Bug Summary

File:jdk/src/java.desktop/share/native/libjavajpeg/jdhuff.c
Warning:line 188, column 15
Array access (via field 'bits') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name jdhuff.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -mthread-model posix -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib/llvm-10/lib/clang/10.0.0 -I /home/daniel/Projects/java/jdk/build/linux-x86_64-server-fastdebug/support/modules_include/java.base -I /home/daniel/Projects/java/jdk/build/linux-x86_64-server-fastdebug/support/modules_include/java.base/linux -I /home/daniel/Projects/java/jdk/src/java.base/share/native/libjava -I /home/daniel/Projects/java/jdk/src/java.base/unix/native/libjava -I /home/daniel/Projects/java/jdk/src/hotspot/share/include -I /home/daniel/Projects/java/jdk/src/hotspot/os/posix/include -D LIBC=gnu -D _GNU_SOURCE -D _REENTRANT -D _LARGEFILE64_SOURCE -D LINUX -D DEBUG -D _LITTLE_ENDIAN -D ARCH="amd64" -D amd64 -D _LP64=1 -D SPLASHSCREEN -D PNG_NO_MMX_CODE -D PNG_ARM_NEON_OPT=0 -D PNG_ARM_NEON_IMPLEMENTATION=0 -D WITH_X11 -I /home/daniel/Projects/java/jdk/src/java.desktop/unix/native/libsplashscreen -I /home/daniel/Projects/java/jdk/src/java.desktop/share/native/libsplashscreen -I /home/daniel/Projects/java/jdk/src/java.desktop/unix/native/common/awt/systemscale -I /home/daniel/Projects/java/jdk/src/java.desktop/share/native/libjavajpeg -I /home/daniel/Projects/java/jdk/build/linux-x86_64-server-fastdebug/support/headers/java.desktop -I /home/daniel/Projects/java/jdk/src/java.desktop/share/native/libsplashscreen/giflib -I /home/daniel/Projects/java/jdk/src/java.desktop/share/native/libsplashscreen/libpng -I /home/daniel/Projects/java/jdk/src/java.base/unix/native/include -I /home/daniel/Projects/java/jdk/src/java.base/share/native/include -I /home/daniel/Projects/java/jdk/src/java.base/linux/native/libjava -I /home/daniel/Projects/java/jdk/src/java.base/unix/native/libjava -I /home/daniel/Projects/java/jdk/src/java.base/share/native/libjava -D _FORTIFY_SOURCE=2 -internal-isystem /usr/local/include -internal-isystem /usr/lib/llvm-10/lib/clang/10.0.0/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -Wno-unused-parameter -Wno-unused -Wno-sign-compare -Wno-type-limits -Wno-unused-result -Wno-maybe-uninitialized -Wno-shift-negative-value -Wno-implicit-fallthrough -Wno-unused-function -std=c99 -fdebug-compilation-dir /home/daniel/Projects/java/jdk/make -ferror-limit 19 -fmessage-length 0 -fvisibility hidden -stack-protector 1 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -vectorize-loops -vectorize-slp -analyzer-output=html -faddrsig -o /home/daniel/Projects/java/scan/2021-12-21-193737-8510-1 -x c /home/daniel/Projects/java/jdk/src/java.desktop/share/native/libjavajpeg/jdhuff.c
1/*
2 * reserved comment block
3 * DO NOT REMOVE OR ALTER!
4 */
5/*
6 * jdhuff.c
7 *
8 * Copyright (C) 1991-1997, Thomas G. Lane.
9 * This file is part of the Independent JPEG Group's software.
10 * For conditions of distribution and use, see the accompanying README file.
11 *
12 * This file contains Huffman entropy decoding routines.
13 *
14 * Much of the complexity here has to do with supporting input suspension.
15 * If the data source module demands suspension, we want to be able to back
16 * up to the start of the current MCU. To do this, we copy state variables
17 * into local working storage, and update them back to the permanent
18 * storage only upon successful completion of an MCU.
19 */
20
21#define JPEG_INTERNALS
22#include "jinclude.h"
23#include "jpeglib.h"
24#include "jdhuff.h" /* Declarations shared with jdphuff.c */
25
26
27/*
28 * Expanded entropy decoder object for Huffman decoding.
29 *
30 * The savable_state subrecord contains fields that change within an MCU,
31 * but must not be updated permanently until we complete the MCU.
32 */
33
34typedef struct {
35 int last_dc_val[MAX_COMPS_IN_SCAN4]; /* last DC coef for each component */
36} savable_state;
37
38/* This macro is to work around compilers with missing or broken
39 * structure assignment. You'll need to fix this code if you have
40 * such a compiler and you change MAX_COMPS_IN_SCAN.
41 */
42
43#ifndef NO_STRUCT_ASSIGN
44#define ASSIGN_STATE(dest,src)((dest) = (src)) ((dest) = (src))
45#else
46#if MAX_COMPS_IN_SCAN4 == 4
47#define ASSIGN_STATE(dest,src)((dest) = (src)) \
48 ((dest).last_dc_val[0] = (src).last_dc_val[0], \
49 (dest).last_dc_val[1] = (src).last_dc_val[1], \
50 (dest).last_dc_val[2] = (src).last_dc_val[2], \
51 (dest).last_dc_val[3] = (src).last_dc_val[3])
52#endif
53#endif
54
55
56typedef struct {
57 struct jpeg_entropy_decoder pub; /* public fields */
58
59 /* These fields are loaded into local variables at start of each MCU.
60 * In case of suspension, we exit WITHOUT updating them.
61 */
62 bitread_perm_state bitstate; /* Bit buffer at start of MCU */
63 savable_state saved; /* Other state at start of MCU */
64
65 /* These fields are NOT loaded into local working state. */
66 unsigned int restarts_to_go; /* MCUs left in this restart interval */
67
68 /* Pointers to derived tables (these workspaces have image lifespan) */
69 d_derived_tbl * dc_derived_tbls[NUM_HUFF_TBLS4];
70 d_derived_tbl * ac_derived_tbls[NUM_HUFF_TBLS4];
71
72 /* Precalculated info set up by start_pass for use in decode_mcu: */
73
74 /* Pointers to derived tables to be used for each block within an MCU */
75 d_derived_tbl * dc_cur_tbls[D_MAX_BLOCKS_IN_MCU10];
76 d_derived_tbl * ac_cur_tbls[D_MAX_BLOCKS_IN_MCU10];
77 /* Whether we care about the DC and AC coefficient values for each block */
78 boolean dc_needed[D_MAX_BLOCKS_IN_MCU10];
79 boolean ac_needed[D_MAX_BLOCKS_IN_MCU10];
80} huff_entropy_decoder;
81
82typedef huff_entropy_decoder * huff_entropy_ptr;
83
84
85/*
86 * Initialize for a Huffman-compressed scan.
87 */
88
89METHODDEF(void)static void
90start_pass_huff_decoder (j_decompress_ptr cinfo)
91{
92 huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
93 int ci, blkn, dctbl, actbl;
94 jpeg_component_info * compptr;
95
96 /* Check that the scan parameters Ss, Se, Ah/Al are OK for sequential JPEG.
97 * This ought to be an error condition, but we make it a warning because
98 * there are some baseline files out there with all zeroes in these bytes.
99 */
100 if (cinfo->Ss != 0 || cinfo->Se != DCTSIZE264-1 ||
1
Assuming field 'Ss' is equal to 0
→
2
←
Assuming the condition is false
→
5
←
Taking false branch
→
101 cinfo->Ah != 0 || cinfo->Al != 0)
3
←
Assuming field 'Ah' is equal to 0
→
4
←
Assuming field 'Al' is equal to 0
→
102 WARNMS(cinfo, JWRN_NOT_SEQUENTIAL)((cinfo)->err->msg_code = (JWRN_NOT_SEQUENTIAL), (*(cinfo
)->err->emit_message) ((j_common_ptr) (cinfo), -1));
103
104 for (ci = 0; ci < cinfo->comps_in_scan; ci++) {
6
←
Assuming 'ci' is < field 'comps_in_scan'
→
7
←
Loop condition is true. Entering loop body
→
105 compptr = cinfo->cur_comp_info[ci];
106 dctbl = compptr->dc_tbl_no;
107 actbl = compptr->ac_tbl_no;
108 /* Compute derived values for Huffman tables */
109 /* We may do this more than once for a table, but it's not expensive */
110 jpeg_make_d_derived_tbljMkDDerived(cinfo, TRUE1, dctbl,
8
←
Calling 'jMkDDerived'
→
111 & entropy->dc_derived_tbls[dctbl]);
112 jpeg_make_d_derived_tbljMkDDerived(cinfo, FALSE0, actbl,
113 & entropy->ac_derived_tbls[actbl]);
114 /* Initialize DC predictions to 0 */
115 entropy->saved.last_dc_val[ci] = 0;
116 }
117
118 /* Precalculate decoding info for each block in an MCU of this scan */
119 for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
120 ci = cinfo->MCU_membership[blkn];
121 compptr = cinfo->cur_comp_info[ci];
122 /* Precalculate which table to use for each block */
123 entropy->dc_cur_tbls[blkn] = entropy->dc_derived_tbls[compptr->dc_tbl_no];
124 entropy->ac_cur_tbls[blkn] = entropy->ac_derived_tbls[compptr->ac_tbl_no];
125 /* Decide whether we really care about the coefficient values */
126 if (compptr->component_needed) {
127 entropy->dc_needed[blkn] = TRUE1;
128 /* we don't need the ACs if producing a 1/8th-size image */
129 entropy->ac_needed[blkn] = (compptr->DCT_scaled_size > 1);
130 } else {
131 entropy->dc_needed[blkn] = entropy->ac_needed[blkn] = FALSE0;
132 }
133 }
134
135 /* Initialize bitread state variables */
136 entropy->bitstate.bits_left = 0;
137 entropy->bitstate.get_buffer = 0; /* unnecessary, but keeps Purify quiet */
138 entropy->pub.insufficient_data = FALSE0;
139
140 /* Initialize restart counter */
141 entropy->restarts_to_go = cinfo->restart_interval;
142}
143
144
145/*
146 * Compute the derived values for a Huffman table.
147 * This routine also performs some validation checks on the table.
148 *
149 * Note this is also used by jdphuff.c.
150 */
151
152GLOBAL(void)void
153jpeg_make_d_derived_tbljMkDDerived (j_decompress_ptr cinfo, boolean isDC, int tblno,
154 d_derived_tbl ** pdtbl)
155{
156 JHUFF_TBL *htbl;
157 d_derived_tbl *dtbl;
158 int p, i, l, si, numsymbols;
159 int lookbits, ctr;
160 char huffsize[257];
161 unsigned int huffcode[257];
162 unsigned int code;
163
164 /* Note that huffsize[] and huffcode[] are filled in code-length order,
165 * paralleling the order of the symbols themselves in htbl->huffval[].
166 */
167
168 /* Find the input Huffman table */
169 if (tblno < 0 || tblno >= NUM_HUFF_TBLS4)
9
←
Assuming 'tblno' is >= 0
→
10
←
Assuming 'tblno' is < NUM_HUFF_TBLS
→
11
←
Taking false branch
→
170 ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno)((cinfo)->err->msg_code = (JERR_NO_HUFF_TABLE), (cinfo)
->err->msg_parm.i[0] = (tblno), (*(cinfo)->err->error_exit
) ((j_common_ptr) (cinfo)));
171 htbl =
13
←
Value assigned to 'htbl'
→
172 isDC
11.1
'isDC' is 1
 ? cinfo->dc_huff_tbl_ptrs[tblno] : cinfo->ac_huff_tbl_ptrs[tblno];
12
←
'?' condition is true
→
173 if (htbl == NULL((void*)0))
14
←
Assuming 'htbl' is equal to NULL
→
15
←
Taking true branch
→
174 ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno)((cinfo)->err->msg_code = (JERR_NO_HUFF_TABLE), (cinfo)
->err->msg_parm.i[0] = (tblno), (*(cinfo)->err->error_exit
) ((j_common_ptr) (cinfo)));
175
176 /* Allocate a workspace if we haven't already done so. */
177 if (*pdtbl == NULL((void*)0))
16
←
Assuming the condition is false
→
17
←
Taking false branch
→
178 *pdtbl = (d_derived_tbl *)
179 (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE1,
180 SIZEOF(d_derived_tbl)((size_t) sizeof(d_derived_tbl)));
181 dtbl = *pdtbl;
182 dtbl->pub = htbl; /* fill in back link */
183
184 /* Figure C.1: make table of Huffman code length for each symbol */
185
186 p = 0;
187 for (l = 1; l <= 16; l++) {
18
←
Loop condition is true. Entering loop body
→
188 i = (int) htbl->bits[l];
19
←
Array access (via field 'bits') results in a null pointer dereference
189 if (i < 0 || p + i > 256) /* protect against table overrun */
190 ERREXIT(cinfo, JERR_BAD_HUFF_TABLE)((cinfo)->err->msg_code = (JERR_BAD_HUFF_TABLE), (*(cinfo
)->err->error_exit) ((j_common_ptr) (cinfo)));
191 while (i--)
192 huffsize[p++] = (char) l;
193 }
194 huffsize[p] = 0;
195 numsymbols = p;
196
197 /* Figure C.2: generate the codes themselves */
198 /* We also validate that the counts represent a legal Huffman code tree. */
199
200 code = 0;
201 si = huffsize[0];
202 p = 0;
203 while (huffsize[p]) {
204 while (((int) huffsize[p]) == si) {
205 huffcode[p++] = code;
206 code++;
207 }
208 /* code is now 1 more than the last code used for codelength si; but
209 * it must still fit in si bits, since no code is allowed to be all ones.
210 */
211 if (((INT32) code) >= (((INT32) 1) << si))
212 ERREXIT(cinfo, JERR_BAD_HUFF_TABLE)((cinfo)->err->msg_code = (JERR_BAD_HUFF_TABLE), (*(cinfo
)->err->error_exit) ((j_common_ptr) (cinfo)));
213 code <<= 1;
214 si++;
215 }
216
217 /* Figure F.15: generate decoding tables for bit-sequential decoding */
218
219 p = 0;
220 for (l = 1; l <= 16; l++) {
221 if (htbl->bits[l]) {
222 /* valoffset[l] = huffval[] index of 1st symbol of code length l,
223 * minus the minimum code of length l
224 */
225 dtbl->valoffset[l] = (INT32) p - (INT32) huffcode[p];
226 p += htbl->bits[l];
227 dtbl->maxcode[l] = huffcode[p-1]; /* maximum code of length l */
228 } else {
229 dtbl->maxcode[l] = -1; /* -1 if no codes of this length */
230 }
231 }
232 dtbl->maxcode[17] = 0xFFFFFL; /* ensures jpeg_huff_decode terminates */
233
234 /* Compute lookahead tables to speed up decoding.
235 * First we set all the table entries to 0, indicating "too long";
236 * then we iterate through the Huffman codes that are short enough and
237 * fill in all the entries that correspond to bit sequences starting
238 * with that code.
239 */
240
241 MEMZERO(dtbl->look_nbits, SIZEOF(dtbl->look_nbits))memset((void *)(dtbl->look_nbits), 0, (size_t)(((size_t) sizeof
(dtbl->look_nbits))));
242
243 p = 0;
244 for (l = 1; l <= HUFF_LOOKAHEAD8; l++) {
245 for (i = 1; i <= (int) htbl->bits[l]; i++, p++) {
246 /* l = current code's length, p = its index in huffcode[] & huffval[]. */
247 /* Generate left-justified code followed by all possible bit sequences */
248 lookbits = huffcode[p] << (HUFF_LOOKAHEAD8-l);
249 for (ctr = 1 << (HUFF_LOOKAHEAD8-l); ctr > 0; ctr--) {
250 dtbl->look_nbits[lookbits] = l;
251 dtbl->look_sym[lookbits] = htbl->huffval[p];
252 lookbits++;
253 }
254 }
255 }
256
257 /* Validate symbols as being reasonable.
258 * For AC tables, we make no check, but accept all byte values 0..255.
259 * For DC tables, we require the symbols to be in range 0..15.
260 * (Tighter bounds could be applied depending on the data depth and mode,
261 * but this is sufficient to ensure safe decoding.)
262 */
263 if (isDC) {
264 for (i = 0; i < numsymbols; i++) {
265 int sym = htbl->huffval[i];
266 if (sym < 0 || sym > 15)
267 ERREXIT(cinfo, JERR_BAD_HUFF_TABLE)((cinfo)->err->msg_code = (JERR_BAD_HUFF_TABLE), (*(cinfo
)->err->error_exit) ((j_common_ptr) (cinfo)));
268 }
269 }
270}
271
272
273/*
274 * Out-of-line code for bit fetching (shared with jdphuff.c).
275 * See jdhuff.h for info about usage.
276 * Note: current values of get_buffer and bits_left are passed as parameters,
277 * but are returned in the corresponding fields of the state struct.
278 *
279 * On most machines MIN_GET_BITS should be 25 to allow the full 32-bit width
280 * of get_buffer to be used. (On machines with wider words, an even larger
281 * buffer could be used.) However, on some machines 32-bit shifts are
282 * quite slow and take time proportional to the number of places shifted.
283 * (This is true with most PC compilers, for instance.) In this case it may
284 * be a win to set MIN_GET_BITS to the minimum value of 15. This reduces the
285 * average shift distance at the cost of more calls to jpeg_fill_bit_buffer.
286 */
287
288#ifdef SLOW_SHIFT_32
289#define MIN_GET_BITS(32 -7) 15 /* minimum allowable value */
290#else
291#define MIN_GET_BITS(32 -7) (BIT_BUF_SIZE32-7)
292#endif
293
294
295GLOBAL(boolean)boolean
296jpeg_fill_bit_bufferjFilBitBuf (bitread_working_state * state,
297 register bit_buf_type get_buffer, register int bits_left,
298 int nbits)
299/* Load up the bit buffer to a depth of at least nbits */
300{
301 /* Copy heavily used state fields into locals (hopefully registers) */
302 register const JOCTET * next_input_byte = state->next_input_byte;
303 register size_t bytes_in_buffer = state->bytes_in_buffer;
304 j_decompress_ptr cinfo = state->cinfo;
305
306 /* Attempt to load at least MIN_GET_BITS bits into get_buffer. */
307 /* (It is assumed that no request will be for more than that many bits.) */
308 /* We fail to do so only if we hit a marker or are forced to suspend. */
309
310 if (cinfo->unread_marker == 0) { /* cannot advance past a marker */
311 while (bits_left < MIN_GET_BITS(32 -7)) {
312 register int c;
313
314 /* Attempt to read a byte */
315 if (bytes_in_buffer == 0) {
316 if (! (*cinfo->src->fill_input_buffer) (cinfo))
317 return FALSE0;
318 next_input_byte = cinfo->src->next_input_byte;
319 bytes_in_buffer = cinfo->src->bytes_in_buffer;
320 }
321 bytes_in_buffer--;
322 c = GETJOCTET(*next_input_byte++)(*next_input_byte++);
323
324 /* If it's 0xFF, check and discard stuffed zero byte */
325 if (c == 0xFF) {
326 /* Loop here to discard any padding FF's on terminating marker,
327 * so that we can save a valid unread_marker value. NOTE: we will
328 * accept multiple FF's followed by a 0 as meaning a single FF data
329 * byte. This data pattern is not valid according to the standard.
330 */
331 do {
332 if (bytes_in_buffer == 0) {
333 if (! (*cinfo->src->fill_input_buffer) (cinfo))
334 return FALSE0;
335 next_input_byte = cinfo->src->next_input_byte;
336 bytes_in_buffer = cinfo->src->bytes_in_buffer;
337 }
338 bytes_in_buffer--;
339 c = GETJOCTET(*next_input_byte++)(*next_input_byte++);
340 } while (c == 0xFF);
341
342 if (c == 0) {
343 /* Found FF/00, which represents an FF data byte */
344 c = 0xFF;
345 } else {
346 /* Oops, it's actually a marker indicating end of compressed data.
347 * Save the marker code for later use.
348 * Fine point: it might appear that we should save the marker into
349 * bitread working state, not straight into permanent state. But
350 * once we have hit a marker, we cannot need to suspend within the
351 * current MCU, because we will read no more bytes from the data
352 * source. So it is OK to update permanent state right away.
353 */
354 cinfo->unread_marker = c;
355 /* See if we need to insert some fake zero bits. */
356 goto no_more_bytes;
357 }
358 }
359
360 /* OK, load c into get_buffer */
361 get_buffer = (get_buffer << 8) | c;
362 bits_left += 8;
363 } /* end while */
364 } else {
365 no_more_bytes:
366 /* We get here if we've read the marker that terminates the compressed
367 * data segment. There should be enough bits in the buffer register
368 * to satisfy the request; if so, no problem.
369 */
370 if (nbits > bits_left) {
371 /* Uh-oh. Report corrupted data to user and stuff zeroes into
372 * the data stream, so that we can produce some kind of image.
373 * We use a nonvolatile flag to ensure that only one warning message
374 * appears per data segment.
375 */
376 if (! cinfo->entropy->insufficient_data) {
377 WARNMS(cinfo, JWRN_HIT_MARKER)((cinfo)->err->msg_code = (JWRN_HIT_MARKER), (*(cinfo)->
err->emit_message) ((j_common_ptr) (cinfo), -1));
378 cinfo->entropy->insufficient_data = TRUE1;
379 }
380 /* Fill the buffer with zero bits */
381 get_buffer <<= MIN_GET_BITS(32 -7) - bits_left;
382 bits_left = MIN_GET_BITS(32 -7);
383 }
384 }
385
386 /* Unload the local registers */
387 state->next_input_byte = next_input_byte;
388 state->bytes_in_buffer = bytes_in_buffer;
389 state->get_buffer = get_buffer;
390 state->bits_left = bits_left;
391
392 return TRUE1;
393}
394
395
396/*
397 * Out-of-line code for Huffman code decoding.
398 * See jdhuff.h for info about usage.
399 */
400
401GLOBAL(int)int
402jpeg_huff_decodejHufDecode (bitread_working_state * state,
403 register bit_buf_type get_buffer, register int bits_left,
404 d_derived_tbl * htbl, int min_bits)
405{
406 register int l = min_bits;
407 register INT32 code;
408
409 /* HUFF_DECODE has determined that the code is at least min_bits */
410 /* bits long, so fetch that many bits in one swoop. */
411
412 CHECK_BIT_BUFFER(*state, l, return -1){ if (bits_left < (l)) { if (! jFilBitBuf(&(*state),get_buffer
,bits_left,l)) { return -1; } get_buffer = (*state).get_buffer
; bits_left = (*state).bits_left; } };
413 code = GET_BITS(l)(((int) (get_buffer >> (bits_left -= (l)))) & ((1<<
(l))-1));
414
415 /* Collect the rest of the Huffman code one bit at a time. */
416 /* This is per Figure F.16 in the JPEG spec. */
417
418 while (code > htbl->maxcode[l]) {
419 code <<= 1;
420 CHECK_BIT_BUFFER(*state, 1, return -1){ if (bits_left < (1)) { if (! jFilBitBuf(&(*state),get_buffer
,bits_left,1)) { return -1; } get_buffer = (*state).get_buffer
; bits_left = (*state).bits_left; } };
421 code |= GET_BITS(1)(((int) (get_buffer >> (bits_left -= (1)))) & ((1<<
(1))-1));
422 l++;
423 }
424
425 /* Unload the local registers */
426 state->get_buffer = get_buffer;
427 state->bits_left = bits_left;
428
429 /* With garbage input we may reach the sentinel value l = 17. */
430
431 if (l > 16) {
432 WARNMS(state->cinfo, JWRN_HUFF_BAD_CODE)((state->cinfo)->err->msg_code = (JWRN_HUFF_BAD_CODE
), (*(state->cinfo)->err->emit_message) ((j_common_ptr
) (state->cinfo), -1));
433 return 0; /* fake a zero as the safest result */
434 }
435
436 return htbl->pub->huffval[ (int) (code + htbl->valoffset[l]) ];
437}
438
439
440/*
441 * Figure F.12: extend sign bit.
442 * On some machines, a shift and add will be faster than a table lookup.
443 */
444
445#ifdef AVOID_TABLES
446
447#define HUFF_EXTEND(x,s)((x) < extend_test[s] ? (x) + extend_offset[s] : (x)) ((x) < (1<<((s)-1)) ? (x) + (((-1)<<(s)) + 1) : (x))
448
449#else
450
451#define HUFF_EXTEND(x,s)((x) < extend_test[s] ? (x) + extend_offset[s] : (x)) ((x) < extend_test[s] ? (x) + extend_offset[s] : (x))
452
453static const int extend_test[16] = /* entry n is 2**(n-1) */
454 { 0, 0x0001, 0x0002, 0x0004, 0x0008, 0x0010, 0x0020, 0x0040, 0x0080,
455 0x0100, 0x0200, 0x0400, 0x0800, 0x1000, 0x2000, 0x4000 };
456
457static const int extend_offset[16] = /* entry n is (-1 << n) + 1 */
458 { 0,
459 (int)(((unsigned)(~0)<<1) + 1), (int)(((unsigned)(~0)<<2) + 1),
460 (int)(((unsigned)(~0)<<3) + 1), (int)(((unsigned)(~0)<<4) + 1),
461 (int)(((unsigned)(~0)<<5) + 1), (int)(((unsigned)(~0)<<6) + 1),
462 (int)(((unsigned)(~0)<<7) + 1), (int)(((unsigned)(~0)<<8) + 1),
463 (int)(((unsigned)(~0)<<9) + 1), (int)(((unsigned)(~0)<<10) + 1),
464 (int)(((unsigned)(~0)<<11) + 1), (int)(((unsigned)(~0)<<12) + 1),
465 (int)(((unsigned)(~0)<<13) + 1), (int)(((unsigned)(~0)<<14) + 1),
466 (int)(((unsigned)(~0)<<15) + 1) };
467
468#endif /* AVOID_TABLES */
469
470
471/*
472 * Check for a restart marker & resynchronize decoder.
473 * Returns FALSE if must suspend.
474 */
475
476LOCAL(boolean)static boolean
477process_restart (j_decompress_ptr cinfo)
478{
479 huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
480 int ci;
481
482 /* Throw away any unused bits remaining in bit buffer; */
483 /* include any full bytes in next_marker's count of discarded bytes */
484 cinfo->marker->discarded_bytes += entropy->bitstate.bits_left / 8;
485 entropy->bitstate.bits_left = 0;
486
487 /* Advance past the RSTn marker */
488 if (! (*cinfo->marker->read_restart_marker) (cinfo))
489 return FALSE0;
490
491 /* Re-initialize DC predictions to 0 */
492 for (ci = 0; ci < cinfo->comps_in_scan; ci++)
493 entropy->saved.last_dc_val[ci] = 0;
494
495 /* Reset restart counter */
496 entropy->restarts_to_go = cinfo->restart_interval;
497
498 /* Reset out-of-data flag, unless read_restart_marker left us smack up
499 * against a marker. In that case we will end up treating the next data
500 * segment as empty, and we can avoid producing bogus output pixels by
501 * leaving the flag set.
502 */
503 if (cinfo->unread_marker == 0)
504 entropy->pub.insufficient_data = FALSE0;
505
506 return TRUE1;
507}
508
509
510/*
511 * Decode and return one MCU's worth of Huffman-compressed coefficients.
512 * The coefficients are reordered from zigzag order into natural array order,
513 * but are not dequantized.
514 *
515 * The i'th block of the MCU is stored into the block pointed to by
516 * MCU_data[i]. WE ASSUME THIS AREA HAS BEEN ZEROED BY THE CALLER.
517 * (Wholesale zeroing is usually a little faster than retail...)
518 *
519 * Returns FALSE if data source requested suspension. In that case no
520 * changes have been made to permanent state. (Exception: some output
521 * coefficients may already have been assigned. This is harmless for
522 * this module, since we'll just re-assign them on the next call.)
523 */
524
525METHODDEF(boolean)static boolean
526decode_mcu (j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
527{
528 huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
529 int blkn;
530 BITREAD_STATE_VARSregister bit_buf_type get_buffer; register int bits_left; bitread_working_state
br_state;
531 savable_state state;
532
533 /* Process restart marker if needed; may have to suspend */
534 if (cinfo->restart_interval) {
535 if (entropy->restarts_to_go == 0)
536 if (! process_restart(cinfo))
537 return FALSE0;
538 }
539
540 /* If we've run out of data, just leave the MCU set to zeroes.
541 * This way, we return uniform gray for the remainder of the segment.
542 */
543 if (! entropy->pub.insufficient_data) {
544
545 /* Load up working state */
546 BITREAD_LOAD_STATE(cinfo,entropy->bitstate)br_state.cinfo = cinfo; br_state.next_input_byte = cinfo->
src->next_input_byte; br_state.bytes_in_buffer = cinfo->
src->bytes_in_buffer; get_buffer = entropy->bitstate.get_buffer
; bits_left = entropy->bitstate.bits_left;;
547 ASSIGN_STATE(state, entropy->saved)((state) = (entropy->saved));
548
549 /* Outer loop handles each block in the MCU */
550
551 for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
552 JBLOCKROW block = MCU_data[blkn];
553 d_derived_tbl * dctbl = entropy->dc_cur_tbls[blkn];
554 d_derived_tbl * actbl = entropy->ac_cur_tbls[blkn];
555 register int s, k, r;
556
557 /* Decode a single block's worth of coefficients */
558
559 /* Section F.2.2.1: decode the DC coefficient difference */
560 HUFF_DECODE(s, br_state, dctbl, return FALSE, label1){ register int nb, look; if (bits_left < 8) { if (! jFilBitBuf
(&br_state,get_buffer,bits_left, 0)) {return 0;} get_buffer
= br_state.get_buffer; bits_left = br_state.bits_left; if (bits_left
< 8) { nb = 1; goto label1; } } look = (((int) (get_buffer
>> (bits_left - (8)))) & ((1<<(8))-1)); if (
(nb = dctbl->look_nbits[look]) != 0) { (bits_left -= (nb))
; s = dctbl->look_sym[look]; } else { nb = 8 +1; label1: if
((s=jHufDecode(&br_state,get_buffer,bits_left,dctbl,nb))
< 0) { return 0; } get_buffer = br_state.get_buffer; bits_left
= br_state.bits_left; } };
561 if (s) {
562 CHECK_BIT_BUFFER(br_state, s, return FALSE){ if (bits_left < (s)) { if (! jFilBitBuf(&(br_state),
get_buffer,bits_left,s)) { return 0; } get_buffer = (br_state
).get_buffer; bits_left = (br_state).bits_left; } };
563 r = GET_BITS(s)(((int) (get_buffer >> (bits_left -= (s)))) & ((1<<
(s))-1));
564 s = HUFF_EXTEND(r, s)((r) < extend_test[s] ? (r) + extend_offset[s] : (r));
565 }
566
567 if (entropy->dc_needed[blkn]) {
568 /* Convert DC difference to actual value, update last_dc_val */
569 int ci = cinfo->MCU_membership[blkn];
570 s += state.last_dc_val[ci];
571 state.last_dc_val[ci] = s;
572 /* Output the DC coefficient (assumes jpeg_natural_order[0] = 0) */
573 (*block)[0] = (JCOEF) s;
574 }
575
576 if (entropy->ac_needed[blkn]) {
577
578 /* Section F.2.2.2: decode the AC coefficients */
579 /* Since zeroes are skipped, output area must be cleared beforehand */
580 for (k = 1; k < DCTSIZE264; k++) {
581 HUFF_DECODE(s, br_state, actbl, return FALSE, label2){ register int nb, look; if (bits_left < 8) { if (! jFilBitBuf
(&br_state,get_buffer,bits_left, 0)) {return 0;} get_buffer
= br_state.get_buffer; bits_left = br_state.bits_left; if (bits_left
< 8) { nb = 1; goto label2; } } look = (((int) (get_buffer
>> (bits_left - (8)))) & ((1<<(8))-1)); if (
(nb = actbl->look_nbits[look]) != 0) { (bits_left -= (nb))
; s = actbl->look_sym[look]; } else { nb = 8 +1; label2: if
((s=jHufDecode(&br_state,get_buffer,bits_left,actbl,nb))
< 0) { return 0; } get_buffer = br_state.get_buffer; bits_left
= br_state.bits_left; } };
582
583 r = s >> 4;
584 s &= 15;
585
586 if (s) {
587 k += r;
588 CHECK_BIT_BUFFER(br_state, s, return FALSE){ if (bits_left < (s)) { if (! jFilBitBuf(&(br_state),
get_buffer,bits_left,s)) { return 0; } get_buffer = (br_state
).get_buffer; bits_left = (br_state).bits_left; } };
589 r = GET_BITS(s)(((int) (get_buffer >> (bits_left -= (s)))) & ((1<<
(s))-1));
590 s = HUFF_EXTEND(r, s)((r) < extend_test[s] ? (r) + extend_offset[s] : (r));
591 /* Output coefficient in natural (dezigzagged) order.
592 * Note: the extra entries in jpeg_natural_order[] will save us
593 * if k >= DCTSIZE2, which could happen if the data is corrupted.
594 */
595 (*block)[jpeg_natural_orderjZAGTable[k]] = (JCOEF) s;
596 } else {
597 if (r != 15)
598 break;
599 k += 15;
600 }
601 }
602
603 } else {
604
605 /* Section F.2.2.2: decode the AC coefficients */
606 /* In this path we just discard the values */
607 for (k = 1; k < DCTSIZE264; k++) {
608 HUFF_DECODE(s, br_state, actbl, return FALSE, label3){ register int nb, look; if (bits_left < 8) { if (! jFilBitBuf
(&br_state,get_buffer,bits_left, 0)) {return 0;} get_buffer
= br_state.get_buffer; bits_left = br_state.bits_left; if (bits_left
< 8) { nb = 1; goto label3; } } look = (((int) (get_buffer
>> (bits_left - (8)))) & ((1<<(8))-1)); if (
(nb = actbl->look_nbits[look]) != 0) { (bits_left -= (nb))
; s = actbl->look_sym[look]; } else { nb = 8 +1; label3: if
((s=jHufDecode(&br_state,get_buffer,bits_left,actbl,nb))
< 0) { return 0; } get_buffer = br_state.get_buffer; bits_left
= br_state.bits_left; } };
609
610 r = s >> 4;
611 s &= 15;
612
613 if (s) {
614 k += r;
615 CHECK_BIT_BUFFER(br_state, s, return FALSE){ if (bits_left < (s)) { if (! jFilBitBuf(&(br_state),
get_buffer,bits_left,s)) { return 0; } get_buffer = (br_state
).get_buffer; bits_left = (br_state).bits_left; } };
616 DROP_BITS(s)(bits_left -= (s));
617 } else {
618 if (r != 15)
619 break;
620 k += 15;
621 }
622 }
623
624 }
625 }
626
627 /* Completed MCU, so update state */
628 BITREAD_SAVE_STATE(cinfo,entropy->bitstate)cinfo->src->next_input_byte = br_state.next_input_byte;
cinfo->src->bytes_in_buffer = br_state.bytes_in_buffer
; entropy->bitstate.get_buffer = get_buffer; entropy->bitstate
.bits_left = bits_left;
629 ASSIGN_STATE(entropy->saved, state)((entropy->saved) = (state));
630 }
631
632 /* Account for restart interval (no-op if not using restarts) */
633 entropy->restarts_to_go--;
634
635 return TRUE1;
636}
637
638
639/*
640 * Module initialization routine for Huffman entropy decoding.
641 */
642
643GLOBAL(void)void
644jinit_huff_decoderjIHDecoder (j_decompress_ptr cinfo)
645{
646 huff_entropy_ptr entropy;
647 int i;
648
649 entropy = (huff_entropy_ptr)
650 (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE1,
651 SIZEOF(huff_entropy_decoder)((size_t) sizeof(huff_entropy_decoder)));
652 cinfo->entropy = (struct jpeg_entropy_decoder *) entropy;
653 entropy->pub.start_pass = start_pass_huff_decoder;
654 entropy->pub.decode_mcu = decode_mcu;
655
656 /* Mark tables unallocated */
657 for (i = 0; i < NUM_HUFF_TBLS4; i++) {
658 entropy->dc_derived_tbls[i] = entropy->ac_derived_tbls[i] = NULL((void*)0);
659 }
660}