|
1 | 1 | // Malicious JPEG files can cause operations in the idct to overflow.
|
2 | 2 | // One example is tests/crashtest/images/imagetestsuite/b0b8914cc5f7a6eff409f16d8cc236c5.jpg
|
3 | 3 | // That's why wrapping operators are needed.
|
| 4 | +use crate::parser::Dimensions; |
| 5 | + |
| 6 | +pub(crate) fn choose_idct_size(full_size: Dimensions, requested_size: Dimensions) -> usize { |
| 7 | + fn scaled(len: u16, scale: usize) -> u16 { ((len as u32 * scale as u32 - 1) / 8 + 1) as u16 } |
| 8 | + |
| 9 | + for &scale in &[1, 2, 4] { |
| 10 | + if scaled(full_size.width, scale) >= requested_size.width || scaled(full_size.height, scale) >= requested_size.height { |
| 11 | + return scale; |
| 12 | + } |
| 13 | + } |
| 14 | + |
| 15 | + return 8; |
| 16 | +} |
| 17 | + |
| 18 | +#[test] |
| 19 | +fn test_choose_idct_size() { |
| 20 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 200, height: 200}), 1); |
| 21 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 500, height: 500}), 1); |
| 22 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 684, height: 456}), 1); |
| 23 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 999, height: 456}), 1); |
| 24 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 684, height: 999}), 1); |
| 25 | + assert_eq!(choose_idct_size(Dimensions{width: 500, height: 333}, Dimensions{width: 63, height: 42}), 1); |
| 26 | + |
| 27 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 685, height: 999}), 2); |
| 28 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 1000, height: 1000}), 2); |
| 29 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 1400, height: 1400}), 4); |
| 30 | + |
| 31 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 5472, height: 3648}), 8); |
| 32 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 16384, height: 16384}), 8); |
| 33 | + assert_eq!(choose_idct_size(Dimensions{width: 1, height: 1}, Dimensions{width: 65535, height: 65535}), 8); |
| 34 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 16384, height: 16384}), 8); |
| 35 | +} |
| 36 | + |
| 37 | +pub(crate) fn dequantize_and_idct_block(scale: usize, coefficients: &[i16], quantization_table: &[u16; 64], output_linestride: usize, output: &mut [u8]) { |
| 38 | + match scale { |
| 39 | + 8 => dequantize_and_idct_block_8x8(coefficients, quantization_table, output_linestride, output), |
| 40 | + 4 => dequantize_and_idct_block_4x4(coefficients, quantization_table, output_linestride, output), |
| 41 | + 2 => dequantize_and_idct_block_2x2(coefficients, quantization_table, output_linestride, output), |
| 42 | + 1 => dequantize_and_idct_block_1x1(coefficients, quantization_table, output_linestride, output), |
| 43 | + _ => panic!("Unsupported IDCT scale {}/8", scale), |
| 44 | + } |
| 45 | +} |
4 | 46 |
|
5 | 47 | // This is based on stb_image's 'stbi__idct_block'.
|
6 |
| -pub fn dequantize_and_idct_block(coefficients: &[i16], quantization_table: &[u16; 64], output_linestride: usize, output: &mut [u8]) { |
| 48 | +fn dequantize_and_idct_block_8x8(coefficients: &[i16], quantization_table: &[u16; 64], output_linestride: usize, output: &mut [u8]) { |
7 | 49 | debug_assert_eq!(coefficients.len(), 64);
|
8 | 50 |
|
9 | 51 | let mut temp = [0i32; 64];
|
@@ -155,6 +197,103 @@ pub fn dequantize_and_idct_block(coefficients: &[i16], quantization_table: &[u16
|
155 | 197 | }
|
156 | 198 | }
|
157 | 199 |
|
| 200 | +// 4x4 and 2x2 IDCT based on Rakesh Dugad and Narendra Ahuja: "A Fast Scheme for Image Size Change in the Compressed Domain" (2001). |
| 201 | +// http://sylvana.net/jpegcrop/jidctred/ |
| 202 | +fn dequantize_and_idct_block_4x4(coefficients: &[i16], quantization_table: &[u16; 64], output_linestride: usize, output: &mut [u8]) { |
| 203 | + debug_assert_eq!(coefficients.len(), 64); |
| 204 | + let mut temp = [0i32; 4*4]; |
| 205 | + |
| 206 | + const CONST_BITS: u32 = 12; |
| 207 | + const PASS1_BITS: u32 = 2; |
| 208 | + const FINAL_BITS: u32 = CONST_BITS + PASS1_BITS + 3; |
| 209 | + |
| 210 | + // columns |
| 211 | + for i in 0 .. 4 { |
| 212 | + let s0 = coefficients[i + 8*0] as i32 * quantization_table[i + 8*0] as i32; |
| 213 | + let s1 = coefficients[i + 8*1] as i32 * quantization_table[i + 8*1] as i32; |
| 214 | + let s2 = coefficients[i + 8*2] as i32 * quantization_table[i + 8*2] as i32; |
| 215 | + let s3 = coefficients[i + 8*3] as i32 * quantization_table[i + 8*3] as i32; |
| 216 | + |
| 217 | + let x0 = s0.wrapping_add(s2).wrapping_shl(PASS1_BITS); |
| 218 | + let x2 = s0.wrapping_sub(s2).wrapping_shl(PASS1_BITS); |
| 219 | + |
| 220 | + let p1 = s1.wrapping_add(s3).wrapping_mul(stbi_f2f(0.541196100)); |
| 221 | + let t0 = p1.wrapping_add(s3.wrapping_mul(stbi_f2f(-1.847759065))).wrapping_add(512).wrapping_shr(CONST_BITS - PASS1_BITS); |
| 222 | + let t2 = p1.wrapping_add(s1.wrapping_mul(stbi_f2f( 0.765366865))).wrapping_add(512).wrapping_shr(CONST_BITS - PASS1_BITS); |
| 223 | + |
| 224 | + temp[i + 4*0] = x0.wrapping_add(t2); |
| 225 | + temp[i + 4*3] = x0.wrapping_sub(t2); |
| 226 | + temp[i + 4*1] = x2.wrapping_add(t0); |
| 227 | + temp[i + 4*2] = x2.wrapping_sub(t0); |
| 228 | + } |
| 229 | + |
| 230 | + for i in 0 .. 4 { |
| 231 | + let s0 = temp[i * 4 + 0]; |
| 232 | + let s1 = temp[i * 4 + 1]; |
| 233 | + let s2 = temp[i * 4 + 2]; |
| 234 | + let s3 = temp[i * 4 + 3]; |
| 235 | + |
| 236 | + let x0 = s0.wrapping_add(s2).wrapping_shl(CONST_BITS); |
| 237 | + let x2 = s0.wrapping_sub(s2).wrapping_shl(CONST_BITS); |
| 238 | + |
| 239 | + let p1 = s1.wrapping_add(s3).wrapping_mul(stbi_f2f(0.541196100)); |
| 240 | + let t0 = p1.wrapping_add(s3.wrapping_mul(stbi_f2f(-1.847759065))); |
| 241 | + let t2 = p1.wrapping_add(s1.wrapping_mul(stbi_f2f(0.765366865))); |
| 242 | + |
| 243 | + // constants scaled things up by 1<<12, plus we had 1<<2 from first |
| 244 | + // loop, plus horizontal and vertical each scale by sqrt(8) so together |
| 245 | + // we've got an extra 1<<3, so 1<<17 total we need to remove. |
| 246 | + // so we want to round that, which means adding 0.5 * 1<<17, |
| 247 | + // aka 65536. Also, we'll end up with -128 to 127 that we want |
| 248 | + // to encode as 0..255 by adding 128, so we'll add that before the shift |
| 249 | + let x0 = x0.wrapping_add((1 << (FINAL_BITS - 1)) + (128 << FINAL_BITS)); |
| 250 | + let x2 = x2.wrapping_add((1 << (FINAL_BITS - 1)) + (128 << FINAL_BITS)); |
| 251 | + |
| 252 | + output[i * output_linestride + 0] = stbi_clamp(x0.wrapping_add(t2).wrapping_shr(FINAL_BITS)); |
| 253 | + output[i * output_linestride + 3] = stbi_clamp(x0.wrapping_sub(t2).wrapping_shr(FINAL_BITS)); |
| 254 | + output[i * output_linestride + 1] = stbi_clamp(x2.wrapping_add(t0).wrapping_shr(FINAL_BITS)); |
| 255 | + output[i * output_linestride + 2] = stbi_clamp(x2.wrapping_sub(t0).wrapping_shr(FINAL_BITS)); |
| 256 | + } |
| 257 | +} |
| 258 | + |
| 259 | +fn dequantize_and_idct_block_2x2(coefficients: &[i16], quantization_table: &[u16; 64], output_linestride: usize, output: &mut [u8]) { |
| 260 | + debug_assert_eq!(coefficients.len(), 64); |
| 261 | + |
| 262 | + const SCALE_BITS: u32 = 3; |
| 263 | + |
| 264 | + // Column 0 |
| 265 | + let s00 = coefficients[8*0] as i32 * quantization_table[8*0] as i32; |
| 266 | + let s10 = coefficients[8*1] as i32 * quantization_table[8*1] as i32; |
| 267 | + |
| 268 | + let x0 = s00.wrapping_add(s10); |
| 269 | + let x2 = s00.wrapping_sub(s10); |
| 270 | + |
| 271 | + // Column 1 |
| 272 | + let s01 = coefficients[8*0+1] as i32 * quantization_table[8*0+1] as i32; |
| 273 | + let s11 = coefficients[8*1+1] as i32 * quantization_table[8*1+1] as i32; |
| 274 | + |
| 275 | + let x1 = s01.wrapping_add(s11); |
| 276 | + let x3 = s01.wrapping_sub(s11); |
| 277 | + |
| 278 | + let x0 = x0.wrapping_add((1 << (SCALE_BITS-1)) + (128 << SCALE_BITS)); |
| 279 | + let x2 = x2.wrapping_add((1 << (SCALE_BITS-1)) + (128 << SCALE_BITS)); |
| 280 | + |
| 281 | + // Row 0 |
| 282 | + output[0] = stbi_clamp(x0.wrapping_add(x1).wrapping_shr(SCALE_BITS)); |
| 283 | + output[1] = stbi_clamp(x0.wrapping_sub(x1).wrapping_shr(SCALE_BITS)); |
| 284 | + |
| 285 | + // Row 1 |
| 286 | + output[output_linestride + 0] = stbi_clamp(x2.wrapping_add(x3).wrapping_shr(SCALE_BITS)); |
| 287 | + output[output_linestride + 1] = stbi_clamp(x2.wrapping_sub(x3).wrapping_shr(SCALE_BITS)); |
| 288 | +} |
| 289 | + |
| 290 | +fn dequantize_and_idct_block_1x1(coefficients: &[i16], quantization_table: &[u16; 64], _output_linestride: usize, output: &mut [u8]) { |
| 291 | + debug_assert_eq!(coefficients.len(), 64); |
| 292 | + |
| 293 | + let s0 = (coefficients[0] as i32 * quantization_table[0] as i32).wrapping_add(128 * 8) / 8; |
| 294 | + output[0] = stbi_clamp(s0); |
| 295 | +} |
| 296 | + |
158 | 297 | // take a -128..127 value and stbi__clamp it and convert to 0..255
|
159 | 298 | fn stbi_clamp(x: i32) -> u8
|
160 | 299 | {
|
|
0 commit comments