1 /*
2  * jdhuff.c
3  *
4  * Copyright (C) 1991-1997, Thomas G. Lane.
5  * Modified 2006-2013 by Guido Vollbeding.
6  * This file is part of the Independent JPEG Group's software.
7  * For conditions of distribution and use, see the accompanying README file.
8  *
9  * This file contains Huffman entropy decoding routines.
10  * Both sequential and progressive modes are supported in this single module.
11  *
12  * Much of the complexity here has to do with supporting input suspension.
13  * If the data source module demands suspension, we want to be able to back
14  * up to the start of the current MCU.  To do this, we copy state variables
15  * into local working storage, and update them back to the permanent
16  * storage only upon successful completion of an MCU.
17  */
18 
19 #define JPEG_INTERNALS
20 #include "jinclude.h"
21 #include "jpeglib.h"
22 
23 
24 /* Derived data constructed for each Huffman table */
25 
26 #define HUFF_LOOKAHEAD	8	/* # of bits of lookahead */
27 
28 typedef struct {
29   /* Basic tables: (element [0] of each array is unused) */
30   INT32 maxcode[18];		/* largest code of length k (-1 if none) */
31   /* (maxcode[17] is a sentinel to ensure jpeg_huff_decode terminates) */
32   INT32 valoffset[17];		/* huffval[] offset for codes of length k */
33   /* valoffset[k] = huffval[] index of 1st symbol of code length k, less
34    * the smallest code of length k; so given a code of length k, the
35    * corresponding symbol is huffval[code + valoffset[k]]
36    */
37 
38   /* Link to public Huffman table (needed only in jpeg_huff_decode) */
39   JHUFF_TBL *pub;
40 
41   /* Lookahead tables: indexed by the next HUFF_LOOKAHEAD bits of
42    * the input data stream.  If the next Huffman code is no more
43    * than HUFF_LOOKAHEAD bits long, we can obtain its length and
44    * the corresponding symbol directly from these tables.
45    */
46   int look_nbits[1<<HUFF_LOOKAHEAD]; /* # bits, or 0 if too long */
47   UINT8 look_sym[1<<HUFF_LOOKAHEAD]; /* symbol, or unused */
48 } d_derived_tbl;
49 
50 
51 /*
52  * Fetching the next N bits from the input stream is a time-critical operation
53  * for the Huffman decoders.  We implement it with a combination of inline
54  * macros and out-of-line subroutines.  Note that N (the number of bits
55  * demanded at one time) never exceeds 15 for JPEG use.
56  *
57  * We read source bytes into get_buffer and dole out bits as needed.
58  * If get_buffer already contains enough bits, they are fetched in-line
59  * by the macros CHECK_BIT_BUFFER and GET_BITS.  When there aren't enough
60  * bits, jpeg_fill_bit_buffer is called; it will attempt to fill get_buffer
61  * as full as possible (not just to the number of bits needed; this
62  * prefetching reduces the overhead cost of calling jpeg_fill_bit_buffer).
63  * Note that jpeg_fill_bit_buffer may return FALSE to indicate suspension.
64  * On TRUE return, jpeg_fill_bit_buffer guarantees that get_buffer contains
65  * at least the requested number of bits --- dummy zeroes are inserted if
66  * necessary.
67  */
68 
69 typedef INT32 bit_buf_type;	/* type of bit-extraction buffer */
70 #define BIT_BUF_SIZE  32	/* size of buffer in bits */
71 
72 /* If long is > 32 bits on your machine, and shifting/masking longs is
73  * reasonably fast, making bit_buf_type be long and setting BIT_BUF_SIZE
74  * appropriately should be a win.  Unfortunately we can't define the size
75  * with something like  #define BIT_BUF_SIZE (sizeof(bit_buf_type)*8)
76  * because not all machines measure sizeof in 8-bit bytes.
77  */
78 
79 typedef struct {		/* Bitreading state saved across MCUs */
80   bit_buf_type get_buffer;	/* current bit-extraction buffer */
81   int bits_left;		/* # of unused bits in it */
82 } bitread_perm_state;
83 
84 typedef struct {		/* Bitreading working state within an MCU */
85   /* Current data source location */
86   /* We need a copy, rather than munging the original, in case of suspension */
87   const JOCTET * next_input_byte; /* => next byte to read from source */
88   size_t bytes_in_buffer;	/* # of bytes remaining in source buffer */
89   /* Bit input buffer --- note these values are kept in register variables,
90    * not in this struct, inside the inner loops.
91    */
92   bit_buf_type get_buffer;	/* current bit-extraction buffer */
93   int bits_left;		/* # of unused bits in it */
94   /* Pointer needed by jpeg_fill_bit_buffer. */
95   j_decompress_ptr cinfo;	/* back link to decompress master record */
96 } bitread_working_state;
97 
98 /* Macros to declare and load/save bitread local variables. */
99 #define BITREAD_STATE_VARS  \
100 	register bit_buf_type get_buffer;  \
101 	register int bits_left;  \
102 	bitread_working_state br_state
103 
104 #define BITREAD_LOAD_STATE(cinfop,permstate)  \
105 	br_state.cinfo = cinfop; \
106 	br_state.next_input_byte = cinfop->src->next_input_byte; \
107 	br_state.bytes_in_buffer = cinfop->src->bytes_in_buffer; \
108 	get_buffer = permstate.get_buffer; \
109 	bits_left = permstate.bits_left;
110 
111 #define BITREAD_SAVE_STATE(cinfop,permstate)  \
112 	cinfop->src->next_input_byte = br_state.next_input_byte; \
113 	cinfop->src->bytes_in_buffer = br_state.bytes_in_buffer; \
114 	permstate.get_buffer = get_buffer; \
115 	permstate.bits_left = bits_left
116 
117 /*
118  * These macros provide the in-line portion of bit fetching.
119  * Use CHECK_BIT_BUFFER to ensure there are N bits in get_buffer
120  * before using GET_BITS, PEEK_BITS, or DROP_BITS.
121  * The variables get_buffer and bits_left are assumed to be locals,
122  * but the state struct might not be (jpeg_huff_decode needs this).
123  *	CHECK_BIT_BUFFER(state,n,action);
124  *		Ensure there are N bits in get_buffer; if suspend, take action.
125  *      val = GET_BITS(n);
126  *		Fetch next N bits.
127  *      val = PEEK_BITS(n);
128  *		Fetch next N bits without removing them from the buffer.
129  *	DROP_BITS(n);
130  *		Discard next N bits.
131  * The value N should be a simple variable, not an expression, because it
132  * is evaluated multiple times.
133  */
134 
135 #define CHECK_BIT_BUFFER(state,nbits,action) \
136 	{ if (bits_left < (nbits)) {  \
137 	    if (! jpeg_fill_bit_buffer(&(state),get_buffer,bits_left,nbits))  \
138 	      { action; }  \
139 	    get_buffer = (state).get_buffer; bits_left = (state).bits_left; } }
140 
141 #define GET_BITS(nbits) \
142 	(((int) (get_buffer >> (bits_left -= (nbits)))) & BIT_MASK(nbits))
143 
144 #define PEEK_BITS(nbits) \
145 	(((int) (get_buffer >> (bits_left -  (nbits)))) & BIT_MASK(nbits))
146 
147 #define DROP_BITS(nbits) \
148 	(bits_left -= (nbits))
149 
150 
151 /*
152  * Code for extracting next Huffman-coded symbol from input bit stream.
153  * Again, this is time-critical and we make the main paths be macros.
154  *
155  * We use a lookahead table to process codes of up to HUFF_LOOKAHEAD bits
156  * without looping.  Usually, more than 95% of the Huffman codes will be 8
157  * or fewer bits long.  The few overlength codes are handled with a loop,
158  * which need not be inline code.
159  *
160  * Notes about the HUFF_DECODE macro:
161  * 1. Near the end of the data segment, we may fail to get enough bits
162  *    for a lookahead.  In that case, we do it the hard way.
163  * 2. If the lookahead table contains no entry, the next code must be
164  *    more than HUFF_LOOKAHEAD bits long.
165  * 3. jpeg_huff_decode returns -1 if forced to suspend.
166  */
167 
168 #define HUFF_DECODE(result,state,htbl,failaction,slowlabel) \
169 { register int nb, look; \
170   if (bits_left < HUFF_LOOKAHEAD) { \
171     if (! jpeg_fill_bit_buffer(&state,get_buffer,bits_left, 0)) {failaction;} \
172     get_buffer = state.get_buffer; bits_left = state.bits_left; \
173     if (bits_left < HUFF_LOOKAHEAD) { \
174       nb = 1; goto slowlabel; \
175     } \
176   } \
177   look = PEEK_BITS(HUFF_LOOKAHEAD); \
178   if ((nb = htbl->look_nbits[look]) != 0) { \
179     DROP_BITS(nb); \
180     result = htbl->look_sym[look]; \
181   } else { \
182     nb = HUFF_LOOKAHEAD+1; \
183 slowlabel: \
184     if ((result=jpeg_huff_decode(&state,get_buffer,bits_left,htbl,nb)) < 0) \
185 	{ failaction; } \
186     get_buffer = state.get_buffer; bits_left = state.bits_left; \
187   } \
188 }
189 
190 
191 /*
192  * Expanded entropy decoder object for Huffman decoding.
193  *
194  * The savable_state subrecord contains fields that change within an MCU,
195  * but must not be updated permanently until we complete the MCU.
196  */
197 
198 typedef struct {
199   unsigned int EOBRUN;			/* remaining EOBs in EOBRUN */
200   int last_dc_val[MAX_COMPS_IN_SCAN];	/* last DC coef for each component */
201 } savable_state;
202 
203 /* This macro is to work around compilers with missing or broken
204  * structure assignment.  You'll need to fix this code if you have
205  * such a compiler and you change MAX_COMPS_IN_SCAN.
206  */
207 
208 #ifndef NO_STRUCT_ASSIGN
209 #define ASSIGN_STATE(dest,src)  ((dest) = (src))
210 #else
211 #if MAX_COMPS_IN_SCAN == 4
212 #define ASSIGN_STATE(dest,src)  \
213 	((dest).EOBRUN = (src).EOBRUN, \
214 	 (dest).last_dc_val[0] = (src).last_dc_val[0], \
215 	 (dest).last_dc_val[1] = (src).last_dc_val[1], \
216 	 (dest).last_dc_val[2] = (src).last_dc_val[2], \
217 	 (dest).last_dc_val[3] = (src).last_dc_val[3])
218 #endif
219 #endif
220 
221 
222 typedef struct {
223   struct jpeg_entropy_decoder pub; /* public fields */
224 
225   /* These fields are loaded into local variables at start of each MCU.
226    * In case of suspension, we exit WITHOUT updating them.
227    */
228   bitread_perm_state bitstate;	/* Bit buffer at start of MCU */
229   savable_state saved;		/* Other state at start of MCU */
230 
231   /* These fields are NOT loaded into local working state. */
232   boolean insufficient_data;	/* set TRUE after emitting warning */
233   unsigned int restarts_to_go;	/* MCUs left in this restart interval */
234 
235   /* Following two fields used only in progressive mode */
236 
237   /* Pointers to derived tables (these workspaces have image lifespan) */
238   d_derived_tbl * derived_tbls[NUM_HUFF_TBLS];
239 
240   d_derived_tbl * ac_derived_tbl; /* active table during an AC scan */
241 
242   /* Following fields used only in sequential mode */
243 
244   /* Pointers to derived tables (these workspaces have image lifespan) */
245   d_derived_tbl * dc_derived_tbls[NUM_HUFF_TBLS];
246   d_derived_tbl * ac_derived_tbls[NUM_HUFF_TBLS];
247 
248   /* Precalculated info set up by start_pass for use in decode_mcu: */
249 
250   /* Pointers to derived tables to be used for each block within an MCU */
251   d_derived_tbl * dc_cur_tbls[D_MAX_BLOCKS_IN_MCU];
252   d_derived_tbl * ac_cur_tbls[D_MAX_BLOCKS_IN_MCU];
253   /* Whether we care about the DC and AC coefficient values for each block */
254   int coef_limit[D_MAX_BLOCKS_IN_MCU];
255 } huff_entropy_decoder;
256 
257 typedef huff_entropy_decoder * huff_entropy_ptr;
258 
259 
260 static const int jpeg_zigzag_order[8][8] = {
261   {  0,  1,  5,  6, 14, 15, 27, 28 },
262   {  2,  4,  7, 13, 16, 26, 29, 42 },
263   {  3,  8, 12, 17, 25, 30, 41, 43 },
264   {  9, 11, 18, 24, 31, 40, 44, 53 },
265   { 10, 19, 23, 32, 39, 45, 52, 54 },
266   { 20, 22, 33, 38, 46, 51, 55, 60 },
267   { 21, 34, 37, 47, 50, 56, 59, 61 },
268   { 35, 36, 48, 49, 57, 58, 62, 63 }
269 };
270 
271 static const int jpeg_zigzag_order7[7][7] = {
272   {  0,  1,  5,  6, 14, 15, 27 },
273   {  2,  4,  7, 13, 16, 26, 28 },
274   {  3,  8, 12, 17, 25, 29, 38 },
275   {  9, 11, 18, 24, 30, 37, 39 },
276   { 10, 19, 23, 31, 36, 40, 45 },
277   { 20, 22, 32, 35, 41, 44, 46 },
278   { 21, 33, 34, 42, 43, 47, 48 }
279 };
280 
281 static const int jpeg_zigzag_order6[6][6] = {
282   {  0,  1,  5,  6, 14, 15 },
283   {  2,  4,  7, 13, 16, 25 },
284   {  3,  8, 12, 17, 24, 26 },
285   {  9, 11, 18, 23, 27, 32 },
286   { 10, 19, 22, 28, 31, 33 },
287   { 20, 21, 29, 30, 34, 35 }
288 };
289 
290 static const int jpeg_zigzag_order5[5][5] = {
291   {  0,  1,  5,  6, 14 },
292   {  2,  4,  7, 13, 15 },
293   {  3,  8, 12, 16, 21 },
294   {  9, 11, 17, 20, 22 },
295   { 10, 18, 19, 23, 24 }
296 };
297 
298 static const int jpeg_zigzag_order4[4][4] = {
299   { 0,  1,  5,  6 },
300   { 2,  4,  7, 12 },
301   { 3,  8, 11, 13 },
302   { 9, 10, 14, 15 }
303 };
304 
305 static const int jpeg_zigzag_order3[3][3] = {
306   { 0, 1, 5 },
307   { 2, 4, 6 },
308   { 3, 7, 8 }
309 };
310 
311 static const int jpeg_zigzag_order2[2][2] = {
312   { 0, 1 },
313   { 2, 3 }
314 };
315 
316 
317 /*
318  * Compute the derived values for a Huffman table.
319  * This routine also performs some validation checks on the table.
320  */
321 
322 LOCAL(void)
jpeg_make_d_derived_tbl(j_decompress_ptr cinfo,boolean isDC,int tblno,d_derived_tbl ** pdtbl)323 jpeg_make_d_derived_tbl (j_decompress_ptr cinfo, boolean isDC, int tblno,
324 			 d_derived_tbl ** pdtbl)
325 {
326   JHUFF_TBL *htbl;
327   d_derived_tbl *dtbl;
328   int p, i, l, si, numsymbols;
329   int lookbits, ctr;
330   char huffsize[257];
331   unsigned int huffcode[257];
332   unsigned int code;
333 
334   /* Note that huffsize[] and huffcode[] are filled in code-length order,
335    * paralleling the order of the symbols themselves in htbl->huffval[].
336    */
337 
338   /* Find the input Huffman table */
339   if (tblno < 0 || tblno >= NUM_HUFF_TBLS)
340     ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno);
341   htbl =
342     isDC ? cinfo->dc_huff_tbl_ptrs[tblno] : cinfo->ac_huff_tbl_ptrs[tblno];
343   if (htbl == NULL)
344     ERREXIT1(cinfo, JERR_NO_HUFF_TABLE, tblno);
345 
346   /* Allocate a workspace if we haven't already done so. */
347   if (*pdtbl == NULL)
348     *pdtbl = (d_derived_tbl *)
349       (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE,
350 				  SIZEOF(d_derived_tbl));
351   dtbl = *pdtbl;
352   dtbl->pub = htbl;		/* fill in back link */
353 
354   /* Figure C.1: make table of Huffman code length for each symbol */
355 
356   p = 0;
357   for (l = 1; l <= 16; l++) {
358     i = (int) htbl->bits[l];
359     if (i < 0 || p + i > 256)	/* protect against table overrun */
360       ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
361     while (i--)
362       huffsize[p++] = (char) l;
363   }
364   huffsize[p] = 0;
365   numsymbols = p;
366 
367   /* Figure C.2: generate the codes themselves */
368   /* We also validate that the counts represent a legal Huffman code tree. */
369 
370   code = 0;
371   si = huffsize[0];
372   p = 0;
373   while (huffsize[p]) {
374     while (((int) huffsize[p]) == si) {
375       huffcode[p++] = code;
376       code++;
377     }
378     /* code is now 1 more than the last code used for codelength si; but
379      * it must still fit in si bits, since no code is allowed to be all ones.
380      */
381     if (((INT32) code) >= (((INT32) 1) << si))
382       ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
383     code <<= 1;
384     si++;
385   }
386 
387   /* Figure F.15: generate decoding tables for bit-sequential decoding */
388 
389   p = 0;
390   for (l = 1; l <= 16; l++) {
391     if (htbl->bits[l]) {
392       /* valoffset[l] = huffval[] index of 1st symbol of code length l,
393        * minus the minimum code of length l
394        */
395       dtbl->valoffset[l] = (INT32) p - (INT32) huffcode[p];
396       p += htbl->bits[l];
397       dtbl->maxcode[l] = huffcode[p-1]; /* maximum code of length l */
398     } else {
399       dtbl->maxcode[l] = -1;	/* -1 if no codes of this length */
400     }
401   }
402   dtbl->maxcode[17] = 0xFFFFFL; /* ensures jpeg_huff_decode terminates */
403 
404   /* Compute lookahead tables to speed up decoding.
405    * First we set all the table entries to 0, indicating "too long";
406    * then we iterate through the Huffman codes that are short enough and
407    * fill in all the entries that correspond to bit sequences starting
408    * with that code.
409    */
410 
411   MEMZERO(dtbl->look_nbits, SIZEOF(dtbl->look_nbits));
412 
413   p = 0;
414   for (l = 1; l <= HUFF_LOOKAHEAD; l++) {
415     for (i = 1; i <= (int) htbl->bits[l]; i++, p++) {
416       /* l = current code's length, p = its index in huffcode[] & huffval[]. */
417       /* Generate left-justified code followed by all possible bit sequences */
418       lookbits = huffcode[p] << (HUFF_LOOKAHEAD-l);
419       for (ctr = 1 << (HUFF_LOOKAHEAD-l); ctr > 0; ctr--) {
420 	dtbl->look_nbits[lookbits] = l;
421 	dtbl->look_sym[lookbits] = htbl->huffval[p];
422 	lookbits++;
423       }
424     }
425   }
426 
427   /* Validate symbols as being reasonable.
428    * For AC tables, we make no check, but accept all byte values 0..255.
429    * For DC tables, we require the symbols to be in range 0..15.
430    * (Tighter bounds could be applied depending on the data depth and mode,
431    * but this is sufficient to ensure safe decoding.)
432    */
433   if (isDC) {
434     for (i = 0; i < numsymbols; i++) {
435       int sym = htbl->huffval[i];
436       if (sym < 0 || sym > 15)
437 	ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
438     }
439   }
440 }
441 
442 
443 /*
444  * Out-of-line code for bit fetching.
445  * Note: current values of get_buffer and bits_left are passed as parameters,
446  * but are returned in the corresponding fields of the state struct.
447  *
448  * On most machines MIN_GET_BITS should be 25 to allow the full 32-bit width
449  * of get_buffer to be used.  (On machines with wider words, an even larger
450  * buffer could be used.)  However, on some machines 32-bit shifts are
451  * quite slow and take time proportional to the number of places shifted.
452  * (This is true with most PC compilers, for instance.)  In this case it may
453  * be a win to set MIN_GET_BITS to the minimum value of 15.  This reduces the
454  * average shift distance at the cost of more calls to jpeg_fill_bit_buffer.
455  */
456 
457 #ifdef SLOW_SHIFT_32
458 #define MIN_GET_BITS  15	/* minimum allowable value */
459 #else
460 #define MIN_GET_BITS  (BIT_BUF_SIZE-7)
461 #endif
462 
463 
464 LOCAL(boolean)
jpeg_fill_bit_buffer(bitread_working_state * state,register bit_buf_type get_buffer,register int bits_left,int nbits)465 jpeg_fill_bit_buffer (bitread_working_state * state,
466 		      register bit_buf_type get_buffer, register int bits_left,
467 		      int nbits)
468 /* Load up the bit buffer to a depth of at least nbits */
469 {
470   /* Copy heavily used state fields into locals (hopefully registers) */
471   register const JOCTET * next_input_byte = state->next_input_byte;
472   register size_t bytes_in_buffer = state->bytes_in_buffer;
473   j_decompress_ptr cinfo = state->cinfo;
474 
475   /* Attempt to load at least MIN_GET_BITS bits into get_buffer. */
476   /* (It is assumed that no request will be for more than that many bits.) */
477   /* We fail to do so only if we hit a marker or are forced to suspend. */
478 
479   if (cinfo->unread_marker == 0) {	/* cannot advance past a marker */
480     while (bits_left < MIN_GET_BITS) {
481       register int c;
482 
483       /* Attempt to read a byte */
484       if (bytes_in_buffer == 0) {
485 	if (! (*cinfo->src->fill_input_buffer) (cinfo))
486 	  return FALSE;
487 	next_input_byte = cinfo->src->next_input_byte;
488 	bytes_in_buffer = cinfo->src->bytes_in_buffer;
489       }
490       bytes_in_buffer--;
491       c = GETJOCTET(*next_input_byte++);
492 
493       /* If it's 0xFF, check and discard stuffed zero byte */
494       if (c == 0xFF) {
495 	/* Loop here to discard any padding FF's on terminating marker,
496 	 * so that we can save a valid unread_marker value.  NOTE: we will
497 	 * accept multiple FF's followed by a 0 as meaning a single FF data
498 	 * byte.  This data pattern is not valid according to the standard.
499 	 */
500 	do {
501 	  if (bytes_in_buffer == 0) {
502 	    if (! (*cinfo->src->fill_input_buffer) (cinfo))
503 	      return FALSE;
504 	    next_input_byte = cinfo->src->next_input_byte;
505 	    bytes_in_buffer = cinfo->src->bytes_in_buffer;
506 	  }
507 	  bytes_in_buffer--;
508 	  c = GETJOCTET(*next_input_byte++);
509 	} while (c == 0xFF);
510 
511 	if (c == 0) {
512 	  /* Found FF/00, which represents an FF data byte */
513 	  c = 0xFF;
514 	} else {
515 	  /* Oops, it's actually a marker indicating end of compressed data.
516 	   * Save the marker code for later use.
517 	   * Fine point: it might appear that we should save the marker into
518 	   * bitread working state, not straight into permanent state.  But
519 	   * once we have hit a marker, we cannot need to suspend within the
520 	   * current MCU, because we will read no more bytes from the data
521 	   * source.  So it is OK to update permanent state right away.
522 	   */
523 	  cinfo->unread_marker = c;
524 	  /* See if we need to insert some fake zero bits. */
525 	  goto no_more_bytes;
526 	}
527       }
528 
529       /* OK, load c into get_buffer */
530       get_buffer = (get_buffer << 8) | c;
531       bits_left += 8;
532     } /* end while */
533   } else {
534   no_more_bytes:
535     /* We get here if we've read the marker that terminates the compressed
536      * data segment.  There should be enough bits in the buffer register
537      * to satisfy the request; if so, no problem.
538      */
539     if (nbits > bits_left) {
540       /* Uh-oh.  Report corrupted data to user and stuff zeroes into
541        * the data stream, so that we can produce some kind of image.
542        * We use a nonvolatile flag to ensure that only one warning message
543        * appears per data segment.
544        */
545       if (! ((huff_entropy_ptr) cinfo->entropy)->insufficient_data) {
546 	WARNMS(cinfo, JWRN_HIT_MARKER);
547 	((huff_entropy_ptr) cinfo->entropy)->insufficient_data = TRUE;
548       }
549       /* Fill the buffer with zero bits */
550       get_buffer <<= MIN_GET_BITS - bits_left;
551       bits_left = MIN_GET_BITS;
552     }
553   }
554 
555   /* Unload the local registers */
556   state->next_input_byte = next_input_byte;
557   state->bytes_in_buffer = bytes_in_buffer;
558   state->get_buffer = get_buffer;
559   state->bits_left = bits_left;
560 
561   return TRUE;
562 }
563 
564 
565 /*
566  * Figure F.12: extend sign bit.
567  * On some machines, a shift and sub will be faster than a table lookup.
568  */
569 
570 #ifdef AVOID_TABLES
571 
572 #define BIT_MASK(nbits)   ((1<<(nbits))-1)
573 #define HUFF_EXTEND(x,s)  ((x) < (1<<((s)-1)) ? (x) - ((1<<(s))-1) : (x))
574 
575 #else
576 
577 #define BIT_MASK(nbits)   bmask[nbits]
578 #define HUFF_EXTEND(x,s)  ((x) <= bmask[(s) - 1] ? (x) - bmask[s] : (x))
579 
580 static const int bmask[16] =	/* bmask[n] is mask for n rightmost bits */
581   { 0, 0x0001, 0x0003, 0x0007, 0x000F, 0x001F, 0x003F, 0x007F, 0x00FF,
582     0x01FF, 0x03FF, 0x07FF, 0x0FFF, 0x1FFF, 0x3FFF, 0x7FFF };
583 
584 #endif /* AVOID_TABLES */
585 
586 
587 /*
588  * Out-of-line code for Huffman code decoding.
589  */
590 
591 LOCAL(int)
jpeg_huff_decode(bitread_working_state * state,register bit_buf_type get_buffer,register int bits_left,d_derived_tbl * htbl,int min_bits)592 jpeg_huff_decode (bitread_working_state * state,
593 		  register bit_buf_type get_buffer, register int bits_left,
594 		  d_derived_tbl * htbl, int min_bits)
595 {
596   register int l = min_bits;
597   register INT32 code;
598 
599   /* HUFF_DECODE has determined that the code is at least min_bits */
600   /* bits long, so fetch that many bits in one swoop. */
601 
602   CHECK_BIT_BUFFER(*state, l, return -1);
603   code = GET_BITS(l);
604 
605   /* Collect the rest of the Huffman code one bit at a time. */
606   /* This is per Figure F.16 in the JPEG spec. */
607 
608   while (code > htbl->maxcode[l]) {
609     code <<= 1;
610     CHECK_BIT_BUFFER(*state, 1, return -1);
611     code |= GET_BITS(1);
612     l++;
613   }
614 
615   /* Unload the local registers */
616   state->get_buffer = get_buffer;
617   state->bits_left = bits_left;
618 
619   /* With garbage input we may reach the sentinel value l = 17. */
620 
621   if (l > 16) {
622     WARNMS(state->cinfo, JWRN_HUFF_BAD_CODE);
623     return 0;			/* fake a zero as the safest result */
624   }
625 
626   return htbl->pub->huffval[ (int) (code + htbl->valoffset[l]) ];
627 }
628 
629 
630 /*
631  * Finish up at the end of a Huffman-compressed scan.
632  */
633 
634 METHODDEF(void)
finish_pass_huff(j_decompress_ptr cinfo)635 finish_pass_huff (j_decompress_ptr cinfo)
636 {
637   huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
638 
639   /* Throw away any unused bits remaining in bit buffer; */
640   /* include any full bytes in next_marker's count of discarded bytes */
641   cinfo->marker->discarded_bytes += entropy->bitstate.bits_left / 8;
642   entropy->bitstate.bits_left = 0;
643 }
644 
645 
646 /*
647  * Check for a restart marker & resynchronize decoder.
648  * Returns FALSE if must suspend.
649  */
650 
651 LOCAL(boolean)
process_restart(j_decompress_ptr cinfo)652 process_restart (j_decompress_ptr cinfo)
653 {
654   huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
655   int ci;
656 
657   finish_pass_huff(cinfo);
658 
659   /* Advance past the RSTn marker */
660   if (! (*cinfo->marker->read_restart_marker) (cinfo))
661     return FALSE;
662 
663   /* Re-initialize DC predictions to 0 */
664   for (ci = 0; ci < cinfo->comps_in_scan; ci++)
665     entropy->saved.last_dc_val[ci] = 0;
666   /* Re-init EOB run count, too */
667   entropy->saved.EOBRUN = 0;
668 
669   /* Reset restart counter */
670   entropy->restarts_to_go = cinfo->restart_interval;
671 
672   /* Reset out-of-data flag, unless read_restart_marker left us smack up
673    * against a marker.  In that case we will end up treating the next data
674    * segment as empty, and we can avoid producing bogus output pixels by
675    * leaving the flag set.
676    */
677   if (cinfo->unread_marker == 0)
678     entropy->insufficient_data = FALSE;
679 
680   return TRUE;
681 }
682 
683 
684 /*
685  * Huffman MCU decoding.
686  * Each of these routines decodes and returns one MCU's worth of
687  * Huffman-compressed coefficients.
688  * The coefficients are reordered from zigzag order into natural array order,
689  * but are not dequantized.
690  *
691  * The i'th block of the MCU is stored into the block pointed to by
692  * MCU_data[i].  WE ASSUME THIS AREA IS INITIALLY ZEROED BY THE CALLER.
693  * (Wholesale zeroing is usually a little faster than retail...)
694  *
695  * We return FALSE if data source requested suspension.  In that case no
696  * changes have been made to permanent state.  (Exception: some output
697  * coefficients may already have been assigned.  This is harmless for
698  * spectral selection, since we'll just re-assign them on the next call.
699  * Successive approximation AC refinement has to be more careful, however.)
700  */
701 
702 /*
703  * MCU decoding for DC initial scan (either spectral selection,
704  * or first pass of successive approximation).
705  */
706 
707 METHODDEF(boolean)
decode_mcu_DC_first(j_decompress_ptr cinfo,JBLOCKROW * MCU_data)708 decode_mcu_DC_first (j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
709 {
710   huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
711   int Al = cinfo->Al;
712   register int s, r;
713   int blkn, ci;
714   JBLOCKROW block;
715   BITREAD_STATE_VARS;
716   savable_state state;
717   d_derived_tbl * tbl;
718   jpeg_component_info * compptr;
719 
720   /* Process restart marker if needed; may have to suspend */
721   if (cinfo->restart_interval) {
722     if (entropy->restarts_to_go == 0)
723       if (! process_restart(cinfo))
724 	return FALSE;
725   }
726 
727   /* If we've run out of data, just leave the MCU set to zeroes.
728    * This way, we return uniform gray for the remainder of the segment.
729    */
730   if (! entropy->insufficient_data) {
731 
732     /* Load up working state */
733     BITREAD_LOAD_STATE(cinfo,entropy->bitstate);
734     ASSIGN_STATE(state, entropy->saved);
735 
736     /* Outer loop handles each block in the MCU */
737 
738     for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
739       block = MCU_data[blkn];
740       ci = cinfo->MCU_membership[blkn];
741       compptr = cinfo->cur_comp_info[ci];
742       tbl = entropy->derived_tbls[compptr->dc_tbl_no];
743 
744       /* Decode a single block's worth of coefficients */
745 
746       /* Section F.2.2.1: decode the DC coefficient difference */
747       HUFF_DECODE(s, br_state, tbl, return FALSE, label1);
748       if (s) {
749 	CHECK_BIT_BUFFER(br_state, s, return FALSE);
750 	r = GET_BITS(s);
751 	s = HUFF_EXTEND(r, s);
752       }
753 
754       /* Convert DC difference to actual value, update last_dc_val */
755       s += state.last_dc_val[ci];
756       state.last_dc_val[ci] = s;
757       /* Scale and output the coefficient (assumes jpeg_natural_order[0]=0) */
758       (*block)[0] = (JCOEF) (s << Al);
759     }
760 
761     /* Completed MCU, so update state */
762     BITREAD_SAVE_STATE(cinfo,entropy->bitstate);
763     ASSIGN_STATE(entropy->saved, state);
764   }
765 
766   /* Account for restart interval (no-op if not using restarts) */
767   entropy->restarts_to_go--;
768 
769   return TRUE;
770 }
771 
772 
773 /*
774  * MCU decoding for AC initial scan (either spectral selection,
775  * or first pass of successive approximation).
776  */
777 
778 METHODDEF(boolean)
decode_mcu_AC_first(j_decompress_ptr cinfo,JBLOCKROW * MCU_data)779 decode_mcu_AC_first (j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
780 {
781   huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
782   register int s, k, r;
783   unsigned int EOBRUN;
784   int Se, Al;
785   const int * natural_order;
786   JBLOCKROW block;
787   BITREAD_STATE_VARS;
788   d_derived_tbl * tbl;
789 
790   /* Process restart marker if needed; may have to suspend */
791   if (cinfo->restart_interval) {
792     if (entropy->restarts_to_go == 0)
793       if (! process_restart(cinfo))
794 	return FALSE;
795   }
796 
797   /* If we've run out of data, just leave the MCU set to zeroes.
798    * This way, we return uniform gray for the remainder of the segment.
799    */
800   if (! entropy->insufficient_data) {
801 
802     Se = cinfo->Se;
803     Al = cinfo->Al;
804     natural_order = cinfo->natural_order;
805 
806     /* Load up working state.
807      * We can avoid loading/saving bitread state if in an EOB run.
808      */
809     EOBRUN = entropy->saved.EOBRUN;	/* only part of saved state we need */
810 
811     /* There is always only one block per MCU */
812 
813     if (EOBRUN)			/* if it's a band of zeroes... */
814       EOBRUN--;			/* ...process it now (we do nothing) */
815     else {
816       BITREAD_LOAD_STATE(cinfo,entropy->bitstate);
817       block = MCU_data[0];
818       tbl = entropy->ac_derived_tbl;
819 
820       for (k = cinfo->Ss; k <= Se; k++) {
821 	HUFF_DECODE(s, br_state, tbl, return FALSE, label2);
822 	r = s >> 4;
823 	s &= 15;
824 	if (s) {
825 	  k += r;
826 	  CHECK_BIT_BUFFER(br_state, s, return FALSE);
827 	  r = GET_BITS(s);
828 	  s = HUFF_EXTEND(r, s);
829 	  /* Scale and output coefficient in natural (dezigzagged) order */
830 	  (*block)[natural_order[k]] = (JCOEF) (s << Al);
831 	} else {
832 	  if (r != 15) {	/* EOBr, run length is 2^r + appended bits */
833 	    if (r) {		/* EOBr, r > 0 */
834 	      EOBRUN = 1 << r;
835 	      CHECK_BIT_BUFFER(br_state, r, return FALSE);
836 	      r = GET_BITS(r);
837 	      EOBRUN += r;
838 	      EOBRUN--;		/* this band is processed at this moment */
839 	    }
840 	    break;		/* force end-of-band */
841 	  }
842 	  k += 15;		/* ZRL: skip 15 zeroes in band */
843 	}
844       }
845 
846       BITREAD_SAVE_STATE(cinfo,entropy->bitstate);
847     }
848 
849     /* Completed MCU, so update state */
850     entropy->saved.EOBRUN = EOBRUN;	/* only part of saved state we need */
851   }
852 
853   /* Account for restart interval (no-op if not using restarts) */
854   entropy->restarts_to_go--;
855 
856   return TRUE;
857 }
858 
859 
860 /*
861  * MCU decoding for DC successive approximation refinement scan.
862  * Note: we assume such scans can be multi-component,
863  * although the spec is not very clear on the point.
864  */
865 
866 METHODDEF(boolean)
decode_mcu_DC_refine(j_decompress_ptr cinfo,JBLOCKROW * MCU_data)867 decode_mcu_DC_refine (j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
868 {
869   huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
870   int p1, blkn;
871   BITREAD_STATE_VARS;
872 
873   /* Process restart marker if needed; may have to suspend */
874   if (cinfo->restart_interval) {
875     if (entropy->restarts_to_go == 0)
876       if (! process_restart(cinfo))
877 	return FALSE;
878   }
879 
880   /* Not worth the cycles to check insufficient_data here,
881    * since we will not change the data anyway if we read zeroes.
882    */
883 
884   /* Load up working state */
885   BITREAD_LOAD_STATE(cinfo,entropy->bitstate);
886 
887   p1 = 1 << cinfo->Al;		/* 1 in the bit position being coded */
888 
889   /* Outer loop handles each block in the MCU */
890 
891   for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
892     /* Encoded data is simply the next bit of the two's-complement DC value */
893     CHECK_BIT_BUFFER(br_state, 1, return FALSE);
894     if (GET_BITS(1))
895       MCU_data[blkn][0][0] |= p1;
896     /* Note: since we use |=, repeating the assignment later is safe */
897   }
898 
899   /* Completed MCU, so update state */
900   BITREAD_SAVE_STATE(cinfo,entropy->bitstate);
901 
902   /* Account for restart interval (no-op if not using restarts) */
903   entropy->restarts_to_go--;
904 
905   return TRUE;
906 }
907 
908 
909 /*
910  * MCU decoding for AC successive approximation refinement scan.
911  */
912 
913 METHODDEF(boolean)
decode_mcu_AC_refine(j_decompress_ptr cinfo,JBLOCKROW * MCU_data)914 decode_mcu_AC_refine (j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
915 {
916   huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
917   register int s, k, r;
918   unsigned int EOBRUN;
919   int Se, p1, m1;
920   const int * natural_order;
921   JBLOCKROW block;
922   JCOEFPTR thiscoef;
923   BITREAD_STATE_VARS;
924   d_derived_tbl * tbl;
925   int num_newnz;
926   int newnz_pos[DCTSIZE2];
927 
928   /* Process restart marker if needed; may have to suspend */
929   if (cinfo->restart_interval) {
930     if (entropy->restarts_to_go == 0)
931       if (! process_restart(cinfo))
932 	return FALSE;
933   }
934 
935   /* If we've run out of data, don't modify the MCU.
936    */
937   if (! entropy->insufficient_data) {
938 
939     Se = cinfo->Se;
940     p1 = 1 << cinfo->Al;	/* 1 in the bit position being coded */
941     m1 = (-1) << cinfo->Al;	/* -1 in the bit position being coded */
942     natural_order = cinfo->natural_order;
943 
944     /* Load up working state */
945     BITREAD_LOAD_STATE(cinfo,entropy->bitstate);
946     EOBRUN = entropy->saved.EOBRUN; /* only part of saved state we need */
947 
948     /* There is always only one block per MCU */
949     block = MCU_data[0];
950     tbl = entropy->ac_derived_tbl;
951 
952     /* If we are forced to suspend, we must undo the assignments to any newly
953      * nonzero coefficients in the block, because otherwise we'd get confused
954      * next time about which coefficients were already nonzero.
955      * But we need not undo addition of bits to already-nonzero coefficients;
956      * instead, we can test the current bit to see if we already did it.
957      */
958     num_newnz = 0;
959 
960     /* initialize coefficient loop counter to start of band */
961     k = cinfo->Ss;
962 
963     if (EOBRUN == 0) {
964       do {
965 	HUFF_DECODE(s, br_state, tbl, goto undoit, label3);
966 	r = s >> 4;
967 	s &= 15;
968 	if (s) {
969 	  if (s != 1)		/* size of new coef should always be 1 */
970 	    WARNMS(cinfo, JWRN_HUFF_BAD_CODE);
971 	  CHECK_BIT_BUFFER(br_state, 1, goto undoit);
972 	  if (GET_BITS(1))
973 	    s = p1;		/* newly nonzero coef is positive */
974 	  else
975 	    s = m1;		/* newly nonzero coef is negative */
976 	} else {
977 	  if (r != 15) {
978 	    EOBRUN = 1 << r;	/* EOBr, run length is 2^r + appended bits */
979 	    if (r) {
980 	      CHECK_BIT_BUFFER(br_state, r, goto undoit);
981 	      r = GET_BITS(r);
982 	      EOBRUN += r;
983 	    }
984 	    break;		/* rest of block is handled by EOB logic */
985 	  }
986 	  /* note s = 0 for processing ZRL */
987 	}
988 	/* Advance over already-nonzero coefs and r still-zero coefs,
989 	 * appending correction bits to the nonzeroes.  A correction bit is 1
990 	 * if the absolute value of the coefficient must be increased.
991 	 */
992 	do {
993 	  thiscoef = *block + natural_order[k];
994 	  if (*thiscoef) {
995 	    CHECK_BIT_BUFFER(br_state, 1, goto undoit);
996 	    if (GET_BITS(1)) {
997 	      if ((*thiscoef & p1) == 0) { /* do nothing if already set it */
998 		if (*thiscoef >= 0)
999 		  *thiscoef += p1;
1000 		else
1001 		  *thiscoef += m1;
1002 	      }
1003 	    }
1004 	  } else {
1005 	    if (--r < 0)
1006 	      break;		/* reached target zero coefficient */
1007 	  }
1008 	  k++;
1009 	} while (k <= Se);
1010 	if (s) {
1011 	  int pos = natural_order[k];
1012 	  /* Output newly nonzero coefficient */
1013 	  (*block)[pos] = (JCOEF) s;
1014 	  /* Remember its position in case we have to suspend */
1015 	  newnz_pos[num_newnz++] = pos;
1016 	}
1017 	k++;
1018       } while (k <= Se);
1019     }
1020 
1021     if (EOBRUN) {
1022       /* Scan any remaining coefficient positions after the end-of-band
1023        * (the last newly nonzero coefficient, if any).  Append a correction
1024        * bit to each already-nonzero coefficient.  A correction bit is 1
1025        * if the absolute value of the coefficient must be increased.
1026        */
1027       do {
1028 	thiscoef = *block + natural_order[k];
1029 	if (*thiscoef) {
1030 	  CHECK_BIT_BUFFER(br_state, 1, goto undoit);
1031 	  if (GET_BITS(1)) {
1032 	    if ((*thiscoef & p1) == 0) { /* do nothing if already changed it */
1033 	      if (*thiscoef >= 0)
1034 		*thiscoef += p1;
1035 	      else
1036 		*thiscoef += m1;
1037 	    }
1038 	  }
1039 	}
1040 	k++;
1041       } while (k <= Se);
1042       /* Count one block completed in EOB run */
1043       EOBRUN--;
1044     }
1045 
1046     /* Completed MCU, so update state */
1047     BITREAD_SAVE_STATE(cinfo,entropy->bitstate);
1048     entropy->saved.EOBRUN = EOBRUN; /* only part of saved state we need */
1049   }
1050 
1051   /* Account for restart interval (no-op if not using restarts) */
1052   entropy->restarts_to_go--;
1053 
1054   return TRUE;
1055 
1056 undoit:
1057   /* Re-zero any output coefficients that we made newly nonzero */
1058   while (num_newnz)
1059     (*block)[newnz_pos[--num_newnz]] = 0;
1060 
1061   return FALSE;
1062 }
1063 
1064 
1065 /*
1066  * Decode one MCU's worth of Huffman-compressed coefficients,
1067  * partial blocks.
1068  */
1069 
1070 METHODDEF(boolean)
decode_mcu_sub(j_decompress_ptr cinfo,JBLOCKROW * MCU_data)1071 decode_mcu_sub (j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
1072 {
1073   huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
1074   const int * natural_order;
1075   int Se, blkn;
1076   BITREAD_STATE_VARS;
1077   savable_state state;
1078 
1079   /* Process restart marker if needed; may have to suspend */
1080   if (cinfo->restart_interval) {
1081     if (entropy->restarts_to_go == 0)
1082       if (! process_restart(cinfo))
1083 	return FALSE;
1084   }
1085 
1086   /* If we've run out of data, just leave the MCU set to zeroes.
1087    * This way, we return uniform gray for the remainder of the segment.
1088    */
1089   if (! entropy->insufficient_data) {
1090 
1091     natural_order = cinfo->natural_order;
1092     Se = cinfo->lim_Se;
1093 
1094     /* Load up working state */
1095     BITREAD_LOAD_STATE(cinfo,entropy->bitstate);
1096     ASSIGN_STATE(state, entropy->saved);
1097 
1098     /* Outer loop handles each block in the MCU */
1099 
1100     for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
1101       JBLOCKROW block = MCU_data[blkn];
1102       d_derived_tbl * htbl;
1103       register int s, k, r;
1104       int coef_limit, ci;
1105 
1106       /* Decode a single block's worth of coefficients */
1107 
1108       /* Section F.2.2.1: decode the DC coefficient difference */
1109       htbl = entropy->dc_cur_tbls[blkn];
1110       HUFF_DECODE(s, br_state, htbl, return FALSE, label1);
1111 
1112       htbl = entropy->ac_cur_tbls[blkn];
1113       k = 1;
1114       coef_limit = entropy->coef_limit[blkn];
1115       if (coef_limit) {
1116 	/* Convert DC difference to actual value, update last_dc_val */
1117 	if (s) {
1118 	  CHECK_BIT_BUFFER(br_state, s, return FALSE);
1119 	  r = GET_BITS(s);
1120 	  s = HUFF_EXTEND(r, s);
1121 	}
1122 	ci = cinfo->MCU_membership[blkn];
1123 	s += state.last_dc_val[ci];
1124 	state.last_dc_val[ci] = s;
1125 	/* Output the DC coefficient */
1126 	(*block)[0] = (JCOEF) s;
1127 
1128 	/* Section F.2.2.2: decode the AC coefficients */
1129 	/* Since zeroes are skipped, output area must be cleared beforehand */
1130 	for (; k < coef_limit; k++) {
1131 	  HUFF_DECODE(s, br_state, htbl, return FALSE, label2);
1132 
1133 	  r = s >> 4;
1134 	  s &= 15;
1135 
1136 	  if (s) {
1137 	    k += r;
1138 	    CHECK_BIT_BUFFER(br_state, s, return FALSE);
1139 	    r = GET_BITS(s);
1140 	    s = HUFF_EXTEND(r, s);
1141 	    /* Output coefficient in natural (dezigzagged) order.
1142 	     * Note: the extra entries in natural_order[] will save us
1143 	     * if k > Se, which could happen if the data is corrupted.
1144 	     */
1145 	    (*block)[natural_order[k]] = (JCOEF) s;
1146 	  } else {
1147 	    if (r != 15)
1148 	      goto EndOfBlock;
1149 	    k += 15;
1150 	  }
1151 	}
1152       } else {
1153 	if (s) {
1154 	  CHECK_BIT_BUFFER(br_state, s, return FALSE);
1155 	  DROP_BITS(s);
1156 	}
1157       }
1158 
1159       /* Section F.2.2.2: decode the AC coefficients */
1160       /* In this path we just discard the values */
1161       for (; k <= Se; k++) {
1162 	HUFF_DECODE(s, br_state, htbl, return FALSE, label3);
1163 
1164 	r = s >> 4;
1165 	s &= 15;
1166 
1167 	if (s) {
1168 	  k += r;
1169 	  CHECK_BIT_BUFFER(br_state, s, return FALSE);
1170 	  DROP_BITS(s);
1171 	} else {
1172 	  if (r != 15)
1173 	    break;
1174 	  k += 15;
1175 	}
1176       }
1177 
1178       EndOfBlock: ;
1179     }
1180 
1181     /* Completed MCU, so update state */
1182     BITREAD_SAVE_STATE(cinfo,entropy->bitstate);
1183     ASSIGN_STATE(entropy->saved, state);
1184   }
1185 
1186   /* Account for restart interval (no-op if not using restarts) */
1187   entropy->restarts_to_go--;
1188 
1189   return TRUE;
1190 }
1191 
1192 
1193 /*
1194  * Decode one MCU's worth of Huffman-compressed coefficients,
1195  * full-size blocks.
1196  */
1197 
1198 METHODDEF(boolean)
decode_mcu(j_decompress_ptr cinfo,JBLOCKROW * MCU_data)1199 decode_mcu (j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
1200 {
1201   huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
1202   int blkn;
1203   BITREAD_STATE_VARS;
1204   savable_state state;
1205 
1206   /* Process restart marker if needed; may have to suspend */
1207   if (cinfo->restart_interval) {
1208     if (entropy->restarts_to_go == 0)
1209       if (! process_restart(cinfo))
1210 	return FALSE;
1211   }
1212 
1213   /* If we've run out of data, just leave the MCU set to zeroes.
1214    * This way, we return uniform gray for the remainder of the segment.
1215    */
1216   if (! entropy->insufficient_data) {
1217 
1218     /* Load up working state */
1219     BITREAD_LOAD_STATE(cinfo,entropy->bitstate);
1220     ASSIGN_STATE(state, entropy->saved);
1221 
1222     /* Outer loop handles each block in the MCU */
1223 
1224     for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
1225       JBLOCKROW block = MCU_data[blkn];
1226       d_derived_tbl * htbl;
1227       register int s, k, r;
1228       int coef_limit, ci;
1229 
1230       /* Decode a single block's worth of coefficients */
1231 
1232       /* Section F.2.2.1: decode the DC coefficient difference */
1233       htbl = entropy->dc_cur_tbls[blkn];
1234       HUFF_DECODE(s, br_state, htbl, return FALSE, label1);
1235 
1236       htbl = entropy->ac_cur_tbls[blkn];
1237       k = 1;
1238       coef_limit = entropy->coef_limit[blkn];
1239       if (coef_limit) {
1240 	/* Convert DC difference to actual value, update last_dc_val */
1241 	if (s) {
1242 	  CHECK_BIT_BUFFER(br_state, s, return FALSE);
1243 	  r = GET_BITS(s);
1244 	  s = HUFF_EXTEND(r, s);
1245 	}
1246 	ci = cinfo->MCU_membership[blkn];
1247 	s += state.last_dc_val[ci];
1248 	state.last_dc_val[ci] = s;
1249 	/* Output the DC coefficient */
1250 	(*block)[0] = (JCOEF) s;
1251 
1252 	/* Section F.2.2.2: decode the AC coefficients */
1253 	/* Since zeroes are skipped, output area must be cleared beforehand */
1254 	for (; k < coef_limit; k++) {
1255 	  HUFF_DECODE(s, br_state, htbl, return FALSE, label2);
1256 
1257 	  r = s >> 4;
1258 	  s &= 15;
1259 
1260 	  if (s) {
1261 	    k += r;
1262 	    CHECK_BIT_BUFFER(br_state, s, return FALSE);
1263 	    r = GET_BITS(s);
1264 	    s = HUFF_EXTEND(r, s);
1265 	    /* Output coefficient in natural (dezigzagged) order.
1266 	     * Note: the extra entries in jpeg_natural_order[] will save us
1267 	     * if k >= DCTSIZE2, which could happen if the data is corrupted.
1268 	     */
1269 	    (*block)[jpeg_natural_order[k]] = (JCOEF) s;
1270 	  } else {
1271 	    if (r != 15)
1272 	      goto EndOfBlock;
1273 	    k += 15;
1274 	  }
1275 	}
1276       } else {
1277 	if (s) {
1278 	  CHECK_BIT_BUFFER(br_state, s, return FALSE);
1279 	  DROP_BITS(s);
1280 	}
1281       }
1282 
1283       /* Section F.2.2.2: decode the AC coefficients */
1284       /* In this path we just discard the values */
1285       for (; k < DCTSIZE2; k++) {
1286 	HUFF_DECODE(s, br_state, htbl, return FALSE, label3);
1287 
1288 	r = s >> 4;
1289 	s &= 15;
1290 
1291 	if (s) {
1292 	  k += r;
1293 	  CHECK_BIT_BUFFER(br_state, s, return FALSE);
1294 	  DROP_BITS(s);
1295 	} else {
1296 	  if (r != 15)
1297 	    break;
1298 	  k += 15;
1299 	}
1300       }
1301 
1302       EndOfBlock: ;
1303     }
1304 
1305     /* Completed MCU, so update state */
1306     BITREAD_SAVE_STATE(cinfo,entropy->bitstate);
1307     ASSIGN_STATE(entropy->saved, state);
1308   }
1309 
1310   /* Account for restart interval (no-op if not using restarts) */
1311   entropy->restarts_to_go--;
1312 
1313   return TRUE;
1314 }
1315 
1316 
1317 /*
1318  * Initialize for a Huffman-compressed scan.
1319  */
1320 
1321 METHODDEF(void)
start_pass_huff_decoder(j_decompress_ptr cinfo)1322 start_pass_huff_decoder (j_decompress_ptr cinfo)
1323 {
1324   huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
1325   int ci, blkn, tbl, i;
1326   jpeg_component_info * compptr;
1327 
1328   if (cinfo->progressive_mode) {
1329     /* Validate progressive scan parameters */
1330     if (cinfo->Ss == 0) {
1331       if (cinfo->Se != 0)
1332 	goto bad;
1333     } else {
1334       /* need not check Ss/Se < 0 since they came from unsigned bytes */
1335       if (cinfo->Se < cinfo->Ss || cinfo->Se > cinfo->lim_Se)
1336 	goto bad;
1337       /* AC scans may have only one component */
1338       if (cinfo->comps_in_scan != 1)
1339 	goto bad;
1340     }
1341     if (cinfo->Ah != 0) {
1342       /* Successive approximation refinement scan: must have Al = Ah-1. */
1343       if (cinfo->Ah-1 != cinfo->Al)
1344 	goto bad;
1345     }
1346     if (cinfo->Al > 13) {	/* need not check for < 0 */
1347       /* Arguably the maximum Al value should be less than 13 for 8-bit precision,
1348        * but the spec doesn't say so, and we try to be liberal about what we
1349        * accept.  Note: large Al values could result in out-of-range DC
1350        * coefficients during early scans, leading to bizarre displays due to
1351        * overflows in the IDCT math.  But we won't crash.
1352        */
1353       bad:
1354       ERREXIT4(cinfo, JERR_BAD_PROGRESSION,
1355 	       cinfo->Ss, cinfo->Se, cinfo->Ah, cinfo->Al);
1356     }
1357     /* Update progression status, and verify that scan order is legal.
1358      * Note that inter-scan inconsistencies are treated as warnings
1359      * not fatal errors ... not clear if this is right way to behave.
1360      */
1361     for (ci = 0; ci < cinfo->comps_in_scan; ci++) {
1362       int coefi, cindex = cinfo->cur_comp_info[ci]->component_index;
1363       int *coef_bit_ptr = & cinfo->coef_bits[cindex][0];
1364       if (cinfo->Ss && coef_bit_ptr[0] < 0) /* AC without prior DC scan */
1365 	WARNMS2(cinfo, JWRN_BOGUS_PROGRESSION, cindex, 0);
1366       for (coefi = cinfo->Ss; coefi <= cinfo->Se; coefi++) {
1367 	int expected = (coef_bit_ptr[coefi] < 0) ? 0 : coef_bit_ptr[coefi];
1368 	if (cinfo->Ah != expected)
1369 	  WARNMS2(cinfo, JWRN_BOGUS_PROGRESSION, cindex, coefi);
1370 	coef_bit_ptr[coefi] = cinfo->Al;
1371       }
1372     }
1373 
1374     /* Select MCU decoding routine */
1375     if (cinfo->Ah == 0) {
1376       if (cinfo->Ss == 0)
1377 	entropy->pub.decode_mcu = decode_mcu_DC_first;
1378       else
1379 	entropy->pub.decode_mcu = decode_mcu_AC_first;
1380     } else {
1381       if (cinfo->Ss == 0)
1382 	entropy->pub.decode_mcu = decode_mcu_DC_refine;
1383       else
1384 	entropy->pub.decode_mcu = decode_mcu_AC_refine;
1385     }
1386 
1387     for (ci = 0; ci < cinfo->comps_in_scan; ci++) {
1388       compptr = cinfo->cur_comp_info[ci];
1389       /* Make sure requested tables are present, and compute derived tables.
1390        * We may build same derived table more than once, but it's not expensive.
1391        */
1392       if (cinfo->Ss == 0) {
1393 	if (cinfo->Ah == 0) {	/* DC refinement needs no table */
1394 	  tbl = compptr->dc_tbl_no;
1395 	  jpeg_make_d_derived_tbl(cinfo, TRUE, tbl,
1396 				  & entropy->derived_tbls[tbl]);
1397 	}
1398       } else {
1399 	tbl = compptr->ac_tbl_no;
1400 	jpeg_make_d_derived_tbl(cinfo, FALSE, tbl,
1401 				& entropy->derived_tbls[tbl]);
1402 	/* remember the single active table */
1403 	entropy->ac_derived_tbl = entropy->derived_tbls[tbl];
1404       }
1405       /* Initialize DC predictions to 0 */
1406       entropy->saved.last_dc_val[ci] = 0;
1407     }
1408 
1409     /* Initialize private state variables */
1410     entropy->saved.EOBRUN = 0;
1411   } else {
1412     /* Check that the scan parameters Ss, Se, Ah/Al are OK for sequential JPEG.
1413      * This ought to be an error condition, but we make it a warning because
1414      * there are some baseline files out there with all zeroes in these bytes.
1415      */
1416     if (cinfo->Ss != 0 || cinfo->Ah != 0 || cinfo->Al != 0 ||
1417 	((cinfo->is_baseline || cinfo->Se < DCTSIZE2) &&
1418 	cinfo->Se != cinfo->lim_Se))
1419       WARNMS(cinfo, JWRN_NOT_SEQUENTIAL);
1420 
1421     /* Select MCU decoding routine */
1422     /* We retain the hard-coded case for full-size blocks.
1423      * This is not necessary, but it appears that this version is slightly
1424      * more performant in the given implementation.
1425      * With an improved implementation we would prefer a single optimized
1426      * function.
1427      */
1428     if (cinfo->lim_Se != DCTSIZE2-1)
1429       entropy->pub.decode_mcu = decode_mcu_sub;
1430     else
1431       entropy->pub.decode_mcu = decode_mcu;
1432 
1433     for (ci = 0; ci < cinfo->comps_in_scan; ci++) {
1434       compptr = cinfo->cur_comp_info[ci];
1435       /* Compute derived values for Huffman tables */
1436       /* We may do this more than once for a table, but it's not expensive */
1437       tbl = compptr->dc_tbl_no;
1438       jpeg_make_d_derived_tbl(cinfo, TRUE, tbl,
1439 			      & entropy->dc_derived_tbls[tbl]);
1440       if (cinfo->lim_Se) {	/* AC needs no table when not present */
1441 	tbl = compptr->ac_tbl_no;
1442 	jpeg_make_d_derived_tbl(cinfo, FALSE, tbl,
1443 				& entropy->ac_derived_tbls[tbl]);
1444       }
1445       /* Initialize DC predictions to 0 */
1446       entropy->saved.last_dc_val[ci] = 0;
1447     }
1448 
1449     /* Precalculate decoding info for each block in an MCU of this scan */
1450     for (blkn = 0; blkn < cinfo->blocks_in_MCU; blkn++) {
1451       ci = cinfo->MCU_membership[blkn];
1452       compptr = cinfo->cur_comp_info[ci];
1453       /* Precalculate which table to use for each block */
1454       entropy->dc_cur_tbls[blkn] = entropy->dc_derived_tbls[compptr->dc_tbl_no];
1455       entropy->ac_cur_tbls[blkn] = entropy->ac_derived_tbls[compptr->ac_tbl_no];
1456       /* Decide whether we really care about the coefficient values */
1457       if (compptr->component_needed) {
1458 	ci = compptr->DCT_v_scaled_size;
1459 	i = compptr->DCT_h_scaled_size;
1460 	switch (cinfo->lim_Se) {
1461 	case (1*1-1):
1462 	  entropy->coef_limit[blkn] = 1;
1463 	  break;
1464 	case (2*2-1):
1465 	  if (ci <= 0 || ci > 2) ci = 2;
1466 	  if (i <= 0 || i > 2) i = 2;
1467 	  entropy->coef_limit[blkn] = 1 + jpeg_zigzag_order2[ci - 1][i - 1];
1468 	  break;
1469 	case (3*3-1):
1470 	  if (ci <= 0 || ci > 3) ci = 3;
1471 	  if (i <= 0 || i > 3) i = 3;
1472 	  entropy->coef_limit[blkn] = 1 + jpeg_zigzag_order3[ci - 1][i - 1];
1473 	  break;
1474 	case (4*4-1):
1475 	  if (ci <= 0 || ci > 4) ci = 4;
1476 	  if (i <= 0 || i > 4) i = 4;
1477 	  entropy->coef_limit[blkn] = 1 + jpeg_zigzag_order4[ci - 1][i - 1];
1478 	  break;
1479 	case (5*5-1):
1480 	  if (ci <= 0 || ci > 5) ci = 5;
1481 	  if (i <= 0 || i > 5) i = 5;
1482 	  entropy->coef_limit[blkn] = 1 + jpeg_zigzag_order5[ci - 1][i - 1];
1483 	  break;
1484 	case (6*6-1):
1485 	  if (ci <= 0 || ci > 6) ci = 6;
1486 	  if (i <= 0 || i > 6) i = 6;
1487 	  entropy->coef_limit[blkn] = 1 + jpeg_zigzag_order6[ci - 1][i - 1];
1488 	  break;
1489 	case (7*7-1):
1490 	  if (ci <= 0 || ci > 7) ci = 7;
1491 	  if (i <= 0 || i > 7) i = 7;
1492 	  entropy->coef_limit[blkn] = 1 + jpeg_zigzag_order7[ci - 1][i - 1];
1493 	  break;
1494 	default:
1495 	  if (ci <= 0 || ci > 8) ci = 8;
1496 	  if (i <= 0 || i > 8) i = 8;
1497 	  entropy->coef_limit[blkn] = 1 + jpeg_zigzag_order[ci - 1][i - 1];
1498 	  break;
1499 	}
1500       } else {
1501 	entropy->coef_limit[blkn] = 0;
1502       }
1503     }
1504   }
1505 
1506   /* Initialize bitread state variables */
1507   entropy->bitstate.bits_left = 0;
1508   entropy->bitstate.get_buffer = 0; /* unnecessary, but keeps Purify quiet */
1509   entropy->insufficient_data = FALSE;
1510 
1511   /* Initialize restart counter */
1512   entropy->restarts_to_go = cinfo->restart_interval;
1513 }
1514 
1515 
1516 /*
1517  * Module initialization routine for Huffman entropy decoding.
1518  */
1519 
1520 GLOBAL(void)
jinit_huff_decoder(j_decompress_ptr cinfo)1521 jinit_huff_decoder (j_decompress_ptr cinfo)
1522 {
1523   huff_entropy_ptr entropy;
1524   int i;
1525 
1526   entropy = (huff_entropy_ptr)
1527     (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE,
1528 				SIZEOF(huff_entropy_decoder));
1529   cinfo->entropy = &entropy->pub;
1530   entropy->pub.start_pass = start_pass_huff_decoder;
1531   entropy->pub.finish_pass = finish_pass_huff;
1532 
1533   if (cinfo->progressive_mode) {
1534     /* Create progression status table */
1535     int *coef_bit_ptr, ci;
1536     cinfo->coef_bits = (int (*)[DCTSIZE2])
1537       (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE,
1538 				  cinfo->num_components*DCTSIZE2*SIZEOF(int));
1539     coef_bit_ptr = & cinfo->coef_bits[0][0];
1540     for (ci = 0; ci < cinfo->num_components; ci++)
1541       for (i = 0; i < DCTSIZE2; i++)
1542 	*coef_bit_ptr++ = -1;
1543 
1544     /* Mark derived tables unallocated */
1545     for (i = 0; i < NUM_HUFF_TBLS; i++) {
1546       entropy->derived_tbls[i] = NULL;
1547     }
1548   } else {
1549     /* Mark tables unallocated */
1550     for (i = 0; i < NUM_HUFF_TBLS; i++) {
1551       entropy->dc_derived_tbls[i] = entropy->ac_derived_tbls[i] = NULL;
1552     }
1553   }
1554 }
1555