Mercurial > libavcodec.hg
annotate faxcompr.c @ 8476:0a0d7c4f2cf3 libavcodec
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
be written over the end of the runs array.
author | michael |
---|---|
date | Fri, 26 Dec 2008 16:29:01 +0000 |
parents | b7e5b6350969 |
children | 5f85d21a70b2 |
rev | line source |
---|---|
8466 | 1 /* |
2 * CCITT Fax Group 3 and 4 decompression | |
3 * Copyright (c) 2008 Konstantin Shishkov | |
4 * | |
5 * This file is part of FFmpeg. | |
6 * | |
7 * FFmpeg is free software; you can redistribute it and/or | |
8 * modify it under the terms of the GNU Lesser General Public | |
9 * License as published by the Free Software Foundation; either | |
10 * version 2.1 of the License, or (at your option) any later version. | |
11 * | |
12 * FFmpeg is distributed in the hope that it will be useful, | |
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
15 * Lesser General Public License for more details. | |
16 * | |
17 * You should have received a copy of the GNU Lesser General Public | |
18 * License along with FFmpeg; if not, write to the Free Software | |
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA | |
20 */ | |
21 | |
22 /** | |
23 * CCITT Fax Group 3 and 4 decompression | |
24 * @file faxcompr.c | |
25 * @author Konstantin Shishkov | |
26 */ | |
27 #include "avcodec.h" | |
28 #include "bitstream.h" | |
29 #include "faxcompr.h" | |
30 | |
31 #define CCITT_SYMS 104 | |
32 | |
33 static const uint16_t ccitt_syms[CCITT_SYMS] = { | |
34 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, | |
35 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, | |
36 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, | |
37 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, | |
38 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, | |
39 128, 192, 256, 320, 384, 448, 512, 576, 640, 704, 768, 832, 896, | |
40 960, 1024, 1088, 1152, 1216, 1280, 1344, 1408, 1472, 1536, 1600, 1664, 1728, | |
41 1792, 1856, 1920, 1984, 2048, 2112, 2176, 2240, 2304, 2368, 2432, 2496, 2560 | |
42 }; | |
43 | |
44 static const uint8_t ccitt_codes_bits[2][CCITT_SYMS] = | |
45 { | |
46 { | |
47 0x35, 0x07, 0x07, 0x08, 0x0B, 0x0C, 0x0E, 0x0F, 0x13, 0x14, 0x07, 0x08, 0x08, | |
48 0x03, 0x34, 0x35, 0x2A, 0x2B, 0x27, 0x0C, 0x08, 0x17, 0x03, 0x04, 0x28, 0x2B, | |
49 0x13, 0x24, 0x18, 0x02, 0x03, 0x1A, 0x1B, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, | |
50 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x04, 0x05, 0x0A, 0x0B, 0x52, 0x53, 0x54, | |
51 0x55, 0x24, 0x25, 0x58, 0x59, 0x5A, 0x5B, 0x4A, 0x4B, 0x32, 0x33, 0x34, 0x1B, | |
52 0x12, 0x17, 0x37, 0x36, 0x37, 0x64, 0x65, 0x68, 0x67, 0xCC, 0xCD, 0xD2, 0xD3, | |
53 0xD4, 0xD5, 0xD6, 0xD7, 0xD8, 0xD9, 0xDA, 0xDB, 0x98, 0x99, 0x9A, 0x18, 0x9B, | |
54 0x08, 0x0C, 0x0D, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x1C, 0x1D, 0x1E, 0x1F | |
55 }, | |
56 { | |
57 0x37, 0x02, 0x03, 0x02, 0x03, 0x03, 0x02, 0x03, 0x05, 0x04, 0x04, 0x05, 0x07, | |
58 0x04, 0x07, 0x18, 0x17, 0x18, 0x08, 0x67, 0x68, 0x6C, 0x37, 0x28, 0x17, 0x18, | |
59 0xCA, 0xCB, 0xCC, 0xCD, 0x68, 0x69, 0x6A, 0x6B, 0xD2, 0xD3, 0xD4, 0xD5, 0xD6, | |
60 0xD7, 0x6C, 0x6D, 0xDA, 0xDB, 0x54, 0x55, 0x56, 0x57, 0x64, 0x65, 0x52, 0x53, | |
61 0x24, 0x37, 0x38, 0x27, 0x28, 0x58, 0x59, 0x2B, 0x2C, 0x5A, 0x66, 0x67, 0x0F, | |
62 0xC8, 0xC9, 0x5B, 0x33, 0x34, 0x35, 0x6C, 0x6D, 0x4A, 0x4B, 0x4C, 0x4D, 0x72, | |
63 0x73, 0x74, 0x75, 0x76, 0x77, 0x52, 0x53, 0x54, 0x55, 0x5A, 0x5B, 0x64, 0x65, | |
64 0x08, 0x0C, 0x0D, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x1C, 0x1D, 0x1E, 0x1F | |
65 } | |
66 }; | |
67 | |
68 static const uint8_t ccitt_codes_lens[2][CCITT_SYMS] = | |
69 { | |
70 { | |
71 8, 6, 4, 4, 4, 4, 4, 4, 5, 5, 5, 5, 6, 6, 6, 6, 6, 6, 7, 7, | |
72 7, 7, 7, 7, 7, 7, 7, 7, 7, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, | |
73 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, | |
74 8, 8, 8, 8, 5, 5, 6, 7, 8, 8, 8, 8, 8, 8, 9, 9, 9, 9, 9, 9, | |
75 9, 9, 9, 9, 9, 9, 9, 9, 9, 6, 9, 11, 11, 11, 12, 12, 12, 12, 12, 12, | |
76 12, 12, 12, 12 | |
77 }, | |
78 { | |
79 10, 3, 2, 2, 3, 4, 4, 5, 6, 6, 7, 7, 7, 8, 8, 9, 10, 10, 10, 11, | |
80 11, 11, 11, 11, 11, 11, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, | |
81 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, | |
82 12, 12, 12, 12, 10, 12, 12, 12, 12, 12, 12, 13, 13, 13, 13, 13, 13, 13, 13, 13, | |
83 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 11, 11, 11, 12, 12, 12, 12, 12, 12, | |
84 12, 12, 12, 12 | |
85 } | |
86 }; | |
87 | |
88 static const uint8_t ccitt_group3_2d_bits[11] = { | |
89 1, 1, 2, 2, 2, 1, 3, 3, 3, 1, 1 | |
90 }; | |
91 | |
92 static const uint8_t ccitt_group3_2d_lens[11] = { | |
93 4, 3, 7, 6, 3, 1, 3, 6, 7, 7, 9 | |
94 }; | |
95 | |
96 static VLC ccitt_vlc[2], ccitt_group3_2d_vlc; | |
97 | |
98 av_cold void ff_ccitt_unpack_init() | |
99 { | |
100 static VLC_TYPE code_table1[528][2]; | |
101 static VLC_TYPE code_table2[648][2]; | |
102 int i; | |
103 static int initialized = 0; | |
104 | |
105 if(initialized) | |
106 return; | |
107 ccitt_vlc[0].table = code_table1; | |
108 ccitt_vlc[0].table_allocated = 528; | |
109 ccitt_vlc[1].table = code_table2; | |
110 ccitt_vlc[1].table_allocated = 648; | |
111 for(i = 0; i < 2; i++){ | |
112 init_vlc_sparse(&ccitt_vlc[i], 9, CCITT_SYMS, | |
113 ccitt_codes_lens[i], 1, 1, | |
114 ccitt_codes_bits[i], 1, 1, | |
115 ccitt_syms, 2, 2, | |
116 INIT_VLC_USE_NEW_STATIC); | |
117 } | |
118 INIT_VLC_STATIC(&ccitt_group3_2d_vlc, 9, 11, | |
119 ccitt_group3_2d_lens, 1, 1, | |
120 ccitt_group3_2d_bits, 1, 1, 512); | |
121 initialized = 1; | |
122 } | |
123 | |
124 | |
125 static int decode_group3_1d_line(AVCodecContext *avctx, GetBitContext *gb, | |
8476
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
126 int pix_left, int *runs, const int *runend) |
8466 | 127 { |
128 int mode = 0, run = 0; | |
129 unsigned int t; | |
130 for(;;){ | |
131 t = get_vlc2(gb, ccitt_vlc[mode].table, 9, 2); | |
132 run += t; | |
133 if(t < 64){ | |
134 pix_left -= run; | |
135 *runs++ = run; | |
8476
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
136 if(runs >= runend){ |
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
137 av_log(avctx, AV_LOG_ERROR, "Run overrun\n"); |
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
138 return -1; |
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
139 } |
8466 | 140 if(pix_left <= 0){ |
141 if(!pix_left) | |
142 break; | |
8473 | 143 runs[-1] += pix_left; |
8466 | 144 av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n"); |
145 return -1; | |
146 } | |
147 run = 0; | |
148 mode = !mode; | |
149 }else if((int)t == -1){ | |
150 av_log(avctx, AV_LOG_ERROR, "Incorrect code\n"); | |
151 return -1; | |
152 } | |
153 } | |
154 *runs++ = 0; | |
155 return 0; | |
156 } | |
157 | |
158 static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb, | |
8476
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
159 int pix_left, int *runs, const int *runend, const int *ref) |
8466 | 160 { |
161 int mode = 0, offs = 0, run = 0, saved_run = 0, t; | |
162 int run_off = *ref++; | |
163 int *run_start = runs; | |
164 | |
8476
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
165 runend--; // for the last written 0 |
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
166 |
8466 | 167 while(pix_left > 0){ |
168 int cmode = get_vlc2(gb, ccitt_group3_2d_vlc.table, 9, 1); | |
169 if(cmode == -1){ | |
170 av_log(avctx, AV_LOG_ERROR, "Incorrect mode VLC\n"); | |
171 return -1; | |
172 } | |
173 //sync line pointers | |
174 if(runs != run_start)while(run_off <= offs && run_off < avctx->width){ | |
175 run_off += *ref++; | |
176 run_off += *ref++; | |
177 } | |
178 if(!cmode){//pass mode | |
179 run_off += *ref++; | |
180 run = run_off - offs; | |
181 run_off += *ref++; | |
182 pix_left -= run; | |
183 if(pix_left < 0){ | |
184 av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n"); | |
185 return -1; | |
186 } | |
187 offs += run; | |
188 saved_run += run; | |
189 }else if(cmode == 1){//horizontal mode | |
190 int k; | |
191 for(k = 0; k < 2; k++){ | |
192 run = 0; | |
193 for(;;){ | |
194 t = get_vlc2(gb, ccitt_vlc[mode].table, 9, 2); | |
195 if(t == -1){ | |
196 av_log(avctx, AV_LOG_ERROR, "Incorrect code\n"); | |
197 return -1; | |
198 } | |
199 run += t; | |
200 if(t < 64) | |
201 break; | |
202 } | |
203 *runs++ = run + saved_run; | |
8476
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
204 if(runs >= runend){ |
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
205 av_log(avctx, AV_LOG_ERROR, "Run overrun\n"); |
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
206 return -1; |
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
207 } |
8466 | 208 saved_run = 0; |
8475 | 209 pix_left -= run; |
210 if(pix_left < 0){ | |
8466 | 211 av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n"); |
212 return -1; | |
213 } | |
214 offs += run; | |
215 mode = !mode; | |
216 } | |
217 }else if(cmode == 9 || cmode == 10){ | |
218 av_log(avctx, AV_LOG_ERROR, "Special modes are not supported (yet)\n"); | |
219 return -1; | |
220 }else{//vertical mode | |
221 run = run_off - offs + (cmode - 5); | |
222 if(cmode >= 5) | |
223 run_off += *ref++; | |
224 else | |
225 run_off -= *--ref; | |
226 pix_left -= run; | |
227 if(pix_left < 0){ | |
228 av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n"); | |
229 return -1; | |
230 } | |
231 offs += run; | |
232 *runs++ = run + saved_run; | |
8476
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
233 if(runs >= runend){ |
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
234 av_log(avctx, AV_LOG_ERROR, "Run overrun\n"); |
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
235 return -1; |
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
236 } |
8466 | 237 saved_run = 0; |
238 mode = !mode; | |
239 } | |
240 } | |
241 *runs++ = saved_run; | |
242 *runs++ = 0; | |
243 return 0; | |
244 } | |
245 | |
246 static void put_line(uint8_t *dst, int size, int width, const int *runs) | |
247 { | |
248 PutBitContext pb; | |
8469 | 249 int run, mode = ~0, pix_left = width, run_idx = 0; |
8466 | 250 |
251 init_put_bits(&pb, dst, size*8); | |
252 while(pix_left > 0){ | |
253 run = runs[run_idx++]; | |
8469 | 254 mode = ~mode; |
8466 | 255 pix_left -= run; |
256 for(; run > 16; run -= 16) | |
8469 | 257 put_sbits(&pb, 16, mode); |
8470 | 258 if(run) |
8471 | 259 put_sbits(&pb, run, mode); |
8466 | 260 } |
261 } | |
262 | |
263 static int find_group3_syncmarker(GetBitContext *gb, int srcsize) | |
264 { | |
8467 | 265 unsigned int state = -1; |
266 srcsize -= get_bits_count(gb); | |
267 while(srcsize-- > 0){ | |
268 state+= state + get_bits1(gb); | |
8472 | 269 if((state & 0xFFF) == 1) |
8467 | 270 return 0; |
8466 | 271 } |
8467 | 272 return -1; |
8466 | 273 } |
274 | |
8474 | 275 int ff_ccitt_unpack(AVCodecContext *avctx, |
8466 | 276 const uint8_t *src, int srcsize, |
8474 | 277 uint8_t *dst, int height, int stride, enum TiffCompr compr) |
8466 | 278 { |
279 int j; | |
280 GetBitContext gb; | |
8476
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
281 int *runs, *ref, *runend; |
8466 | 282 int ret; |
283 | |
284 runs = av_malloc((avctx->width + 2) * sizeof(runs[0])); | |
285 ref = av_malloc((avctx->width + 2) * sizeof(ref[0])); | |
286 ref[0] = avctx->width; | |
287 ref[1] = 0; | |
288 ref[2] = 0; | |
289 init_get_bits(&gb, src, srcsize*8); | |
290 for(j = 0; j < height; j++){ | |
8476
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
291 runend = runs + avctx->width + 2; |
8474 | 292 if(compr == TIFF_G4){ |
8476
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
293 ret = decode_group3_2d_line(avctx, &gb, avctx->width, runs, runend, ref); |
8466 | 294 if(ret < 0){ |
295 av_free(runs); | |
296 av_free(ref); | |
297 return -1; | |
298 } | |
299 }else{ | |
300 if(find_group3_syncmarker(&gb, srcsize*8) < 0) | |
301 break; | |
8474 | 302 if(compr==TIFF_CCITT_RLE || get_bits1(&gb)) |
8476
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
303 ret = decode_group3_1d_line(avctx, &gb, avctx->width, runs, runend); |
8466 | 304 else |
8476
0a0d7c4f2cf3
Close gaping sechole. That is, a series of run=0 allows arbitrary data to
michael
parents:
8475
diff
changeset
|
305 ret = decode_group3_2d_line(avctx, &gb, avctx->width, runs, runend, ref); |
8466 | 306 } |
307 if(ret < 0){ | |
308 put_line(dst, stride, avctx->width, ref); | |
309 }else{ | |
310 put_line(dst, stride, avctx->width, runs); | |
311 FFSWAP(int*, runs, ref); | |
312 } | |
313 dst += stride; | |
314 } | |
315 av_free(runs); | |
316 av_free(ref); | |
317 return 0; | |
318 } |