#include "cdjpeg.h"
#ifdef GIF_SUPPORTED
typedef unsigned char U_CHAR;
#define UCH …
#define ReadOK …
#define MAXCOLORMAPSIZE …
#define NUMCOLORS …
#define CM_RED …
#define CM_GREEN …
#define CM_BLUE …
#define MAX_LZW_BITS …
#define LZW_TABLE_SIZE …
#define LM_to_uint …
#define BitSet …
#define INTERLACE …
#define COLORMAPFLAG …
typedef struct {
struct cjpeg_source_struct pub;
j_compress_ptr cinfo;
JSAMPARRAY colormap;
U_CHAR code_buf[256 + 4];
int last_byte;
int last_bit;
int cur_bit;
boolean first_time;
boolean out_of_blocks;
int input_code_size;
int clear_code, end_code;
int code_size;
int limit_code;
int max_code;
int oldcode;
int firstcode;
UINT16 *symbol_head;
UINT8 *symbol_tail;
UINT8 *symbol_stack;
UINT8 *sp;
boolean is_interlaced;
jvirt_sarray_ptr interlaced_image;
JDIMENSION cur_row_number;
JDIMENSION pass2_offset;
JDIMENSION pass3_offset;
JDIMENSION pass4_offset;
} gif_source_struct;
typedef gif_source_struct *gif_source_ptr;
METHODDEF(JDIMENSION) get_pixel_rows(j_compress_ptr cinfo,
cjpeg_source_ptr sinfo);
METHODDEF(JDIMENSION) load_interlaced_image(j_compress_ptr cinfo,
cjpeg_source_ptr sinfo);
METHODDEF(JDIMENSION) get_interlaced_row(j_compress_ptr cinfo,
cjpeg_source_ptr sinfo);
LOCAL(int)
ReadByte(gif_source_ptr sinfo)
{
register FILE *infile = sinfo->pub.input_file;
register int c;
if ((c = getc(infile)) == EOF)
ERREXIT(sinfo->cinfo, JERR_INPUT_EOF);
return c;
}
LOCAL(int)
GetDataBlock(gif_source_ptr sinfo, U_CHAR *buf)
{
int count;
count = ReadByte(sinfo);
if (count > 0) {
if (!ReadOK(sinfo->pub.input_file, buf, count))
ERREXIT(sinfo->cinfo, JERR_INPUT_EOF);
}
return count;
}
LOCAL(void)
SkipDataBlocks(gif_source_ptr sinfo)
{
U_CHAR buf[256];
while (GetDataBlock(sinfo, buf) > 0)
;
}
LOCAL(void)
ReInitLZW(gif_source_ptr sinfo)
{
sinfo->code_size = sinfo->input_code_size + 1;
sinfo->limit_code = sinfo->clear_code << 1;
sinfo->max_code = sinfo->clear_code + 2;
sinfo->sp = sinfo->symbol_stack;
}
LOCAL(void)
InitLZWCode(gif_source_ptr sinfo)
{
sinfo->last_byte = 2;
sinfo->code_buf[0] = 0;
sinfo->code_buf[1] = 0;
sinfo->last_bit = 0;
sinfo->cur_bit = 0;
sinfo->first_time = TRUE;
sinfo->out_of_blocks = FALSE;
sinfo->clear_code = 1 << sinfo->input_code_size;
sinfo->end_code = sinfo->clear_code + 1;
ReInitLZW(sinfo);
}
LOCAL(int)
GetCode(gif_source_ptr sinfo)
{
register int accum;
int offs, count;
while (sinfo->cur_bit + sinfo->code_size > sinfo->last_bit) {
if (sinfo->first_time) {
sinfo->first_time = FALSE;
return sinfo->clear_code;
}
if (sinfo->out_of_blocks) {
WARNMS(sinfo->cinfo, JWRN_GIF_NOMOREDATA);
return sinfo->end_code;
}
sinfo->code_buf[0] = sinfo->code_buf[sinfo->last_byte-2];
sinfo->code_buf[1] = sinfo->code_buf[sinfo->last_byte-1];
if ((count = GetDataBlock(sinfo, &sinfo->code_buf[2])) == 0) {
sinfo->out_of_blocks = TRUE;
WARNMS(sinfo->cinfo, JWRN_GIF_NOMOREDATA);
return sinfo->end_code;
}
sinfo->cur_bit = (sinfo->cur_bit - sinfo->last_bit) + 16;
sinfo->last_byte = 2 + count;
sinfo->last_bit = sinfo->last_byte * 8;
}
offs = sinfo->cur_bit >> 3;
accum = UCH(sinfo->code_buf[offs + 2]);
accum <<= 8;
accum |= UCH(sinfo->code_buf[offs + 1]);
accum <<= 8;
accum |= UCH(sinfo->code_buf[offs]);
accum >>= (sinfo->cur_bit & 7);
sinfo->cur_bit += sinfo->code_size;
return accum & ((1 << sinfo->code_size) - 1);
}
LOCAL(int)
LZWReadByte(gif_source_ptr sinfo)
{
register int code;
int incode;
if (sinfo->sp > sinfo->symbol_stack)
return (int)(*(--sinfo->sp));
code = GetCode(sinfo);
if (code == sinfo->clear_code) {
ReInitLZW(sinfo);
do {
code = GetCode(sinfo);
} while (code == sinfo->clear_code);
if (code > sinfo->clear_code) {
WARNMS(sinfo->cinfo, JWRN_GIF_BADDATA);
code = 0;
}
sinfo->firstcode = sinfo->oldcode = code;
return code;
}
if (code == sinfo->end_code) {
if (!sinfo->out_of_blocks) {
SkipDataBlocks(sinfo);
sinfo->out_of_blocks = TRUE;
}
WARNMS(sinfo->cinfo, JWRN_GIF_ENDCODE);
return 0;
}
incode = code;
if (code >= sinfo->max_code) {
if (code > sinfo->max_code) {
WARNMS(sinfo->cinfo, JWRN_GIF_BADDATA);
incode = 0;
}
*(sinfo->sp++) = (UINT8)sinfo->firstcode;
code = sinfo->oldcode;
}
while (code >= sinfo->clear_code) {
*(sinfo->sp++) = sinfo->symbol_tail[code];
code = sinfo->symbol_head[code];
}
sinfo->firstcode = code;
if ((code = sinfo->max_code) < LZW_TABLE_SIZE) {
sinfo->symbol_head[code] = (UINT16)sinfo->oldcode;
sinfo->symbol_tail[code] = (UINT8)sinfo->firstcode;
sinfo->max_code++;
if (sinfo->max_code >= sinfo->limit_code &&
sinfo->code_size < MAX_LZW_BITS) {
sinfo->code_size++;
sinfo->limit_code <<= 1;
}
}
sinfo->oldcode = incode;
return sinfo->firstcode;
}
LOCAL(void)
ReadColorMap(gif_source_ptr sinfo, int cmaplen, JSAMPARRAY cmap)
{
int i, gray = 1;
for (i = 0; i < cmaplen; i++) {
#if BITS_IN_JSAMPLE == 8
#define UPSCALE …
#else
#define UPSCALE …
#endif
cmap[CM_RED][i] = (JSAMPLE)UPSCALE(ReadByte(sinfo));
cmap[CM_GREEN][i] = (JSAMPLE)UPSCALE(ReadByte(sinfo));
cmap[CM_BLUE][i] = (JSAMPLE)UPSCALE(ReadByte(sinfo));
if (cmap[CM_RED][i] != cmap[CM_GREEN][i] ||
cmap[CM_GREEN][i] != cmap[CM_BLUE][i])
gray = 0;
}
if (sinfo->cinfo->in_color_space == JCS_RGB && gray) {
sinfo->cinfo->in_color_space = JCS_GRAYSCALE;
sinfo->cinfo->input_components = 1;
}
}
LOCAL(void)
DoExtension(gif_source_ptr sinfo)
{
int extlabel;
extlabel = ReadByte(sinfo);
TRACEMS1(sinfo->cinfo, 1, JTRC_GIF_EXTENSION, extlabel);
SkipDataBlocks(sinfo);
}
METHODDEF(void)
start_input_gif(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
{
gif_source_ptr source = (gif_source_ptr)sinfo;
U_CHAR hdrbuf[10];
unsigned int width, height;
int colormaplen, aspectRatio;
int c;
if (!ReadOK(source->pub.input_file, hdrbuf, 6))
ERREXIT(cinfo, JERR_GIF_NOT);
if (hdrbuf[0] != 'G' || hdrbuf[1] != 'I' || hdrbuf[2] != 'F')
ERREXIT(cinfo, JERR_GIF_NOT);
if ((hdrbuf[3] != '8' || hdrbuf[4] != '7' || hdrbuf[5] != 'a') &&
(hdrbuf[3] != '8' || hdrbuf[4] != '9' || hdrbuf[5] != 'a'))
TRACEMS3(cinfo, 1, JTRC_GIF_BADVERSION, hdrbuf[3], hdrbuf[4], hdrbuf[5]);
if (!ReadOK(source->pub.input_file, hdrbuf, 7))
ERREXIT(cinfo, JERR_INPUT_EOF);
width = LM_to_uint(hdrbuf, 0);
height = LM_to_uint(hdrbuf, 2);
if (width == 0 || height == 0)
ERREXIT(cinfo, JERR_GIF_EMPTY);
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
if (sinfo->max_pixels &&
(unsigned long long)width * height > sinfo->max_pixels)
ERREXIT(cinfo, JERR_WIDTH_OVERFLOW);
#endif
aspectRatio = UCH(hdrbuf[6]);
if (aspectRatio != 0 && aspectRatio != 49)
TRACEMS(cinfo, 1, JTRC_GIF_NONSQUARE);
source->colormap = (*cinfo->mem->alloc_sarray)
((j_common_ptr)cinfo, JPOOL_IMAGE, (JDIMENSION)MAXCOLORMAPSIZE,
(JDIMENSION)NUMCOLORS);
colormaplen = 0;
if (BitSet(hdrbuf[4], COLORMAPFLAG)) {
colormaplen = 2 << (hdrbuf[4] & 0x07);
ReadColorMap(source, colormaplen, source->colormap);
}
for (;;) {
c = ReadByte(source);
if (c == ';')
ERREXIT(cinfo, JERR_GIF_IMAGENOTFOUND);
if (c == '!') {
DoExtension(source);
continue;
}
if (c != ',') {
WARNMS1(cinfo, JWRN_GIF_CHAR, c);
continue;
}
if (!ReadOK(source->pub.input_file, hdrbuf, 9))
ERREXIT(cinfo, JERR_INPUT_EOF);
width = LM_to_uint(hdrbuf, 4);
height = LM_to_uint(hdrbuf, 6);
if (width == 0 || height == 0)
ERREXIT(cinfo, JERR_GIF_EMPTY);
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
if (sinfo->max_pixels &&
(unsigned long long)width * height > sinfo->max_pixels)
ERREXIT(cinfo, JERR_WIDTH_OVERFLOW);
#endif
source->is_interlaced = (BitSet(hdrbuf[8], INTERLACE) != 0);
if (BitSet(hdrbuf[8], COLORMAPFLAG)) {
colormaplen = 2 << (hdrbuf[8] & 0x07);
ReadColorMap(source, colormaplen, source->colormap);
}
source->input_code_size = ReadByte(source);
if (source->input_code_size < 2 || source->input_code_size > 8)
ERREXIT1(cinfo, JERR_GIF_CODESIZE, source->input_code_size);
break;
}
source->symbol_head = (UINT16 *)
(*cinfo->mem->alloc_large) ((j_common_ptr)cinfo, JPOOL_IMAGE,
LZW_TABLE_SIZE * sizeof(UINT16));
source->symbol_tail = (UINT8 *)
(*cinfo->mem->alloc_large) ((j_common_ptr)cinfo, JPOOL_IMAGE,
LZW_TABLE_SIZE * sizeof(UINT8));
source->symbol_stack = (UINT8 *)
(*cinfo->mem->alloc_large) ((j_common_ptr)cinfo, JPOOL_IMAGE,
LZW_TABLE_SIZE * sizeof(UINT8));
InitLZWCode(source);
if (source->is_interlaced) {
source->interlaced_image = (*cinfo->mem->request_virt_sarray)
((j_common_ptr)cinfo, JPOOL_IMAGE, FALSE,
(JDIMENSION)width, (JDIMENSION)height, (JDIMENSION)1);
if (cinfo->progress != NULL) {
cd_progress_ptr progress = (cd_progress_ptr)cinfo->progress;
progress->total_extra_passes++;
}
source->pub.get_pixel_rows = load_interlaced_image;
} else {
source->pub.get_pixel_rows = get_pixel_rows;
}
if (cinfo->in_color_space != JCS_GRAYSCALE) {
cinfo->in_color_space = JCS_RGB;
cinfo->input_components = NUMCOLORS;
}
source->pub.buffer = (*cinfo->mem->alloc_sarray)
((j_common_ptr)cinfo, JPOOL_IMAGE,
(JDIMENSION)width * cinfo->input_components, (JDIMENSION)1);
source->pub.buffer_height = 1;
for (c = colormaplen; c < source->clear_code; c++) {
source->colormap[CM_RED][c] =
source->colormap[CM_GREEN][c] =
source->colormap[CM_BLUE][c] = CENTERJSAMPLE;
}
cinfo->data_precision = BITS_IN_JSAMPLE;
cinfo->image_width = width;
cinfo->image_height = height;
TRACEMS3(cinfo, 1, JTRC_GIF, width, height, colormaplen);
}
METHODDEF(JDIMENSION)
get_pixel_rows(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
{
gif_source_ptr source = (gif_source_ptr)sinfo;
register int c;
register JSAMPROW ptr;
register JDIMENSION col;
register JSAMPARRAY colormap = source->colormap;
ptr = source->pub.buffer[0];
if (cinfo->in_color_space == JCS_GRAYSCALE) {
for (col = cinfo->image_width; col > 0; col--) {
c = LZWReadByte(source);
*ptr++ = colormap[CM_RED][c];
}
} else {
for (col = cinfo->image_width; col > 0; col--) {
c = LZWReadByte(source);
*ptr++ = colormap[CM_RED][c];
*ptr++ = colormap[CM_GREEN][c];
*ptr++ = colormap[CM_BLUE][c];
}
}
return 1;
}
METHODDEF(JDIMENSION)
load_interlaced_image(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
{
gif_source_ptr source = (gif_source_ptr)sinfo;
register JSAMPROW sptr;
register JDIMENSION col;
JDIMENSION row;
cd_progress_ptr progress = (cd_progress_ptr)cinfo->progress;
for (row = 0; row < cinfo->image_height; row++) {
if (progress != NULL) {
progress->pub.pass_counter = (long)row;
progress->pub.pass_limit = (long)cinfo->image_height;
(*progress->pub.progress_monitor) ((j_common_ptr)cinfo);
}
sptr = *(*cinfo->mem->access_virt_sarray)
((j_common_ptr)cinfo, source->interlaced_image, row, (JDIMENSION)1,
TRUE);
for (col = cinfo->image_width; col > 0; col--) {
*sptr++ = (JSAMPLE)LZWReadByte(source);
}
}
if (progress != NULL)
progress->completed_extra_passes++;
source->pub.get_pixel_rows = get_interlaced_row;
source->cur_row_number = 0;
source->pass2_offset = (cinfo->image_height + 7) / 8;
source->pass3_offset = source->pass2_offset + (cinfo->image_height + 3) / 8;
source->pass4_offset = source->pass3_offset + (cinfo->image_height + 1) / 4;
return get_interlaced_row(cinfo, sinfo);
}
METHODDEF(JDIMENSION)
get_interlaced_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
{
gif_source_ptr source = (gif_source_ptr)sinfo;
register int c;
register JSAMPROW sptr, ptr;
register JDIMENSION col;
register JSAMPARRAY colormap = source->colormap;
JDIMENSION irow;
switch ((int)(source->cur_row_number & 7)) {
case 0:
irow = source->cur_row_number >> 3;
break;
case 4:
irow = (source->cur_row_number >> 3) + source->pass2_offset;
break;
case 2:
case 6:
irow = (source->cur_row_number >> 2) + source->pass3_offset;
break;
default:
irow = (source->cur_row_number >> 1) + source->pass4_offset;
}
sptr = *(*cinfo->mem->access_virt_sarray)
((j_common_ptr)cinfo, source->interlaced_image, irow, (JDIMENSION)1,
FALSE);
ptr = source->pub.buffer[0];
if (cinfo->in_color_space == JCS_GRAYSCALE) {
for (col = cinfo->image_width; col > 0; col--) {
c = *sptr++;
*ptr++ = colormap[CM_RED][c];
}
} else {
for (col = cinfo->image_width; col > 0; col--) {
c = *sptr++;
*ptr++ = colormap[CM_RED][c];
*ptr++ = colormap[CM_GREEN][c];
*ptr++ = colormap[CM_BLUE][c];
}
}
source->cur_row_number++;
return 1;
}
METHODDEF(void)
finish_input_gif(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
{
}
GLOBAL(cjpeg_source_ptr)
jinit_read_gif(j_compress_ptr cinfo)
{
gif_source_ptr source;
source = (gif_source_ptr)
(*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
sizeof(gif_source_struct));
source->cinfo = cinfo;
source->pub.start_input = start_input_gif;
source->pub.finish_input = finish_input_gif;
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
source->pub.max_pixels = 0;
#endif
return (cjpeg_source_ptr)source;
}
#endif