1 // Copyright 2014 The PDFium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
6
7 #include "core/fxcodec/flate/flatemodule.h"
8
9 #include <stdint.h>
10 #include <string.h>
11
12 #include <algorithm>
13 #include <limits>
14 #include <memory>
15 #include <utility>
16 #include <vector>
17
18 #include "core/fxcodec/scanlinedecoder.h"
19 #include "core/fxcrt/data_vector.h"
20 #include "core/fxcrt/fixed_zeroed_data_vector.h"
21 #include "core/fxcrt/fx_extension.h"
22 #include "core/fxcrt/fx_memory_wrappers.h"
23 #include "core/fxcrt/fx_safe_types.h"
24 #include "core/fxcrt/span_util.h"
25 #include "core/fxge/calculate_pitch.h"
26 #include "third_party/base/check.h"
27 #include "third_party/base/containers/span.h"
28 #include "third_party/base/notreached.h"
29 #include "third_party/base/numerics/safe_conversions.h"
30
31 #if defined(USE_SYSTEM_ZLIB)
32 #include <zlib.h>
33 #else
34 #include "third_party/zlib/zlib.h"
35 #endif
36
37 extern "C" {
38
my_alloc_func(void * opaque,unsigned int items,unsigned int size)39 static void* my_alloc_func(void* opaque,
40 unsigned int items,
41 unsigned int size) {
42 return FX_Alloc2D(uint8_t, items, size);
43 }
44
my_free_func(void * opaque,void * address)45 static void my_free_func(void* opaque, void* address) {
46 FX_Free(address);
47 }
48
49 } // extern "C"
50
51 namespace fxcodec {
52
53 namespace {
54
55 static constexpr uint32_t kMaxTotalOutSize = 1024 * 1024 * 1024; // 1 GiB
56
FlateGetPossiblyTruncatedTotalOut(z_stream * context)57 uint32_t FlateGetPossiblyTruncatedTotalOut(z_stream* context) {
58 return std::min(pdfium::base::saturated_cast<uint32_t>(context->total_out),
59 kMaxTotalOutSize);
60 }
61
FlateGetPossiblyTruncatedTotalIn(z_stream * context)62 uint32_t FlateGetPossiblyTruncatedTotalIn(z_stream* context) {
63 return pdfium::base::saturated_cast<uint32_t>(context->total_in);
64 }
65
FlateCompress(unsigned char * dest_buf,unsigned long * dest_size,const unsigned char * src_buf,unsigned long src_size)66 bool FlateCompress(unsigned char* dest_buf,
67 unsigned long* dest_size,
68 const unsigned char* src_buf,
69 unsigned long src_size) {
70 return compress(dest_buf, dest_size, src_buf, src_size) == Z_OK;
71 }
72
FlateInit()73 z_stream* FlateInit() {
74 z_stream* p = FX_Alloc(z_stream, 1);
75 p->zalloc = my_alloc_func;
76 p->zfree = my_free_func;
77 inflateInit(p);
78 return p;
79 }
80
FlateInput(z_stream * context,pdfium::span<const uint8_t> src_buf)81 void FlateInput(z_stream* context, pdfium::span<const uint8_t> src_buf) {
82 context->next_in = const_cast<unsigned char*>(src_buf.data());
83 context->avail_in = static_cast<uint32_t>(src_buf.size());
84 }
85
FlateOutput(z_stream * context,unsigned char * dest_buf,uint32_t dest_size)86 uint32_t FlateOutput(z_stream* context,
87 unsigned char* dest_buf,
88 uint32_t dest_size) {
89 context->next_out = dest_buf;
90 context->avail_out = dest_size;
91 uint32_t pre_pos = FlateGetPossiblyTruncatedTotalOut(context);
92 int ret = inflate(static_cast<z_stream*>(context), Z_SYNC_FLUSH);
93
94 uint32_t post_pos = FlateGetPossiblyTruncatedTotalOut(context);
95 DCHECK(post_pos >= pre_pos);
96
97 uint32_t written = post_pos - pre_pos;
98 if (written < dest_size)
99 memset(dest_buf + written, '\0', dest_size - written);
100
101 return ret;
102 }
103
FlateGetAvailOut(z_stream * context)104 uint32_t FlateGetAvailOut(z_stream* context) {
105 return context->avail_out;
106 }
107
FlateEnd(z_stream * context)108 void FlateEnd(z_stream* context) {
109 inflateEnd(context);
110 FX_Free(context);
111 }
112
113 // For use with std::unique_ptr<z_stream>.
114 struct FlateDeleter {
operator ()fxcodec::__anon1d26b39c0111::FlateDeleter115 inline void operator()(z_stream* context) { FlateEnd(context); }
116 };
117
118 class CLZWDecoder {
119 public:
120 CLZWDecoder(pdfium::span<const uint8_t> src_span, bool early_change);
121
122 bool Decode();
GetSrcSize() const123 uint32_t GetSrcSize() const { return (src_bit_pos_ + 7) / 8; }
GetDestSize() const124 uint32_t GetDestSize() const { return dest_byte_pos_; }
TakeDestBuf()125 std::unique_ptr<uint8_t, FxFreeDeleter> TakeDestBuf() {
126 return std::move(dest_buf_);
127 }
128
129 private:
130 void AddCode(uint32_t prefix_code, uint8_t append_char);
131 void DecodeString(uint32_t code);
132 void ExpandDestBuf(uint32_t additional_size);
133
134 pdfium::span<const uint8_t> const src_span_;
135 std::unique_ptr<uint8_t, FxFreeDeleter> dest_buf_;
136 uint32_t src_bit_pos_ = 0;
137 uint32_t dest_buf_size_ = 0; // Actual allocated size.
138 uint32_t dest_byte_pos_ = 0; // Size used.
139 uint32_t stack_len_ = 0;
140 FixedZeroedDataVector<uint8_t> decode_stack_;
141 const uint8_t early_change_;
142 uint8_t code_len_ = 9;
143 uint32_t current_code_ = 0;
144 FixedZeroedDataVector<uint32_t> codes_;
145 };
146
CLZWDecoder(pdfium::span<const uint8_t> src_span,bool early_change)147 CLZWDecoder::CLZWDecoder(pdfium::span<const uint8_t> src_span,
148 bool early_change)
149 : src_span_(src_span),
150 decode_stack_(4000),
151 early_change_(early_change ? 1 : 0),
152 codes_(5021) {}
153
AddCode(uint32_t prefix_code,uint8_t append_char)154 void CLZWDecoder::AddCode(uint32_t prefix_code, uint8_t append_char) {
155 if (current_code_ + early_change_ == 4094)
156 return;
157
158 pdfium::span<uint32_t> codes_span = codes_.writable_span();
159 codes_span[current_code_++] = (prefix_code << 16) | append_char;
160 if (current_code_ + early_change_ == 512 - 258)
161 code_len_ = 10;
162 else if (current_code_ + early_change_ == 1024 - 258)
163 code_len_ = 11;
164 else if (current_code_ + early_change_ == 2048 - 258)
165 code_len_ = 12;
166 }
167
DecodeString(uint32_t code)168 void CLZWDecoder::DecodeString(uint32_t code) {
169 pdfium::span<uint8_t> decode_span = decode_stack_.writable_span();
170 pdfium::span<const uint32_t> codes_span = codes_.span();
171 while (true) {
172 int index = code - 258;
173 if (index < 0 || static_cast<uint32_t>(index) >= current_code_)
174 break;
175
176 uint32_t data = codes_span[index];
177 if (stack_len_ >= decode_span.size())
178 return;
179
180 decode_span[stack_len_++] = static_cast<uint8_t>(data);
181 code = data >> 16;
182 }
183 if (stack_len_ >= decode_span.size())
184 return;
185
186 decode_span[stack_len_++] = static_cast<uint8_t>(code);
187 }
188
ExpandDestBuf(uint32_t additional_size)189 void CLZWDecoder::ExpandDestBuf(uint32_t additional_size) {
190 FX_SAFE_UINT32 new_size = std::max(dest_buf_size_ / 2, additional_size);
191 new_size += dest_buf_size_;
192 if (!new_size.IsValid()) {
193 dest_buf_.reset();
194 return;
195 }
196
197 dest_buf_size_ = new_size.ValueOrDie();
198 dest_buf_.reset(FX_Realloc(uint8_t, dest_buf_.release(), dest_buf_size_));
199 }
200
Decode()201 bool CLZWDecoder::Decode() {
202 pdfium::span<uint8_t> decode_span = decode_stack_.writable_span();
203 uint32_t old_code = 0xFFFFFFFF;
204 uint8_t last_char = 0;
205
206 // In one PDF test set, 40% of Decode() calls did not need to realloc with
207 // this size.
208 dest_buf_size_ = 512;
209 dest_buf_.reset(FX_Alloc(uint8_t, dest_buf_size_));
210 while (true) {
211 if (src_bit_pos_ + code_len_ > src_span_.size() * 8)
212 break;
213
214 int byte_pos = src_bit_pos_ / 8;
215 int bit_pos = src_bit_pos_ % 8;
216 uint8_t bit_left = code_len_;
217 uint32_t code = 0;
218 if (bit_pos) {
219 bit_left -= 8 - bit_pos;
220 code = (src_span_[byte_pos++] & ((1 << (8 - bit_pos)) - 1)) << bit_left;
221 }
222 if (bit_left < 8) {
223 code |= src_span_[byte_pos] >> (8 - bit_left);
224 } else {
225 bit_left -= 8;
226 code |= src_span_[byte_pos++] << bit_left;
227 if (bit_left)
228 code |= src_span_[byte_pos] >> (8 - bit_left);
229 }
230 src_bit_pos_ += code_len_;
231
232 if (code < 256) {
233 if (dest_byte_pos_ >= dest_buf_size_) {
234 ExpandDestBuf(dest_byte_pos_ - dest_buf_size_ + 1);
235 if (!dest_buf_)
236 return false;
237 }
238
239 dest_buf_.get()[dest_byte_pos_] = (uint8_t)code;
240 dest_byte_pos_++;
241 last_char = (uint8_t)code;
242 if (old_code != 0xFFFFFFFF)
243 AddCode(old_code, last_char);
244 old_code = code;
245 continue;
246 }
247 if (code == 256) {
248 code_len_ = 9;
249 current_code_ = 0;
250 old_code = 0xFFFFFFFF;
251 continue;
252 }
253 if (code == 257)
254 break;
255
256 // Case where |code| is 258 or greater.
257 if (old_code == 0xFFFFFFFF)
258 return false;
259
260 DCHECK(old_code < 256 || old_code >= 258);
261 stack_len_ = 0;
262 if (code - 258 >= current_code_) {
263 if (stack_len_ < decode_stack_.size())
264 decode_span[stack_len_++] = last_char;
265 DecodeString(old_code);
266 } else {
267 DecodeString(code);
268 }
269
270 FX_SAFE_UINT32 safe_required_size = dest_byte_pos_;
271 safe_required_size += stack_len_;
272 if (!safe_required_size.IsValid())
273 return false;
274
275 uint32_t required_size = safe_required_size.ValueOrDie();
276 if (required_size > dest_buf_size_) {
277 ExpandDestBuf(required_size - dest_buf_size_);
278 if (!dest_buf_)
279 return false;
280 }
281
282 for (uint32_t i = 0; i < stack_len_; i++)
283 dest_buf_.get()[dest_byte_pos_ + i] = decode_span[stack_len_ - i - 1];
284 dest_byte_pos_ += stack_len_;
285 last_char = decode_span[stack_len_ - 1];
286 if (old_code >= 258 && old_code - 258 >= current_code_)
287 break;
288
289 AddCode(old_code, last_char);
290 old_code = code;
291 }
292 return dest_byte_pos_ != 0;
293 }
294
PathPredictor(int a,int b,int c)295 uint8_t PathPredictor(int a, int b, int c) {
296 int p = a + b - c;
297 int pa = abs(p - a);
298 int pb = abs(p - b);
299 int pc = abs(p - c);
300 if (pa <= pb && pa <= pc)
301 return (uint8_t)a;
302 if (pb <= pc)
303 return (uint8_t)b;
304 return (uint8_t)c;
305 }
306
PNG_PredictLine(pdfium::span<uint8_t> dest_span,pdfium::span<const uint8_t> src_span,pdfium::span<const uint8_t> last_span,int bpc,int nColors,int nPixels)307 void PNG_PredictLine(pdfium::span<uint8_t> dest_span,
308 pdfium::span<const uint8_t> src_span,
309 pdfium::span<const uint8_t> last_span,
310 int bpc,
311 int nColors,
312 int nPixels) {
313 uint8_t* pDestData = dest_span.data();
314 const uint8_t* pSrcData = src_span.data();
315 const uint8_t* pLastLine = last_span.data();
316 const uint32_t row_size = fxge::CalculatePitch8OrDie(bpc, nColors, nPixels);
317 const uint32_t BytesPerPixel = (bpc * nColors + 7) / 8;
318 uint8_t tag = pSrcData[0];
319 if (tag == 0) {
320 memmove(pDestData, pSrcData + 1, row_size);
321 return;
322 }
323 for (uint32_t byte = 0; byte < row_size; ++byte) {
324 uint8_t raw_byte = pSrcData[byte + 1];
325 switch (tag) {
326 case 1: {
327 uint8_t left = 0;
328 if (byte >= BytesPerPixel) {
329 left = pDestData[byte - BytesPerPixel];
330 }
331 pDestData[byte] = raw_byte + left;
332 break;
333 }
334 case 2: {
335 uint8_t up = 0;
336 if (pLastLine) {
337 up = pLastLine[byte];
338 }
339 pDestData[byte] = raw_byte + up;
340 break;
341 }
342 case 3: {
343 uint8_t left = 0;
344 if (byte >= BytesPerPixel) {
345 left = pDestData[byte - BytesPerPixel];
346 }
347 uint8_t up = 0;
348 if (pLastLine) {
349 up = pLastLine[byte];
350 }
351 pDestData[byte] = raw_byte + (up + left) / 2;
352 break;
353 }
354 case 4: {
355 uint8_t left = 0;
356 if (byte >= BytesPerPixel) {
357 left = pDestData[byte - BytesPerPixel];
358 }
359 uint8_t up = 0;
360 if (pLastLine) {
361 up = pLastLine[byte];
362 }
363 uint8_t upper_left = 0;
364 if (byte >= BytesPerPixel && pLastLine) {
365 upper_left = pLastLine[byte - BytesPerPixel];
366 }
367 pDestData[byte] = raw_byte + PathPredictor(left, up, upper_left);
368 break;
369 }
370 default:
371 pDestData[byte] = raw_byte;
372 break;
373 }
374 }
375 }
376
PNG_Predictor(int Colors,int BitsPerComponent,int Columns,std::unique_ptr<uint8_t,FxFreeDeleter> * data_buf,uint32_t * data_size)377 bool PNG_Predictor(int Colors,
378 int BitsPerComponent,
379 int Columns,
380 std::unique_ptr<uint8_t, FxFreeDeleter>* data_buf,
381 uint32_t* data_size) {
382 // TODO(thestig): Look into using CalculatePitch8() here.
383 const int BytesPerPixel = (Colors * BitsPerComponent + 7) / 8;
384 const int row_size = (Colors * BitsPerComponent * Columns + 7) / 8;
385 if (row_size <= 0)
386 return false;
387 const int row_count = (*data_size + row_size) / (row_size + 1);
388 if (row_count <= 0)
389 return false;
390 const int last_row_size = *data_size % (row_size + 1);
391 std::unique_ptr<uint8_t, FxFreeDeleter> dest_buf(
392 FX_Alloc2D(uint8_t, row_size, row_count));
393 uint32_t byte_cnt = 0;
394 uint8_t* pSrcData = data_buf->get();
395 uint8_t* pDestData = dest_buf.get();
396 for (int row = 0; row < row_count; row++) {
397 uint8_t tag = pSrcData[0];
398 byte_cnt++;
399 if (tag == 0) {
400 int move_size = row_size;
401 if ((row + 1) * (move_size + 1) > static_cast<int>(*data_size)) {
402 move_size = last_row_size - 1;
403 }
404 memcpy(pDestData, pSrcData + 1, move_size);
405 pSrcData += move_size + 1;
406 pDestData += move_size;
407 byte_cnt += move_size;
408 continue;
409 }
410 for (int byte = 0; byte < row_size && byte_cnt < *data_size;
411 ++byte, ++byte_cnt) {
412 uint8_t raw_byte = pSrcData[byte + 1];
413 switch (tag) {
414 case 1: {
415 uint8_t left = 0;
416 if (byte >= BytesPerPixel) {
417 left = pDestData[byte - BytesPerPixel];
418 }
419 pDestData[byte] = raw_byte + left;
420 break;
421 }
422 case 2: {
423 uint8_t up = 0;
424 if (row) {
425 up = pDestData[byte - row_size];
426 }
427 pDestData[byte] = raw_byte + up;
428 break;
429 }
430 case 3: {
431 uint8_t left = 0;
432 if (byte >= BytesPerPixel) {
433 left = pDestData[byte - BytesPerPixel];
434 }
435 uint8_t up = 0;
436 if (row) {
437 up = pDestData[byte - row_size];
438 }
439 pDestData[byte] = raw_byte + (up + left) / 2;
440 break;
441 }
442 case 4: {
443 uint8_t left = 0;
444 if (byte >= BytesPerPixel) {
445 left = pDestData[byte - BytesPerPixel];
446 }
447 uint8_t up = 0;
448 if (row) {
449 up = pDestData[byte - row_size];
450 }
451 uint8_t upper_left = 0;
452 if (byte >= BytesPerPixel && row) {
453 upper_left = pDestData[byte - row_size - BytesPerPixel];
454 }
455 pDestData[byte] = raw_byte + PathPredictor(left, up, upper_left);
456 break;
457 }
458 default:
459 pDestData[byte] = raw_byte;
460 break;
461 }
462 }
463 pSrcData += row_size + 1;
464 pDestData += row_size;
465 }
466 *data_buf = std::move(dest_buf);
467 *data_size = row_size * row_count -
468 (last_row_size > 0 ? (row_size + 1 - last_row_size) : 0);
469 return true;
470 }
471
TIFF_PredictLine(uint8_t * dest_buf,uint32_t row_size,int BitsPerComponent,int Colors,int Columns)472 void TIFF_PredictLine(uint8_t* dest_buf,
473 uint32_t row_size,
474 int BitsPerComponent,
475 int Colors,
476 int Columns) {
477 if (BitsPerComponent == 1) {
478 int row_bits = std::min(BitsPerComponent * Colors * Columns,
479 pdfium::base::checked_cast<int>(row_size * 8));
480 int index_pre = 0;
481 int col_pre = 0;
482 for (int i = 1; i < row_bits; i++) {
483 int col = i % 8;
484 int index = i / 8;
485 if (((dest_buf[index] >> (7 - col)) & 1) ^
486 ((dest_buf[index_pre] >> (7 - col_pre)) & 1)) {
487 dest_buf[index] |= 1 << (7 - col);
488 } else {
489 dest_buf[index] &= ~(1 << (7 - col));
490 }
491 index_pre = index;
492 col_pre = col;
493 }
494 return;
495 }
496 int BytesPerPixel = BitsPerComponent * Colors / 8;
497 if (BitsPerComponent == 16) {
498 for (uint32_t i = BytesPerPixel; i + 1 < row_size; i += 2) {
499 uint16_t pixel =
500 (dest_buf[i - BytesPerPixel] << 8) | dest_buf[i - BytesPerPixel + 1];
501 pixel += (dest_buf[i] << 8) | dest_buf[i + 1];
502 dest_buf[i] = pixel >> 8;
503 dest_buf[i + 1] = (uint8_t)pixel;
504 }
505 } else {
506 for (uint32_t i = BytesPerPixel; i < row_size; i++) {
507 dest_buf[i] += dest_buf[i - BytesPerPixel];
508 }
509 }
510 }
511
TIFF_Predictor(int Colors,int BitsPerComponent,int Columns,std::unique_ptr<uint8_t,FxFreeDeleter> * data_buf,uint32_t * data_size)512 bool TIFF_Predictor(int Colors,
513 int BitsPerComponent,
514 int Columns,
515 std::unique_ptr<uint8_t, FxFreeDeleter>* data_buf,
516 uint32_t* data_size) {
517 int row_size = (Colors * BitsPerComponent * Columns + 7) / 8;
518 if (row_size == 0)
519 return false;
520 const int row_count = (*data_size + row_size - 1) / row_size;
521 const int last_row_size = *data_size % row_size;
522 for (int row = 0; row < row_count; row++) {
523 uint8_t* scan_line = data_buf->get() + row * row_size;
524 if ((row + 1) * row_size > static_cast<int>(*data_size)) {
525 row_size = last_row_size;
526 }
527 TIFF_PredictLine(scan_line, row_size, BitsPerComponent, Colors, Columns);
528 }
529 return true;
530 }
531
FlateUncompress(pdfium::span<const uint8_t> src_buf,uint32_t orig_size,std::unique_ptr<uint8_t,FxFreeDeleter> * dest_buf,uint32_t * dest_size,uint32_t * offset)532 void FlateUncompress(pdfium::span<const uint8_t> src_buf,
533 uint32_t orig_size,
534 std::unique_ptr<uint8_t, FxFreeDeleter>* dest_buf,
535 uint32_t* dest_size,
536 uint32_t* offset) {
537 dest_buf->reset();
538 *dest_size = 0;
539
540 std::unique_ptr<z_stream, FlateDeleter> context(FlateInit());
541 if (!context)
542 return;
543
544 FlateInput(context.get(), src_buf);
545
546 const uint32_t kMaxInitialAllocSize = 10000000;
547 uint32_t guess_size =
548 orig_size ? orig_size
549 : pdfium::base::checked_cast<uint32_t>(src_buf.size() * 2);
550 guess_size = std::min(guess_size, kMaxInitialAllocSize);
551
552 uint32_t buf_size = guess_size;
553 uint32_t last_buf_size = buf_size;
554 std::unique_ptr<uint8_t, FxFreeDeleter> guess_buf(
555 FX_Alloc(uint8_t, guess_size + 1));
556 guess_buf.get()[guess_size] = '\0';
557
558 std::vector<std::unique_ptr<uint8_t, FxFreeDeleter>> result_tmp_bufs;
559 {
560 std::unique_ptr<uint8_t, FxFreeDeleter> cur_buf = std::move(guess_buf);
561 while (true) {
562 uint32_t ret = FlateOutput(context.get(), cur_buf.get(), buf_size);
563 uint32_t avail_buf_size = FlateGetAvailOut(context.get());
564 if (ret != Z_OK || avail_buf_size != 0) {
565 last_buf_size = buf_size - avail_buf_size;
566 result_tmp_bufs.push_back(std::move(cur_buf));
567 break;
568 }
569 result_tmp_bufs.push_back(std::move(cur_buf));
570 cur_buf.reset(FX_Alloc(uint8_t, buf_size + 1));
571 cur_buf.get()[buf_size] = '\0';
572 }
573 }
574
575 // The TotalOut size returned from the library may not be big enough to
576 // handle the content the library returns. We can only handle items
577 // up to 4GB in size.
578 *dest_size = FlateGetPossiblyTruncatedTotalOut(context.get());
579 *offset = FlateGetPossiblyTruncatedTotalIn(context.get());
580 if (result_tmp_bufs.size() == 1) {
581 *dest_buf = std::move(result_tmp_bufs[0]);
582 return;
583 }
584
585 std::unique_ptr<uint8_t, FxFreeDeleter> result_buf(
586 FX_Alloc(uint8_t, *dest_size));
587 uint32_t result_pos = 0;
588 uint32_t remaining = *dest_size;
589 for (size_t i = 0; i < result_tmp_bufs.size(); i++) {
590 std::unique_ptr<uint8_t, FxFreeDeleter> tmp_buf =
591 std::move(result_tmp_bufs[i]);
592 uint32_t tmp_buf_size = buf_size;
593 if (i == result_tmp_bufs.size() - 1)
594 tmp_buf_size = last_buf_size;
595
596 uint32_t cp_size = std::min(tmp_buf_size, remaining);
597 memcpy(result_buf.get() + result_pos, tmp_buf.get(), cp_size);
598 result_pos += cp_size;
599 remaining -= cp_size;
600 }
601 *dest_buf = std::move(result_buf);
602 }
603
604 enum class PredictorType : uint8_t { kNone, kFlate, kPng };
GetPredictor(int predictor)605 static PredictorType GetPredictor(int predictor) {
606 if (predictor >= 10)
607 return PredictorType::kPng;
608 if (predictor == 2)
609 return PredictorType::kFlate;
610 return PredictorType::kNone;
611 }
612
613 class FlateScanlineDecoder : public ScanlineDecoder {
614 public:
615 FlateScanlineDecoder(pdfium::span<const uint8_t> src_span,
616 int width,
617 int height,
618 int nComps,
619 int bpc);
620 ~FlateScanlineDecoder() override;
621
622 // ScanlineDecoder:
623 bool Rewind() override;
624 pdfium::span<uint8_t> GetNextLine() override;
625 uint32_t GetSrcOffset() override;
626
627 protected:
628 std::unique_ptr<z_stream, FlateDeleter> m_pFlate;
629 const pdfium::span<const uint8_t> m_SrcBuf;
630 DataVector<uint8_t> m_Scanline;
631 };
632
FlateScanlineDecoder(pdfium::span<const uint8_t> src_span,int width,int height,int nComps,int bpc)633 FlateScanlineDecoder::FlateScanlineDecoder(pdfium::span<const uint8_t> src_span,
634 int width,
635 int height,
636 int nComps,
637 int bpc)
638 : ScanlineDecoder(width,
639 height,
640 width,
641 height,
642 nComps,
643 bpc,
644 fxge::CalculatePitch8OrDie(bpc, nComps, width)),
645 m_SrcBuf(src_span),
646 m_Scanline(m_Pitch) {}
647
~FlateScanlineDecoder()648 FlateScanlineDecoder::~FlateScanlineDecoder() {
649 // Span in superclass can't outlive our buffer.
650 m_pLastScanline = pdfium::span<uint8_t>();
651 }
652
Rewind()653 bool FlateScanlineDecoder::Rewind() {
654 m_pFlate.reset(FlateInit());
655 if (!m_pFlate)
656 return false;
657
658 FlateInput(m_pFlate.get(), m_SrcBuf);
659 return true;
660 }
661
GetNextLine()662 pdfium::span<uint8_t> FlateScanlineDecoder::GetNextLine() {
663 FlateOutput(m_pFlate.get(), m_Scanline.data(), m_Pitch);
664 return m_Scanline;
665 }
666
GetSrcOffset()667 uint32_t FlateScanlineDecoder::GetSrcOffset() {
668 return FlateGetPossiblyTruncatedTotalIn(m_pFlate.get());
669 }
670
671 class FlatePredictorScanlineDecoder final : public FlateScanlineDecoder {
672 public:
673 FlatePredictorScanlineDecoder(pdfium::span<const uint8_t> src_span,
674 int width,
675 int height,
676 int comps,
677 int bpc,
678 PredictorType predictor,
679 int Colors,
680 int BitsPerComponent,
681 int Columns);
682 ~FlatePredictorScanlineDecoder() override;
683
684 // ScanlineDecoder:
685 bool Rewind() override;
686 pdfium::span<uint8_t> GetNextLine() override;
687
688 private:
689 void GetNextLineWithPredictedPitch();
690 void GetNextLineWithoutPredictedPitch();
691
692 const PredictorType m_Predictor;
693 int m_Colors = 0;
694 int m_BitsPerComponent = 0;
695 int m_Columns = 0;
696 uint32_t m_PredictPitch = 0;
697 size_t m_LeftOver = 0;
698 DataVector<uint8_t> m_LastLine;
699 DataVector<uint8_t> m_PredictBuffer;
700 DataVector<uint8_t> m_PredictRaw;
701 };
702
FlatePredictorScanlineDecoder(pdfium::span<const uint8_t> src_span,int width,int height,int comps,int bpc,PredictorType predictor,int Colors,int BitsPerComponent,int Columns)703 FlatePredictorScanlineDecoder::FlatePredictorScanlineDecoder(
704 pdfium::span<const uint8_t> src_span,
705 int width,
706 int height,
707 int comps,
708 int bpc,
709 PredictorType predictor,
710 int Colors,
711 int BitsPerComponent,
712 int Columns)
713 : FlateScanlineDecoder(src_span, width, height, comps, bpc),
714 m_Predictor(predictor) {
715 DCHECK(m_Predictor != PredictorType::kNone);
716 if (BitsPerComponent * Colors * Columns == 0) {
717 BitsPerComponent = m_bpc;
718 Colors = m_nComps;
719 Columns = m_OrigWidth;
720 }
721 m_Colors = Colors;
722 m_BitsPerComponent = BitsPerComponent;
723 m_Columns = Columns;
724 m_PredictPitch =
725 fxge::CalculatePitch8OrDie(m_BitsPerComponent, m_Colors, m_Columns);
726 m_LastLine.resize(m_PredictPitch);
727 m_PredictBuffer.resize(m_PredictPitch);
728 m_PredictRaw.resize(m_PredictPitch + 1);
729 }
730
~FlatePredictorScanlineDecoder()731 FlatePredictorScanlineDecoder::~FlatePredictorScanlineDecoder() {
732 // Span in superclass can't outlive our buffer.
733 m_pLastScanline = pdfium::span<uint8_t>();
734 }
735
Rewind()736 bool FlatePredictorScanlineDecoder::Rewind() {
737 if (!FlateScanlineDecoder::Rewind())
738 return false;
739
740 m_LeftOver = 0;
741 return true;
742 }
743
GetNextLine()744 pdfium::span<uint8_t> FlatePredictorScanlineDecoder::GetNextLine() {
745 if (m_Pitch == m_PredictPitch)
746 GetNextLineWithPredictedPitch();
747 else
748 GetNextLineWithoutPredictedPitch();
749 return m_Scanline;
750 }
751
GetNextLineWithPredictedPitch()752 void FlatePredictorScanlineDecoder::GetNextLineWithPredictedPitch() {
753 switch (m_Predictor) {
754 case PredictorType::kPng:
755 FlateOutput(m_pFlate.get(), m_PredictRaw.data(), m_PredictPitch + 1);
756 PNG_PredictLine(m_Scanline, m_PredictRaw, m_LastLine, m_BitsPerComponent,
757 m_Colors, m_Columns);
758 memcpy(m_LastLine.data(), m_Scanline.data(), m_PredictPitch);
759 break;
760 case PredictorType::kFlate:
761 FlateOutput(m_pFlate.get(), m_Scanline.data(), m_Pitch);
762 TIFF_PredictLine(m_Scanline.data(), m_PredictPitch, m_bpc, m_nComps,
763 m_OutputWidth);
764 break;
765 case PredictorType::kNone:
766 NOTREACHED_NORETURN();
767 }
768 }
769
GetNextLineWithoutPredictedPitch()770 void FlatePredictorScanlineDecoder::GetNextLineWithoutPredictedPitch() {
771 size_t bytes_to_go = m_Pitch;
772 size_t read_leftover = m_LeftOver > bytes_to_go ? bytes_to_go : m_LeftOver;
773 if (read_leftover) {
774 memcpy(m_Scanline.data(), &m_PredictBuffer[m_PredictPitch - m_LeftOver],
775 read_leftover);
776 m_LeftOver -= read_leftover;
777 bytes_to_go -= read_leftover;
778 }
779 while (bytes_to_go) {
780 switch (m_Predictor) {
781 case PredictorType::kPng:
782 FlateOutput(m_pFlate.get(), m_PredictRaw.data(), m_PredictPitch + 1);
783 PNG_PredictLine(m_PredictBuffer, m_PredictRaw, m_LastLine,
784 m_BitsPerComponent, m_Colors, m_Columns);
785 memcpy(m_LastLine.data(), m_PredictBuffer.data(), m_PredictPitch);
786 break;
787 case PredictorType::kFlate:
788 FlateOutput(m_pFlate.get(), m_PredictBuffer.data(), m_PredictPitch);
789 TIFF_PredictLine(m_PredictBuffer.data(), m_PredictPitch,
790 m_BitsPerComponent, m_Colors, m_Columns);
791 break;
792 case PredictorType::kNone:
793 NOTREACHED_NORETURN();
794 }
795 size_t read_bytes =
796 m_PredictPitch > bytes_to_go ? bytes_to_go : m_PredictPitch;
797 fxcrt::spancpy(pdfium::make_span(m_Scanline).subspan(m_Pitch - bytes_to_go),
798 pdfium::make_span(m_PredictBuffer).first(read_bytes));
799 m_LeftOver += m_PredictPitch - read_bytes;
800 bytes_to_go -= read_bytes;
801 }
802 }
803
804 } // namespace
805
806 // static
CreateDecoder(pdfium::span<const uint8_t> src_span,int width,int height,int nComps,int bpc,int predictor,int Colors,int BitsPerComponent,int Columns)807 std::unique_ptr<ScanlineDecoder> FlateModule::CreateDecoder(
808 pdfium::span<const uint8_t> src_span,
809 int width,
810 int height,
811 int nComps,
812 int bpc,
813 int predictor,
814 int Colors,
815 int BitsPerComponent,
816 int Columns) {
817 PredictorType predictor_type = GetPredictor(predictor);
818 if (predictor_type == PredictorType::kNone) {
819 return std::make_unique<FlateScanlineDecoder>(src_span, width, height,
820 nComps, bpc);
821 }
822 return std::make_unique<FlatePredictorScanlineDecoder>(
823 src_span, width, height, nComps, bpc, predictor_type, Colors,
824 BitsPerComponent, Columns);
825 }
826
827 // static
FlateOrLZWDecode(bool bLZW,pdfium::span<const uint8_t> src_span,bool bEarlyChange,int predictor,int Colors,int BitsPerComponent,int Columns,uint32_t estimated_size,std::unique_ptr<uint8_t,FxFreeDeleter> * dest_buf,uint32_t * dest_size)828 uint32_t FlateModule::FlateOrLZWDecode(
829 bool bLZW,
830 pdfium::span<const uint8_t> src_span,
831 bool bEarlyChange,
832 int predictor,
833 int Colors,
834 int BitsPerComponent,
835 int Columns,
836 uint32_t estimated_size,
837 std::unique_ptr<uint8_t, FxFreeDeleter>* dest_buf,
838 uint32_t* dest_size) {
839 dest_buf->reset();
840 uint32_t offset = 0;
841 PredictorType predictor_type = GetPredictor(predictor);
842
843 if (bLZW) {
844 auto decoder = std::make_unique<CLZWDecoder>(src_span, bEarlyChange);
845 if (!decoder->Decode())
846 return FX_INVALID_OFFSET;
847
848 offset = decoder->GetSrcSize();
849 *dest_size = decoder->GetDestSize();
850 *dest_buf = decoder->TakeDestBuf();
851 } else {
852 FlateUncompress(src_span, estimated_size, dest_buf, dest_size, &offset);
853 }
854
855 bool ret = false;
856 switch (predictor_type) {
857 case PredictorType::kNone:
858 return offset;
859 case PredictorType::kPng:
860 ret =
861 PNG_Predictor(Colors, BitsPerComponent, Columns, dest_buf, dest_size);
862 break;
863 case PredictorType::kFlate:
864 ret = TIFF_Predictor(Colors, BitsPerComponent, Columns, dest_buf,
865 dest_size);
866 break;
867 }
868 return ret ? offset : FX_INVALID_OFFSET;
869 }
870
871 // static
Encode(pdfium::span<const uint8_t> src_span)872 DataVector<uint8_t> FlateModule::Encode(pdfium::span<const uint8_t> src_span) {
873 const unsigned long src_size =
874 pdfium::base::checked_cast<unsigned long>(src_span.size());
875 pdfium::base::CheckedNumeric<unsigned long> safe_dest_size = src_size;
876 safe_dest_size += src_size / 1000;
877 safe_dest_size += 12;
878 unsigned long dest_size = safe_dest_size.ValueOrDie();
879 DataVector<uint8_t> dest_buf(dest_size);
880 if (!FlateCompress(dest_buf.data(), &dest_size, src_span.data(), src_size))
881 return {};
882
883 dest_buf.resize(pdfium::base::checked_cast<size_t>(dest_size));
884 return dest_buf;
885 }
886
887 } // namespace fxcodec
888