xref: /aosp_15_r20/external/pdfium/core/fxcodec/flate/flatemodule.cpp (revision 3ac0a46f773bac49fa9476ec2b1cf3f8da5ec3a4)
1 // Copyright 2014 The PDFium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 
5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
6 
7 #include "core/fxcodec/flate/flatemodule.h"
8 
9 #include <stdint.h>
10 #include <string.h>
11 
12 #include <algorithm>
13 #include <limits>
14 #include <memory>
15 #include <utility>
16 #include <vector>
17 
18 #include "core/fxcodec/scanlinedecoder.h"
19 #include "core/fxcrt/data_vector.h"
20 #include "core/fxcrt/fixed_zeroed_data_vector.h"
21 #include "core/fxcrt/fx_extension.h"
22 #include "core/fxcrt/fx_memory_wrappers.h"
23 #include "core/fxcrt/fx_safe_types.h"
24 #include "core/fxcrt/span_util.h"
25 #include "core/fxge/calculate_pitch.h"
26 #include "third_party/base/check.h"
27 #include "third_party/base/containers/span.h"
28 #include "third_party/base/notreached.h"
29 #include "third_party/base/numerics/safe_conversions.h"
30 
31 #if defined(USE_SYSTEM_ZLIB)
32 #include <zlib.h>
33 #else
34 #include "third_party/zlib/zlib.h"
35 #endif
36 
37 extern "C" {
38 
my_alloc_func(void * opaque,unsigned int items,unsigned int size)39 static void* my_alloc_func(void* opaque,
40                            unsigned int items,
41                            unsigned int size) {
42   return FX_Alloc2D(uint8_t, items, size);
43 }
44 
my_free_func(void * opaque,void * address)45 static void my_free_func(void* opaque, void* address) {
46   FX_Free(address);
47 }
48 
49 }  // extern "C"
50 
51 namespace fxcodec {
52 
53 namespace {
54 
55 static constexpr uint32_t kMaxTotalOutSize = 1024 * 1024 * 1024;  // 1 GiB
56 
FlateGetPossiblyTruncatedTotalOut(z_stream * context)57 uint32_t FlateGetPossiblyTruncatedTotalOut(z_stream* context) {
58   return std::min(pdfium::base::saturated_cast<uint32_t>(context->total_out),
59                   kMaxTotalOutSize);
60 }
61 
FlateGetPossiblyTruncatedTotalIn(z_stream * context)62 uint32_t FlateGetPossiblyTruncatedTotalIn(z_stream* context) {
63   return pdfium::base::saturated_cast<uint32_t>(context->total_in);
64 }
65 
FlateCompress(unsigned char * dest_buf,unsigned long * dest_size,const unsigned char * src_buf,unsigned long src_size)66 bool FlateCompress(unsigned char* dest_buf,
67                    unsigned long* dest_size,
68                    const unsigned char* src_buf,
69                    unsigned long src_size) {
70   return compress(dest_buf, dest_size, src_buf, src_size) == Z_OK;
71 }
72 
FlateInit()73 z_stream* FlateInit() {
74   z_stream* p = FX_Alloc(z_stream, 1);
75   p->zalloc = my_alloc_func;
76   p->zfree = my_free_func;
77   inflateInit(p);
78   return p;
79 }
80 
FlateInput(z_stream * context,pdfium::span<const uint8_t> src_buf)81 void FlateInput(z_stream* context, pdfium::span<const uint8_t> src_buf) {
82   context->next_in = const_cast<unsigned char*>(src_buf.data());
83   context->avail_in = static_cast<uint32_t>(src_buf.size());
84 }
85 
FlateOutput(z_stream * context,unsigned char * dest_buf,uint32_t dest_size)86 uint32_t FlateOutput(z_stream* context,
87                      unsigned char* dest_buf,
88                      uint32_t dest_size) {
89   context->next_out = dest_buf;
90   context->avail_out = dest_size;
91   uint32_t pre_pos = FlateGetPossiblyTruncatedTotalOut(context);
92   int ret = inflate(static_cast<z_stream*>(context), Z_SYNC_FLUSH);
93 
94   uint32_t post_pos = FlateGetPossiblyTruncatedTotalOut(context);
95   DCHECK(post_pos >= pre_pos);
96 
97   uint32_t written = post_pos - pre_pos;
98   if (written < dest_size)
99     memset(dest_buf + written, '\0', dest_size - written);
100 
101   return ret;
102 }
103 
FlateGetAvailOut(z_stream * context)104 uint32_t FlateGetAvailOut(z_stream* context) {
105   return context->avail_out;
106 }
107 
FlateEnd(z_stream * context)108 void FlateEnd(z_stream* context) {
109   inflateEnd(context);
110   FX_Free(context);
111 }
112 
113 // For use with std::unique_ptr<z_stream>.
114 struct FlateDeleter {
operator ()fxcodec::__anon1d26b39c0111::FlateDeleter115   inline void operator()(z_stream* context) { FlateEnd(context); }
116 };
117 
118 class CLZWDecoder {
119  public:
120   CLZWDecoder(pdfium::span<const uint8_t> src_span, bool early_change);
121 
122   bool Decode();
GetSrcSize() const123   uint32_t GetSrcSize() const { return (src_bit_pos_ + 7) / 8; }
GetDestSize() const124   uint32_t GetDestSize() const { return dest_byte_pos_; }
TakeDestBuf()125   std::unique_ptr<uint8_t, FxFreeDeleter> TakeDestBuf() {
126     return std::move(dest_buf_);
127   }
128 
129  private:
130   void AddCode(uint32_t prefix_code, uint8_t append_char);
131   void DecodeString(uint32_t code);
132   void ExpandDestBuf(uint32_t additional_size);
133 
134   pdfium::span<const uint8_t> const src_span_;
135   std::unique_ptr<uint8_t, FxFreeDeleter> dest_buf_;
136   uint32_t src_bit_pos_ = 0;
137   uint32_t dest_buf_size_ = 0;  // Actual allocated size.
138   uint32_t dest_byte_pos_ = 0;  // Size used.
139   uint32_t stack_len_ = 0;
140   FixedZeroedDataVector<uint8_t> decode_stack_;
141   const uint8_t early_change_;
142   uint8_t code_len_ = 9;
143   uint32_t current_code_ = 0;
144   FixedZeroedDataVector<uint32_t> codes_;
145 };
146 
CLZWDecoder(pdfium::span<const uint8_t> src_span,bool early_change)147 CLZWDecoder::CLZWDecoder(pdfium::span<const uint8_t> src_span,
148                          bool early_change)
149     : src_span_(src_span),
150       decode_stack_(4000),
151       early_change_(early_change ? 1 : 0),
152       codes_(5021) {}
153 
AddCode(uint32_t prefix_code,uint8_t append_char)154 void CLZWDecoder::AddCode(uint32_t prefix_code, uint8_t append_char) {
155   if (current_code_ + early_change_ == 4094)
156     return;
157 
158   pdfium::span<uint32_t> codes_span = codes_.writable_span();
159   codes_span[current_code_++] = (prefix_code << 16) | append_char;
160   if (current_code_ + early_change_ == 512 - 258)
161     code_len_ = 10;
162   else if (current_code_ + early_change_ == 1024 - 258)
163     code_len_ = 11;
164   else if (current_code_ + early_change_ == 2048 - 258)
165     code_len_ = 12;
166 }
167 
DecodeString(uint32_t code)168 void CLZWDecoder::DecodeString(uint32_t code) {
169   pdfium::span<uint8_t> decode_span = decode_stack_.writable_span();
170   pdfium::span<const uint32_t> codes_span = codes_.span();
171   while (true) {
172     int index = code - 258;
173     if (index < 0 || static_cast<uint32_t>(index) >= current_code_)
174       break;
175 
176     uint32_t data = codes_span[index];
177     if (stack_len_ >= decode_span.size())
178       return;
179 
180     decode_span[stack_len_++] = static_cast<uint8_t>(data);
181     code = data >> 16;
182   }
183   if (stack_len_ >= decode_span.size())
184     return;
185 
186   decode_span[stack_len_++] = static_cast<uint8_t>(code);
187 }
188 
ExpandDestBuf(uint32_t additional_size)189 void CLZWDecoder::ExpandDestBuf(uint32_t additional_size) {
190   FX_SAFE_UINT32 new_size = std::max(dest_buf_size_ / 2, additional_size);
191   new_size += dest_buf_size_;
192   if (!new_size.IsValid()) {
193     dest_buf_.reset();
194     return;
195   }
196 
197   dest_buf_size_ = new_size.ValueOrDie();
198   dest_buf_.reset(FX_Realloc(uint8_t, dest_buf_.release(), dest_buf_size_));
199 }
200 
Decode()201 bool CLZWDecoder::Decode() {
202   pdfium::span<uint8_t> decode_span = decode_stack_.writable_span();
203   uint32_t old_code = 0xFFFFFFFF;
204   uint8_t last_char = 0;
205 
206   // In one PDF test set, 40% of Decode() calls did not need to realloc with
207   // this size.
208   dest_buf_size_ = 512;
209   dest_buf_.reset(FX_Alloc(uint8_t, dest_buf_size_));
210   while (true) {
211     if (src_bit_pos_ + code_len_ > src_span_.size() * 8)
212       break;
213 
214     int byte_pos = src_bit_pos_ / 8;
215     int bit_pos = src_bit_pos_ % 8;
216     uint8_t bit_left = code_len_;
217     uint32_t code = 0;
218     if (bit_pos) {
219       bit_left -= 8 - bit_pos;
220       code = (src_span_[byte_pos++] & ((1 << (8 - bit_pos)) - 1)) << bit_left;
221     }
222     if (bit_left < 8) {
223       code |= src_span_[byte_pos] >> (8 - bit_left);
224     } else {
225       bit_left -= 8;
226       code |= src_span_[byte_pos++] << bit_left;
227       if (bit_left)
228         code |= src_span_[byte_pos] >> (8 - bit_left);
229     }
230     src_bit_pos_ += code_len_;
231 
232     if (code < 256) {
233       if (dest_byte_pos_ >= dest_buf_size_) {
234         ExpandDestBuf(dest_byte_pos_ - dest_buf_size_ + 1);
235         if (!dest_buf_)
236           return false;
237       }
238 
239       dest_buf_.get()[dest_byte_pos_] = (uint8_t)code;
240       dest_byte_pos_++;
241       last_char = (uint8_t)code;
242       if (old_code != 0xFFFFFFFF)
243         AddCode(old_code, last_char);
244       old_code = code;
245       continue;
246     }
247     if (code == 256) {
248       code_len_ = 9;
249       current_code_ = 0;
250       old_code = 0xFFFFFFFF;
251       continue;
252     }
253     if (code == 257)
254       break;
255 
256     // Case where |code| is 258 or greater.
257     if (old_code == 0xFFFFFFFF)
258       return false;
259 
260     DCHECK(old_code < 256 || old_code >= 258);
261     stack_len_ = 0;
262     if (code - 258 >= current_code_) {
263       if (stack_len_ < decode_stack_.size())
264         decode_span[stack_len_++] = last_char;
265       DecodeString(old_code);
266     } else {
267       DecodeString(code);
268     }
269 
270     FX_SAFE_UINT32 safe_required_size = dest_byte_pos_;
271     safe_required_size += stack_len_;
272     if (!safe_required_size.IsValid())
273       return false;
274 
275     uint32_t required_size = safe_required_size.ValueOrDie();
276     if (required_size > dest_buf_size_) {
277       ExpandDestBuf(required_size - dest_buf_size_);
278       if (!dest_buf_)
279         return false;
280     }
281 
282     for (uint32_t i = 0; i < stack_len_; i++)
283       dest_buf_.get()[dest_byte_pos_ + i] = decode_span[stack_len_ - i - 1];
284     dest_byte_pos_ += stack_len_;
285     last_char = decode_span[stack_len_ - 1];
286     if (old_code >= 258 && old_code - 258 >= current_code_)
287       break;
288 
289     AddCode(old_code, last_char);
290     old_code = code;
291   }
292   return dest_byte_pos_ != 0;
293 }
294 
PathPredictor(int a,int b,int c)295 uint8_t PathPredictor(int a, int b, int c) {
296   int p = a + b - c;
297   int pa = abs(p - a);
298   int pb = abs(p - b);
299   int pc = abs(p - c);
300   if (pa <= pb && pa <= pc)
301     return (uint8_t)a;
302   if (pb <= pc)
303     return (uint8_t)b;
304   return (uint8_t)c;
305 }
306 
PNG_PredictLine(pdfium::span<uint8_t> dest_span,pdfium::span<const uint8_t> src_span,pdfium::span<const uint8_t> last_span,int bpc,int nColors,int nPixels)307 void PNG_PredictLine(pdfium::span<uint8_t> dest_span,
308                      pdfium::span<const uint8_t> src_span,
309                      pdfium::span<const uint8_t> last_span,
310                      int bpc,
311                      int nColors,
312                      int nPixels) {
313   uint8_t* pDestData = dest_span.data();
314   const uint8_t* pSrcData = src_span.data();
315   const uint8_t* pLastLine = last_span.data();
316   const uint32_t row_size = fxge::CalculatePitch8OrDie(bpc, nColors, nPixels);
317   const uint32_t BytesPerPixel = (bpc * nColors + 7) / 8;
318   uint8_t tag = pSrcData[0];
319   if (tag == 0) {
320     memmove(pDestData, pSrcData + 1, row_size);
321     return;
322   }
323   for (uint32_t byte = 0; byte < row_size; ++byte) {
324     uint8_t raw_byte = pSrcData[byte + 1];
325     switch (tag) {
326       case 1: {
327         uint8_t left = 0;
328         if (byte >= BytesPerPixel) {
329           left = pDestData[byte - BytesPerPixel];
330         }
331         pDestData[byte] = raw_byte + left;
332         break;
333       }
334       case 2: {
335         uint8_t up = 0;
336         if (pLastLine) {
337           up = pLastLine[byte];
338         }
339         pDestData[byte] = raw_byte + up;
340         break;
341       }
342       case 3: {
343         uint8_t left = 0;
344         if (byte >= BytesPerPixel) {
345           left = pDestData[byte - BytesPerPixel];
346         }
347         uint8_t up = 0;
348         if (pLastLine) {
349           up = pLastLine[byte];
350         }
351         pDestData[byte] = raw_byte + (up + left) / 2;
352         break;
353       }
354       case 4: {
355         uint8_t left = 0;
356         if (byte >= BytesPerPixel) {
357           left = pDestData[byte - BytesPerPixel];
358         }
359         uint8_t up = 0;
360         if (pLastLine) {
361           up = pLastLine[byte];
362         }
363         uint8_t upper_left = 0;
364         if (byte >= BytesPerPixel && pLastLine) {
365           upper_left = pLastLine[byte - BytesPerPixel];
366         }
367         pDestData[byte] = raw_byte + PathPredictor(left, up, upper_left);
368         break;
369       }
370       default:
371         pDestData[byte] = raw_byte;
372         break;
373     }
374   }
375 }
376 
PNG_Predictor(int Colors,int BitsPerComponent,int Columns,std::unique_ptr<uint8_t,FxFreeDeleter> * data_buf,uint32_t * data_size)377 bool PNG_Predictor(int Colors,
378                    int BitsPerComponent,
379                    int Columns,
380                    std::unique_ptr<uint8_t, FxFreeDeleter>* data_buf,
381                    uint32_t* data_size) {
382   // TODO(thestig): Look into using CalculatePitch8() here.
383   const int BytesPerPixel = (Colors * BitsPerComponent + 7) / 8;
384   const int row_size = (Colors * BitsPerComponent * Columns + 7) / 8;
385   if (row_size <= 0)
386     return false;
387   const int row_count = (*data_size + row_size) / (row_size + 1);
388   if (row_count <= 0)
389     return false;
390   const int last_row_size = *data_size % (row_size + 1);
391   std::unique_ptr<uint8_t, FxFreeDeleter> dest_buf(
392       FX_Alloc2D(uint8_t, row_size, row_count));
393   uint32_t byte_cnt = 0;
394   uint8_t* pSrcData = data_buf->get();
395   uint8_t* pDestData = dest_buf.get();
396   for (int row = 0; row < row_count; row++) {
397     uint8_t tag = pSrcData[0];
398     byte_cnt++;
399     if (tag == 0) {
400       int move_size = row_size;
401       if ((row + 1) * (move_size + 1) > static_cast<int>(*data_size)) {
402         move_size = last_row_size - 1;
403       }
404       memcpy(pDestData, pSrcData + 1, move_size);
405       pSrcData += move_size + 1;
406       pDestData += move_size;
407       byte_cnt += move_size;
408       continue;
409     }
410     for (int byte = 0; byte < row_size && byte_cnt < *data_size;
411          ++byte, ++byte_cnt) {
412       uint8_t raw_byte = pSrcData[byte + 1];
413       switch (tag) {
414         case 1: {
415           uint8_t left = 0;
416           if (byte >= BytesPerPixel) {
417             left = pDestData[byte - BytesPerPixel];
418           }
419           pDestData[byte] = raw_byte + left;
420           break;
421         }
422         case 2: {
423           uint8_t up = 0;
424           if (row) {
425             up = pDestData[byte - row_size];
426           }
427           pDestData[byte] = raw_byte + up;
428           break;
429         }
430         case 3: {
431           uint8_t left = 0;
432           if (byte >= BytesPerPixel) {
433             left = pDestData[byte - BytesPerPixel];
434           }
435           uint8_t up = 0;
436           if (row) {
437             up = pDestData[byte - row_size];
438           }
439           pDestData[byte] = raw_byte + (up + left) / 2;
440           break;
441         }
442         case 4: {
443           uint8_t left = 0;
444           if (byte >= BytesPerPixel) {
445             left = pDestData[byte - BytesPerPixel];
446           }
447           uint8_t up = 0;
448           if (row) {
449             up = pDestData[byte - row_size];
450           }
451           uint8_t upper_left = 0;
452           if (byte >= BytesPerPixel && row) {
453             upper_left = pDestData[byte - row_size - BytesPerPixel];
454           }
455           pDestData[byte] = raw_byte + PathPredictor(left, up, upper_left);
456           break;
457         }
458         default:
459           pDestData[byte] = raw_byte;
460           break;
461       }
462     }
463     pSrcData += row_size + 1;
464     pDestData += row_size;
465   }
466   *data_buf = std::move(dest_buf);
467   *data_size = row_size * row_count -
468                (last_row_size > 0 ? (row_size + 1 - last_row_size) : 0);
469   return true;
470 }
471 
TIFF_PredictLine(uint8_t * dest_buf,uint32_t row_size,int BitsPerComponent,int Colors,int Columns)472 void TIFF_PredictLine(uint8_t* dest_buf,
473                       uint32_t row_size,
474                       int BitsPerComponent,
475                       int Colors,
476                       int Columns) {
477   if (BitsPerComponent == 1) {
478     int row_bits = std::min(BitsPerComponent * Colors * Columns,
479                             pdfium::base::checked_cast<int>(row_size * 8));
480     int index_pre = 0;
481     int col_pre = 0;
482     for (int i = 1; i < row_bits; i++) {
483       int col = i % 8;
484       int index = i / 8;
485       if (((dest_buf[index] >> (7 - col)) & 1) ^
486           ((dest_buf[index_pre] >> (7 - col_pre)) & 1)) {
487         dest_buf[index] |= 1 << (7 - col);
488       } else {
489         dest_buf[index] &= ~(1 << (7 - col));
490       }
491       index_pre = index;
492       col_pre = col;
493     }
494     return;
495   }
496   int BytesPerPixel = BitsPerComponent * Colors / 8;
497   if (BitsPerComponent == 16) {
498     for (uint32_t i = BytesPerPixel; i + 1 < row_size; i += 2) {
499       uint16_t pixel =
500           (dest_buf[i - BytesPerPixel] << 8) | dest_buf[i - BytesPerPixel + 1];
501       pixel += (dest_buf[i] << 8) | dest_buf[i + 1];
502       dest_buf[i] = pixel >> 8;
503       dest_buf[i + 1] = (uint8_t)pixel;
504     }
505   } else {
506     for (uint32_t i = BytesPerPixel; i < row_size; i++) {
507       dest_buf[i] += dest_buf[i - BytesPerPixel];
508     }
509   }
510 }
511 
TIFF_Predictor(int Colors,int BitsPerComponent,int Columns,std::unique_ptr<uint8_t,FxFreeDeleter> * data_buf,uint32_t * data_size)512 bool TIFF_Predictor(int Colors,
513                     int BitsPerComponent,
514                     int Columns,
515                     std::unique_ptr<uint8_t, FxFreeDeleter>* data_buf,
516                     uint32_t* data_size) {
517   int row_size = (Colors * BitsPerComponent * Columns + 7) / 8;
518   if (row_size == 0)
519     return false;
520   const int row_count = (*data_size + row_size - 1) / row_size;
521   const int last_row_size = *data_size % row_size;
522   for (int row = 0; row < row_count; row++) {
523     uint8_t* scan_line = data_buf->get() + row * row_size;
524     if ((row + 1) * row_size > static_cast<int>(*data_size)) {
525       row_size = last_row_size;
526     }
527     TIFF_PredictLine(scan_line, row_size, BitsPerComponent, Colors, Columns);
528   }
529   return true;
530 }
531 
FlateUncompress(pdfium::span<const uint8_t> src_buf,uint32_t orig_size,std::unique_ptr<uint8_t,FxFreeDeleter> * dest_buf,uint32_t * dest_size,uint32_t * offset)532 void FlateUncompress(pdfium::span<const uint8_t> src_buf,
533                      uint32_t orig_size,
534                      std::unique_ptr<uint8_t, FxFreeDeleter>* dest_buf,
535                      uint32_t* dest_size,
536                      uint32_t* offset) {
537   dest_buf->reset();
538   *dest_size = 0;
539 
540   std::unique_ptr<z_stream, FlateDeleter> context(FlateInit());
541   if (!context)
542     return;
543 
544   FlateInput(context.get(), src_buf);
545 
546   const uint32_t kMaxInitialAllocSize = 10000000;
547   uint32_t guess_size =
548       orig_size ? orig_size
549                 : pdfium::base::checked_cast<uint32_t>(src_buf.size() * 2);
550   guess_size = std::min(guess_size, kMaxInitialAllocSize);
551 
552   uint32_t buf_size = guess_size;
553   uint32_t last_buf_size = buf_size;
554   std::unique_ptr<uint8_t, FxFreeDeleter> guess_buf(
555       FX_Alloc(uint8_t, guess_size + 1));
556   guess_buf.get()[guess_size] = '\0';
557 
558   std::vector<std::unique_ptr<uint8_t, FxFreeDeleter>> result_tmp_bufs;
559   {
560     std::unique_ptr<uint8_t, FxFreeDeleter> cur_buf = std::move(guess_buf);
561     while (true) {
562       uint32_t ret = FlateOutput(context.get(), cur_buf.get(), buf_size);
563       uint32_t avail_buf_size = FlateGetAvailOut(context.get());
564       if (ret != Z_OK || avail_buf_size != 0) {
565         last_buf_size = buf_size - avail_buf_size;
566         result_tmp_bufs.push_back(std::move(cur_buf));
567         break;
568       }
569       result_tmp_bufs.push_back(std::move(cur_buf));
570       cur_buf.reset(FX_Alloc(uint8_t, buf_size + 1));
571       cur_buf.get()[buf_size] = '\0';
572     }
573   }
574 
575   // The TotalOut size returned from the library may not be big enough to
576   // handle the content the library returns. We can only handle items
577   // up to 4GB in size.
578   *dest_size = FlateGetPossiblyTruncatedTotalOut(context.get());
579   *offset = FlateGetPossiblyTruncatedTotalIn(context.get());
580   if (result_tmp_bufs.size() == 1) {
581     *dest_buf = std::move(result_tmp_bufs[0]);
582     return;
583   }
584 
585   std::unique_ptr<uint8_t, FxFreeDeleter> result_buf(
586       FX_Alloc(uint8_t, *dest_size));
587   uint32_t result_pos = 0;
588   uint32_t remaining = *dest_size;
589   for (size_t i = 0; i < result_tmp_bufs.size(); i++) {
590     std::unique_ptr<uint8_t, FxFreeDeleter> tmp_buf =
591         std::move(result_tmp_bufs[i]);
592     uint32_t tmp_buf_size = buf_size;
593     if (i == result_tmp_bufs.size() - 1)
594       tmp_buf_size = last_buf_size;
595 
596     uint32_t cp_size = std::min(tmp_buf_size, remaining);
597     memcpy(result_buf.get() + result_pos, tmp_buf.get(), cp_size);
598     result_pos += cp_size;
599     remaining -= cp_size;
600   }
601   *dest_buf = std::move(result_buf);
602 }
603 
604 enum class PredictorType : uint8_t { kNone, kFlate, kPng };
GetPredictor(int predictor)605 static PredictorType GetPredictor(int predictor) {
606   if (predictor >= 10)
607     return PredictorType::kPng;
608   if (predictor == 2)
609     return PredictorType::kFlate;
610   return PredictorType::kNone;
611 }
612 
613 class FlateScanlineDecoder : public ScanlineDecoder {
614  public:
615   FlateScanlineDecoder(pdfium::span<const uint8_t> src_span,
616                        int width,
617                        int height,
618                        int nComps,
619                        int bpc);
620   ~FlateScanlineDecoder() override;
621 
622   // ScanlineDecoder:
623   bool Rewind() override;
624   pdfium::span<uint8_t> GetNextLine() override;
625   uint32_t GetSrcOffset() override;
626 
627  protected:
628   std::unique_ptr<z_stream, FlateDeleter> m_pFlate;
629   const pdfium::span<const uint8_t> m_SrcBuf;
630   DataVector<uint8_t> m_Scanline;
631 };
632 
FlateScanlineDecoder(pdfium::span<const uint8_t> src_span,int width,int height,int nComps,int bpc)633 FlateScanlineDecoder::FlateScanlineDecoder(pdfium::span<const uint8_t> src_span,
634                                            int width,
635                                            int height,
636                                            int nComps,
637                                            int bpc)
638     : ScanlineDecoder(width,
639                       height,
640                       width,
641                       height,
642                       nComps,
643                       bpc,
644                       fxge::CalculatePitch8OrDie(bpc, nComps, width)),
645       m_SrcBuf(src_span),
646       m_Scanline(m_Pitch) {}
647 
~FlateScanlineDecoder()648 FlateScanlineDecoder::~FlateScanlineDecoder() {
649   // Span in superclass can't outlive our buffer.
650   m_pLastScanline = pdfium::span<uint8_t>();
651 }
652 
Rewind()653 bool FlateScanlineDecoder::Rewind() {
654   m_pFlate.reset(FlateInit());
655   if (!m_pFlate)
656     return false;
657 
658   FlateInput(m_pFlate.get(), m_SrcBuf);
659   return true;
660 }
661 
GetNextLine()662 pdfium::span<uint8_t> FlateScanlineDecoder::GetNextLine() {
663   FlateOutput(m_pFlate.get(), m_Scanline.data(), m_Pitch);
664   return m_Scanline;
665 }
666 
GetSrcOffset()667 uint32_t FlateScanlineDecoder::GetSrcOffset() {
668   return FlateGetPossiblyTruncatedTotalIn(m_pFlate.get());
669 }
670 
671 class FlatePredictorScanlineDecoder final : public FlateScanlineDecoder {
672  public:
673   FlatePredictorScanlineDecoder(pdfium::span<const uint8_t> src_span,
674                                 int width,
675                                 int height,
676                                 int comps,
677                                 int bpc,
678                                 PredictorType predictor,
679                                 int Colors,
680                                 int BitsPerComponent,
681                                 int Columns);
682   ~FlatePredictorScanlineDecoder() override;
683 
684   // ScanlineDecoder:
685   bool Rewind() override;
686   pdfium::span<uint8_t> GetNextLine() override;
687 
688  private:
689   void GetNextLineWithPredictedPitch();
690   void GetNextLineWithoutPredictedPitch();
691 
692   const PredictorType m_Predictor;
693   int m_Colors = 0;
694   int m_BitsPerComponent = 0;
695   int m_Columns = 0;
696   uint32_t m_PredictPitch = 0;
697   size_t m_LeftOver = 0;
698   DataVector<uint8_t> m_LastLine;
699   DataVector<uint8_t> m_PredictBuffer;
700   DataVector<uint8_t> m_PredictRaw;
701 };
702 
FlatePredictorScanlineDecoder(pdfium::span<const uint8_t> src_span,int width,int height,int comps,int bpc,PredictorType predictor,int Colors,int BitsPerComponent,int Columns)703 FlatePredictorScanlineDecoder::FlatePredictorScanlineDecoder(
704     pdfium::span<const uint8_t> src_span,
705     int width,
706     int height,
707     int comps,
708     int bpc,
709     PredictorType predictor,
710     int Colors,
711     int BitsPerComponent,
712     int Columns)
713     : FlateScanlineDecoder(src_span, width, height, comps, bpc),
714       m_Predictor(predictor) {
715   DCHECK(m_Predictor != PredictorType::kNone);
716   if (BitsPerComponent * Colors * Columns == 0) {
717     BitsPerComponent = m_bpc;
718     Colors = m_nComps;
719     Columns = m_OrigWidth;
720   }
721   m_Colors = Colors;
722   m_BitsPerComponent = BitsPerComponent;
723   m_Columns = Columns;
724   m_PredictPitch =
725       fxge::CalculatePitch8OrDie(m_BitsPerComponent, m_Colors, m_Columns);
726   m_LastLine.resize(m_PredictPitch);
727   m_PredictBuffer.resize(m_PredictPitch);
728   m_PredictRaw.resize(m_PredictPitch + 1);
729 }
730 
~FlatePredictorScanlineDecoder()731 FlatePredictorScanlineDecoder::~FlatePredictorScanlineDecoder() {
732   // Span in superclass can't outlive our buffer.
733   m_pLastScanline = pdfium::span<uint8_t>();
734 }
735 
Rewind()736 bool FlatePredictorScanlineDecoder::Rewind() {
737   if (!FlateScanlineDecoder::Rewind())
738     return false;
739 
740   m_LeftOver = 0;
741   return true;
742 }
743 
GetNextLine()744 pdfium::span<uint8_t> FlatePredictorScanlineDecoder::GetNextLine() {
745   if (m_Pitch == m_PredictPitch)
746     GetNextLineWithPredictedPitch();
747   else
748     GetNextLineWithoutPredictedPitch();
749   return m_Scanline;
750 }
751 
GetNextLineWithPredictedPitch()752 void FlatePredictorScanlineDecoder::GetNextLineWithPredictedPitch() {
753   switch (m_Predictor) {
754     case PredictorType::kPng:
755       FlateOutput(m_pFlate.get(), m_PredictRaw.data(), m_PredictPitch + 1);
756       PNG_PredictLine(m_Scanline, m_PredictRaw, m_LastLine, m_BitsPerComponent,
757                       m_Colors, m_Columns);
758       memcpy(m_LastLine.data(), m_Scanline.data(), m_PredictPitch);
759       break;
760     case PredictorType::kFlate:
761       FlateOutput(m_pFlate.get(), m_Scanline.data(), m_Pitch);
762       TIFF_PredictLine(m_Scanline.data(), m_PredictPitch, m_bpc, m_nComps,
763                        m_OutputWidth);
764       break;
765     case PredictorType::kNone:
766       NOTREACHED_NORETURN();
767   }
768 }
769 
GetNextLineWithoutPredictedPitch()770 void FlatePredictorScanlineDecoder::GetNextLineWithoutPredictedPitch() {
771   size_t bytes_to_go = m_Pitch;
772   size_t read_leftover = m_LeftOver > bytes_to_go ? bytes_to_go : m_LeftOver;
773   if (read_leftover) {
774     memcpy(m_Scanline.data(), &m_PredictBuffer[m_PredictPitch - m_LeftOver],
775            read_leftover);
776     m_LeftOver -= read_leftover;
777     bytes_to_go -= read_leftover;
778   }
779   while (bytes_to_go) {
780     switch (m_Predictor) {
781       case PredictorType::kPng:
782         FlateOutput(m_pFlate.get(), m_PredictRaw.data(), m_PredictPitch + 1);
783         PNG_PredictLine(m_PredictBuffer, m_PredictRaw, m_LastLine,
784                         m_BitsPerComponent, m_Colors, m_Columns);
785         memcpy(m_LastLine.data(), m_PredictBuffer.data(), m_PredictPitch);
786         break;
787       case PredictorType::kFlate:
788         FlateOutput(m_pFlate.get(), m_PredictBuffer.data(), m_PredictPitch);
789         TIFF_PredictLine(m_PredictBuffer.data(), m_PredictPitch,
790                          m_BitsPerComponent, m_Colors, m_Columns);
791         break;
792       case PredictorType::kNone:
793         NOTREACHED_NORETURN();
794     }
795     size_t read_bytes =
796         m_PredictPitch > bytes_to_go ? bytes_to_go : m_PredictPitch;
797     fxcrt::spancpy(pdfium::make_span(m_Scanline).subspan(m_Pitch - bytes_to_go),
798                    pdfium::make_span(m_PredictBuffer).first(read_bytes));
799     m_LeftOver += m_PredictPitch - read_bytes;
800     bytes_to_go -= read_bytes;
801   }
802 }
803 
804 }  // namespace
805 
806 // static
CreateDecoder(pdfium::span<const uint8_t> src_span,int width,int height,int nComps,int bpc,int predictor,int Colors,int BitsPerComponent,int Columns)807 std::unique_ptr<ScanlineDecoder> FlateModule::CreateDecoder(
808     pdfium::span<const uint8_t> src_span,
809     int width,
810     int height,
811     int nComps,
812     int bpc,
813     int predictor,
814     int Colors,
815     int BitsPerComponent,
816     int Columns) {
817   PredictorType predictor_type = GetPredictor(predictor);
818   if (predictor_type == PredictorType::kNone) {
819     return std::make_unique<FlateScanlineDecoder>(src_span, width, height,
820                                                   nComps, bpc);
821   }
822   return std::make_unique<FlatePredictorScanlineDecoder>(
823       src_span, width, height, nComps, bpc, predictor_type, Colors,
824       BitsPerComponent, Columns);
825 }
826 
827 // static
FlateOrLZWDecode(bool bLZW,pdfium::span<const uint8_t> src_span,bool bEarlyChange,int predictor,int Colors,int BitsPerComponent,int Columns,uint32_t estimated_size,std::unique_ptr<uint8_t,FxFreeDeleter> * dest_buf,uint32_t * dest_size)828 uint32_t FlateModule::FlateOrLZWDecode(
829     bool bLZW,
830     pdfium::span<const uint8_t> src_span,
831     bool bEarlyChange,
832     int predictor,
833     int Colors,
834     int BitsPerComponent,
835     int Columns,
836     uint32_t estimated_size,
837     std::unique_ptr<uint8_t, FxFreeDeleter>* dest_buf,
838     uint32_t* dest_size) {
839   dest_buf->reset();
840   uint32_t offset = 0;
841   PredictorType predictor_type = GetPredictor(predictor);
842 
843   if (bLZW) {
844     auto decoder = std::make_unique<CLZWDecoder>(src_span, bEarlyChange);
845     if (!decoder->Decode())
846       return FX_INVALID_OFFSET;
847 
848     offset = decoder->GetSrcSize();
849     *dest_size = decoder->GetDestSize();
850     *dest_buf = decoder->TakeDestBuf();
851   } else {
852     FlateUncompress(src_span, estimated_size, dest_buf, dest_size, &offset);
853   }
854 
855   bool ret = false;
856   switch (predictor_type) {
857     case PredictorType::kNone:
858       return offset;
859     case PredictorType::kPng:
860       ret =
861           PNG_Predictor(Colors, BitsPerComponent, Columns, dest_buf, dest_size);
862       break;
863     case PredictorType::kFlate:
864       ret = TIFF_Predictor(Colors, BitsPerComponent, Columns, dest_buf,
865                            dest_size);
866       break;
867   }
868   return ret ? offset : FX_INVALID_OFFSET;
869 }
870 
871 // static
Encode(pdfium::span<const uint8_t> src_span)872 DataVector<uint8_t> FlateModule::Encode(pdfium::span<const uint8_t> src_span) {
873   const unsigned long src_size =
874       pdfium::base::checked_cast<unsigned long>(src_span.size());
875   pdfium::base::CheckedNumeric<unsigned long> safe_dest_size = src_size;
876   safe_dest_size += src_size / 1000;
877   safe_dest_size += 12;
878   unsigned long dest_size = safe_dest_size.ValueOrDie();
879   DataVector<uint8_t> dest_buf(dest_size);
880   if (!FlateCompress(dest_buf.data(), &dest_size, src_span.data(), src_size))
881     return {};
882 
883   dest_buf.resize(pdfium::base::checked_cast<size_t>(dest_size));
884   return dest_buf;
885 }
886 
887 }  // namespace fxcodec
888