequence (FF/00).
936      * Discard it and loop back to try again.
937      */
938     cinfo->marker->discarded_bytes += 2;
939     INPUT_SYNC(cinfo);
940   }
941 
942   if (cinfo->marker->discarded_bytes != 0) {
943     WARNMS2(cinfo, JWRN_EXTRANEOUS_DATA, cinfo->marker->discarded_bytes, c);
944     cinfo->marker->discarded_bytes = 0;
945   }
946 
947   cinfo->unread_marker = c;
948 
949   INPUT_SYNC(cinfo);
950   return TRUE;
951 }
952 
953 
954 LOCAL(boolean)
first_marker(j_decompress_ptr cinfo)955 first_marker (j_decompress_ptr cinfo)
956 /* Like next_marker, but used to obtain the initial SOI marker. */
957 /* For this marker, we do not allow preceding garbage or fill; otherwise,
958  * we might well scan an entire input file before realizing it ain't JPEG.
959  * If an application wants to process non-JFIF files, it must seek to the
960  * SOI before calling the JPEG library.
961  */
962 {
963   int c, c2;
964   INPUT_VARS(cinfo);
965 
966   INPUT_BYTE(cinfo, c, return FALSE);
967   INPUT_BYTE(cinfo, c2, return FALSE);
968   if (c != 0xFF || c2 != (int) M_SOI)
969     ERREXIT2(cinfo, JERR_NO_SOI, c, c2);
970 
971   cinfo->unread_marker = c2;
972 
973   INPUT_SYNC(cinfo);
974   return TRUE;
975 }
976 
977 
978 /*
979  * Read markers until SOS or EOI.
980  *
981  * Returns same codes as are defined for jpeg_consume_input:
982  * JPEG_SUSPENDED, JPEG_REACHED_SOS, or JPEG_REACHED_EOI.
983  */
984 
985 METHODDEF(int)
read_markers(j_decompress_ptr cinfo)986 read_markers (j_decompress_ptr cinfo)
987 {
988   /* Outer loop repeats once for each marker. */
989   for (;;) {
990     /* Collect the marker proper, unless we already did. */
991     /* NB: first_marker() enforces the requirement that SOI appear first. */
992     if (cinfo->unread_marker == 0) {
993       if (! cinfo->marker->saw_SOI) {
994 	if (! first_marker(cinfo))
995 	  return JPEG_SUSPENDED;
996       } else {
997 	if (! next_marker(cinfo))
998 	  return JPEG_SUSPENDED;
999       }
1000     }
1001     /* At this point cinfo->unread_marker contains the marker code and the
1002      * input point is just past the marker proper, but before any parameters.
1003      * A suspension will cause us to return with this state still true.
1004      */
1005     switch (cinfo->unread_marker) {
1006     case M_SOI:
1007       if (! get_soi(cinfo))
1008 	return JPEG_SUSPENDED;
1009       break;
1010 
1011     case M_SOF0:		/* Baseline */
1012     case M_SOF1:		/* Extended sequential, Huffman */
1013       if (! get_sof(cinfo, FALSE, FALSE))
1014 	return JPEG_SUSPENDED;
1015       break;
1016 
1017     case M_SOF2:		/* Progressive, Huffman */
1018       if (! get_sof(cinfo, TRUE, FALSE))
1019 	return JPEG_SUSPENDED;
1020       break;
1021 
1022     case M_SOF9:		/* Extended sequential, arithmetic */
1023       if (! get_sof(cinfo, FALSE, TRUE))
1024 	return JPEG_SUSPENDED;
1025       break;
1026 
1027     case M_SOF10:		/* Progressive, arithmetic */
1028       if (! get_sof(cinfo, TRUE, TRUE))
1029 	return JPEG_SUSPENDED;
1030       break;
1031 
1032     /* Currently unsupported SOFn types */
1033     case M_SOF3:		/* Lossless, Huffman */
1034     case M_SOF5:		/* Differential sequential, Huffman */
1035     case M_SOF6:		/* Differential progressive, Huffman */
1036     case M_SOF7:		/* Differential lossless, Huffman */
1037     case M_JPG:			/* Reserved for JPEG extensions */
1038     case M_SOF11:		/* Lossless, arithmetic */
1039     case M_SOF13:		/* Differential sequential, arithmetic */
1040     case M_SOF14:		/* Differential progressive, arithmetic */
1041     case M_SOF15:		/* Differential lossless, arithmetic */
1042       ERREXIT1(cinfo, JERR_SOF_UNSUPPORTED, cinfo->unread_marker);
1043       break;
1044 
1045     case M_SOS:
1046       if (! get_sos(cinfo))
1047 	return JPEG_SUSPENDED;
1048       cinfo->unread_marker = 0;	/* processed the marker */
1049       return JPEG_REACHED_SOS;
1050 
1051     case M_EOI:
1052       TRACEMS(cinfo, 1, JTRC_EOI);
1053       cinfo->unread_marker = 0;	/* processed the marker */
1054       return JPEG_REACHED_EOI;
1055 
1056     case M_DAC:
1057       if (! get_dac(cinfo))
1058 	return JPEG_SUSPENDED;
1059       break;
1060 
1061     case M_DHT:
1062       if (! get_dht(cinfo))
1063 	return JPEG_SUSPENDED;
1064       break;
1065 
1066     case M_DQT:
1067       if (! get_dqt(cinfo))
1068 	return JPEG_SUSPENDED;
1069       break;
1070 
1071     case M_DRI:
1072       if (! get_dri(cinfo))
1073 	return JPEG_SUSPENDED;
1074       break;
1075 
1076     case M_APP0:
1077     case M_APP1:
1078     case M_APP2:
1079     case M_APP3:
1080     case M_APP4:
1081     case M_APP5:
1082     case M_APP6:
1083     case M_APP7:
1084     case M_APP8:
1085     case M_APP9:
1086     case M_APP10:
1087     case M_APP11:
1088     case M_APP12:
1089     case M_APP13:
1090     case M_APP14:
1091     case M_APP15:
1092       if (! (*((my_marker_ptr) cinfo->marker)->process_APPn[
1093 		cinfo->unread_marker - (int) M_APP0]) (cinfo))
1094 	return JPEG_SUSPENDED;
1095       break;
1096 
1097     case M_COM:
1098       if (! (*((my_marker_ptr) cinfo->marker)->process_COM) (cinfo))
1099 	return JPEG_SUSPENDED;
1100       break;
1101 
1102     case M_RST0:		/* these are all parameterless */
1103     case M_RST1:
1104     case M_RST2:
1105     case M_RST3:
1106     case M_RST4:
1107     case M_RST5:
1108     case M_RST6:
1109     case M_RST7:
1110     case M_TEM:
1111       TRACEMS1(cinfo, 1, JTRC_PARMLESS_MARKER, cinfo->unread_marker);
1112       break;
1113 
1114     case M_DNL:			/* Ignore DNL ... perhaps the wrong thing */
1115       if (! skip_variable(cinfo))
1116 	return JPEG_SUSPENDED;
1117       break;
1118 
1119     default:			/* must be DHP, EXP, JPGn, or RESn */
1120       /* For now, we treat the reserved markers as fatal errors since they are
1121        * likely to be used to signal incompatible JPEG Part 3 extensions.
1122        * Once the JPEG 3 version-number marker is well defined, this code
1123        * ought to change!
1124        */
1125       ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, cinfo->unread_marker);
1126       break;
1127     }
1128     /* Successfully processed marker, so reset state variable */
1129     cinfo->unread_marker = 0;
1130   } /* end loop */
1131 }
1132 
1133 
1134 /*
1135  * Read a restart marker, which is expected to appear next in the datastream;
1136  * if the marker is not there, take appropriate recovery action.
1137  * Returns FALSE if suspension is required.
1138  *
1139  * This is called by the entropy decoder after it has read an appropriate
1140  * number of MCUs.  cinfo->unread_marker may be nonzero if the entropy decoder
1141  * has already read a marker from the data source.  Under normal conditions
1142  * cinfo->unread_marker will be reset to 0 before returning; if not reset,
1143  * it holds a marker which the decoder will be unable to read past.
1144  */
1145 
1146 METHODDEF(boolean)
read_restart_marker(j_decompress_ptr cinfo)1147 read_restart_marker (j_decompress_ptr cinfo)
1148 {
1149   /* Obtain a marker unless we already did. */
1150   /* Note that next_marker will complain if it skips any data. */
1151   if (cinfo->unread_marker == 0) {
1152     if (! next_marker(cinfo))
1153       return FALSE;
1154   }
1155 
1156   if (cinfo->unread_marker ==
1157       ((int) M_RST0 + cinfo->marker->next_restart_num)) {
1158     /* Normal case --- swallow the marker and let entropy decoder continue */
1159     TRACEMS1(cinfo, 3, JTRC_RST, cinfo->marker->next_restart_num);
1160     cinfo->unread_marker = 0;
1161   } else {
1162     /* Uh-oh, the restart markers have been messed up. */
1163     /* Let the data source manager determine how to resync. */
1164     if (! (*cinfo->src->resync_to_restart) (cinfo,
1165 					    cinfo->marker->next_restart_num))
1166       return FALSE;
1167   }
1168 
1169   /* Update next-restart state */
1170   cinfo->marker->next_restart_num = (cinfo->marker->next_restart_num + 1) & 7;
1171 
1172   return TRUE;
1173 }
1174 
1175 
1176 /*
1177  * This is the default resync_to_restart method for data source managers
1178  * to use if they don't have any better approach.  Some data source managers
1179  * may be able to back up, or may have additional knowledge about the data
1180  * which permits a more intelligent recovery strategy; such managers would
1181  * presumably supply their own resync method.
1182  *
1183  * read_restart_marker calls resync_to_restart if it finds a marker other than
1184  * the restart marker it was expecting.  (This code is *not* used unless
1185  * a nonzero restart interval has been declared.)  cinfo->unread_marker is
1186  * the marker code actually found (might be anything, except 0 or FF).
1187  * The desired restart marker number (0..7) is passed as a parameter.
1188  * This routine is supposed to apply whatever error recovery strategy seems
1189  * appropriate in order to position the input stream to the next data segment.
1190  * Note that cinfo->unread_marker is treated as a marker appearing before
1191  * the current data-source input point; usually it should be reset to zero
1192  * before returning.
1193  * Returns FALSE if suspension is required.
1194  *
1195  * This implementation is substantially constrained by wanting to treat the
1196  * input as a data stream; this means we can't back up.  Therefore, we have
1197  * only the following actions to work with:
1198  *   1. Simply discard the marker and let the entropy decoder resume at next
1199  *      byte of file.
1200  *   2. Read forward until we find another marker, discarding intervening
1201  *      data.  (In theory we could look ahead within the current bufferload,
1202  *      without having to discard data if we don't find the desired marker.
1203  *      This idea is not implemented here, in part because it makes behavior
1204  *      dependent on buffer size and chance buffer-boundary positions.)
1205  *   3. Leave the marker unread (by failing to zero cinfo->unread_marker).
1206  *      This will cause the entropy decoder to process an empty data segment,
1207  *      inserting dummy zeroes, and then we will reprocess the marker.
1208  *
1209  * #2 is appropriate if we think the desired marker lies ahead, while #3 is
1210  * appropriate if the found marker is a future restart marker (indicating
1211  * that we have missed the desired restart marker, probably because it got
1212  * corrupted).
1213  * We apply #2 or #3 if the found marker is a restart marker no more than
1214  * two counts behind or ahead of the expected one.  We also apply #2 if the
1215  * found marker is not a legal JPEG marker code (it's certainly bogus data).
1216  * If the found marker is a restart marker more than 2 counts away, we do #1
1217  * (too much risk that the marker is erroneous; with luck we will be able to
1218  * resync at some future point).
1219  * For any valid non-restart JPEG marker, we apply #3.  This keeps us from
1220  * overrunning the end of a scan.  An implementation limited to single-scan
1221  * files might find it better to apply #2 for markers other than EOI, since
1222  * any other marker would have to be bogus data in that case.
1223  */
1224 
1225 GLOBAL(boolean)
jpeg_resync_to_restart(j_decompress_ptr cinfo,int desired)1226 jpeg_resync_to_restart (j_decompress_ptr cinfo, int desired)
1227 {
1228   int marker = cinfo->unread_marker;
1229   int action = 1;
1230 
1231   /* Always put up a warning. */
1232   WARNMS2(cinfo, JWRN_MUST_RESYNC, marker, desired);
1233 
1234   /* Outer loop handles repeated decision after scanning forward. */
1235   for (;;) {
1236     if (marker < (int) M_SOF0)
1237       action = 2;		/* invalid marker */
1238     else if (marker < (int) M_RST0 || marker > (int) M_RST7)
1239       action = 3;		/* valid non-restart marker */
1240     else {
1241       if (marker == ((int) M_RST0 + ((desired+1) & 7)) ||
1242 	  marker == ((int) M_RST0 + ((desired+2) & 7)))
1243 	action = 3;		/* one of the next two expected restarts */
1244       else if (marker == ((int) M_RST0 + ((desired-1) & 7)) ||
1245 	       marker == ((int) M_RST0 + ((desired-2) & 7)))
1246 	action = 2;		/* a prior restart, so advance */
1247       else
1248 	action = 1;		/* desired restart or too far away */
1249     }
1250     TRACEMS2(cinfo, 4, JTRC_RECOVERY_ACTION, marker, action);
1251     switch (action) {
1252     case 1:
1253       /* Discard marker and let entropy decoder resume processing. */
1254       cinfo->unread_marker = 0;
1255       return TRUE;
1256     case 2:
1257       /* Scan to the next marker, and repeat the decision loop. */
1258       if (! next_marker(cinfo))
1259 	return FALSE;
1260       marker = cinfo->unread_marker;
1261       break;
1262     case 3:
1263       /* Return without advancing past this marker. */
1264       /* Entropy decoder will be forced to process an empty segment. */
1265       return TRUE;
1266     }
1267   } /* end loop */
1268 }
1269 
1270 
1271 /*
1272  * Reset marker processing state to begin a fresh datastream.
1273  */
1274 
1275 METHODDEF(void)
reset_marker_reader(j_decompress_ptr cinfo)1276 reset_marker_reader (j_decompress_ptr cinfo)
1277 {
1278   my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
1279 
1280   cinfo->comp_info = NULL;		/* until allocated by get_sof */
1281   cinfo->input_scan_number = 0;		/* no SOS seen yet */
1282   cinfo->unread_marker = 0;		/* no pending marker */
1283   marker->pub.saw_SOI = FALSE;		/* set internal state too */
1284   marker->pub.saw_SOF = FALSE;
1285   marker->pub.discarded_bytes = 0;
1286   marker->cur_marker = NULL;
1287 }
1288 
1289 
1290 /*
1291  * Initialize the marker reader module.
1292  * This is called only once, when the decompression object is created.
1293  */
1294 
1295 GLOBAL(void)
jinit_marker_reader(j_decompress_ptr cinfo)1296 jinit_marker_reader (j_decompress_ptr cinfo)
1297 {
1298   my_marker_ptr marker;
1299   int i;
1300 
1301   /* Create subobject in permanent pool */
1302   marker = (my_marker_ptr)
1303     (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_PERMANENT,
1304 				SIZEOF(my_marker_reader));
1305   cinfo->marker = (struct jpeg_marker_reader *) marker;
1306   /* Initialize public method pointers */
1307   marker->pub.reset_marker_reader = reset_marker_reader;
1308   marker->pub.read_markers = read_markers;
1309   marker->pub.read_restart_marker = read_restart_marker;
1310   /* Initialize COM/APPn processing.
1311    * By default, we examine and then discard APP0 and APP14,
1312    * but simply discard COM and all other APPn.
1313    */
1314   marker->process_COM = skip_variable;
1315   marker->length_limit_COM = 0;
1316   for (i = 0; i < 16; i++) {
1317     marker->process_APPn[i] = skip_variable;
1318     marker->length_limit_APPn[i] = 0;
1319   }
1320   marker->process_APPn[0] = get_interesting_appn;
1321   marker->process_APPn[14] = get_interesting_appn;
1322   /* Reset marker processing state */
1323   reset_marker_reader(cinfo);
1324 }
1325 
1326 
1327 /*
1328  * Control saving of COM and APPn markers into marker_list.
1329  */
1330 
1331 #ifdef SAVE_MARKERS_SUPPORTED
1332 
1333 GLOBAL(void)
jpeg_save_markers(j_decompress_ptr cinfo,int marker_code,unsigned int length_limit)1334 jpeg_save_markers (j_decompress_ptr cinfo, int marker_code,
1335 		   unsigned int length_limit)
1336 {
1337   my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
1338   long maxlength;
1339   jpeg_marker_parser_method processor;
1340 
1341   /* Length limit mustn't be larger than what we can allocate
1342    * (should only be a concern in a 16-bit environment).
1343    */
1344   maxlength = cinfo->mem->max_alloc_chunk - SIZEOF(struct jpeg_marker_struct);
1345   if (((long) length_limit) > maxlength)
1346     length_limit = (unsigned int) maxlength;
1347 
1348   /* Choose processor routine to use.
1349    * APP0/APP14 have special requirements.
1350    */
1351   if (length_limit) {
1352     processor = save_marker;
1353     /* If saving APP0/APP14, save at least enough for our internal use. */
1354     if (marker_code == (int) M_APP0 && length_limit < APP0_DATA_LEN)
1355       length_limit = APP0_DATA_LEN;
1356     else if (marker_code == (int) M_APP14 && length_limit < APP14_DATA_LEN)
1357       length_limit = APP14_DATA_LEN;
1358   } else {
1359     processor = skip_variable;
1360     /* If discarding APP0/APP14, use our regular on-the-fly processor. */
1361     if (marker_code == (int) M_APP0 || marker_code == (int) M_APP14)
1362       processor = get_interesting_appn;
1363   }
1364 
1365   if (marker_code == (int) M_COM) {
1366     marker->process_COM = processor;
1367     marker->length_limit_COM = length_limit;
1368   } else if (marker_code >= (int) M_APP0 && marker_code <= (int) M_APP15) {
1369     marker->process_APPn[marker_code - (int) M_APP0] = processor;
1370     marker->length_limit_APPn[marker_code - (int) M_APP0] = length_limit;
1371   } else
1372     ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
1373 }
1374 
1375 #endif /* SAVE_MARKERS_SUPPORTED */
1376 
1377 
1378 /*
1379  * Install a special processing method for COM or APPn markers.
1380  */
1381 
1382 GLOBAL(void)
jpeg_set_marker_processor(j_decompress_ptr cinfo,int marker_code,jpeg_marker_parser_method routine)1383 jpeg_set_marker_processor (j_decompress_ptr cinfo, int marker_code,
1384 			   jpeg_marker_parser_method routine)
1385 {
1386   my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
1387 
1388   if (marker_code == (int) M_COM)
1389     marker->process_COM = routine;
1390   else if (marker_code >= (int) M_APP0 && marker_code <= (int) M_APP15)
1391     marker->process_APPn[marker_code - (int) M_APP0] = routine;
1392   else
1393     ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
1394 }
1395 
1396 #endif //_FX_JPEG_TURBO_
1397