|
1 | 1 | // Malicious JPEG files can cause operations in the idct to overflow.
|
2 | 2 | // One example is tests/crashtest/images/imagetestsuite/b0b8914cc5f7a6eff409f16d8cc236c5.jpg
|
3 | 3 | // That's why wrapping operators are needed.
|
| 4 | +use crate::parser::Dimensions; |
| 5 | + |
| 6 | +pub fn choose_idct_size(full_size: Dimensions, requested_size: Dimensions) -> usize { |
| 7 | + fn scaled(len: u16, scale: usize) -> u16 { ((len as u32 * scale as u32 - 1) / 8 + 1) as u16 } |
| 8 | + |
| 9 | + for &scale in &[1, 2, 4] { |
| 10 | + if scaled(full_size.width, scale) >= requested_size.width || scaled(full_size.height, scale) >= requested_size.height { |
| 11 | + return scale; |
| 12 | + } |
| 13 | + } |
| 14 | + |
| 15 | + return 8; |
| 16 | +} |
| 17 | + |
| 18 | +#[test] |
| 19 | +fn test_choose_idct_size() { |
| 20 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 200, height: 200}), 1); |
| 21 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 500, height: 500}), 1); |
| 22 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 684, height: 456}), 1); |
| 23 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 999, height: 456}), 1); |
| 24 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 684, height: 999}), 1); |
| 25 | + assert_eq!(choose_idct_size(Dimensions{width: 500, height: 333}, Dimensions{width: 63, height: 42}), 1); |
| 26 | + |
| 27 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 685, height: 999}), 2); |
| 28 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 1000, height: 1000}), 2); |
| 29 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 1400, height: 1400}), 4); |
| 30 | + |
| 31 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 5472, height: 3648}), 8); |
| 32 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 16384, height: 16384}), 8); |
| 33 | + assert_eq!(choose_idct_size(Dimensions{width: 1, height: 1}, Dimensions{width: 65535, height: 65535}), 8); |
| 34 | + assert_eq!(choose_idct_size(Dimensions{width: 5472, height: 3648}, Dimensions{width: 16384, height: 16384}), 8); |
| 35 | +} |
| 36 | + |
| 37 | +pub fn dequantize_and_idct_block(scale: usize, coefficients: &[i16], quantization_table: &[u16; 64], output_linestride: usize, output: &mut [u8]) { |
| 38 | + match scale { |
| 39 | + 8 => dequantize_and_idct_block_8x8(coefficients, quantization_table, output_linestride, output), |
| 40 | + 4 => dequantize_and_idct_block_4x4(coefficients, quantization_table, output_linestride, output), |
| 41 | + 2 => dequantize_and_idct_block_2x2(coefficients, quantization_table, output_linestride, output), |
| 42 | + 1 => dequantize_and_idct_block_1x1(coefficients, quantization_table, output_linestride, output), |
| 43 | + _ => panic!("Unsupported IDCT scale {}/8", scale), |
| 44 | + } |
| 45 | +} |
4 | 46 |
|
5 | 47 | // This is based on stb_image's 'stbi__idct_block'.
|
6 |
| -pub fn dequantize_and_idct_block_8x8(coefficients: &[i16], quantization_table: &[u16; 64], output_linestride: usize, output: &mut [u8]) { |
| 48 | +fn dequantize_and_idct_block_8x8(coefficients: &[i16], quantization_table: &[u16; 64], output_linestride: usize, output: &mut [u8]) { |
7 | 49 | debug_assert_eq!(coefficients.len(), 64);
|
8 | 50 |
|
9 | 51 | let mut temp = [0i32; 64];
|
@@ -157,7 +199,7 @@ pub fn dequantize_and_idct_block_8x8(coefficients: &[i16], quantization_table: &
|
157 | 199 |
|
158 | 200 | // 4x4 and 2x2 IDCT based on Rakesh Dugad and Narendra Ahuja: "A Fast Scheme for Image Size Change in the Compressed Domain" (2001).
|
159 | 201 | // http://sylvana.net/jpegcrop/jidctred/
|
160 |
| -pub fn dequantize_and_idct_block_4x4(coefficients: &[i16], quantization_table: &[u16; 64], output_linestride: usize, output: &mut [u8]) { |
| 202 | +fn dequantize_and_idct_block_4x4(coefficients: &[i16], quantization_table: &[u16; 64], output_linestride: usize, output: &mut [u8]) { |
161 | 203 | debug_assert_eq!(coefficients.len(), 64);
|
162 | 204 | let mut temp = [0i32; 4*4];
|
163 | 205 |
|
@@ -214,7 +256,7 @@ pub fn dequantize_and_idct_block_4x4(coefficients: &[i16], quantization_table: &
|
214 | 256 | }
|
215 | 257 | }
|
216 | 258 |
|
217 |
| -pub fn dequantize_and_idct_block_2x2(coefficients: &[i16], quantization_table: &[u16; 64], output_linestride: usize, output: &mut [u8]) { |
| 259 | +fn dequantize_and_idct_block_2x2(coefficients: &[i16], quantization_table: &[u16; 64], output_linestride: usize, output: &mut [u8]) { |
218 | 260 | debug_assert_eq!(coefficients.len(), 64);
|
219 | 261 |
|
220 | 262 | const SCALE_BITS: u32 = 3;
|
@@ -245,7 +287,7 @@ pub fn dequantize_and_idct_block_2x2(coefficients: &[i16], quantization_table: &
|
245 | 287 | output[output_linestride + 1] = stbi_clamp(x2.wrapping_sub(x3).wrapping_shr(SCALE_BITS));
|
246 | 288 | }
|
247 | 289 |
|
248 |
| -pub fn dequantize_and_idct_block_1x1(coefficients: &[i16], quantization_table: &[u16; 64], _output_linestride: usize, output: &mut [u8]) { |
| 290 | +fn dequantize_and_idct_block_1x1(coefficients: &[i16], quantization_table: &[u16; 64], _output_linestride: usize, output: &mut [u8]) { |
249 | 291 | debug_assert_eq!(coefficients.len(), 64);
|
250 | 292 |
|
251 | 293 | let s0 = (coefficients[0] as i32 * quantization_table[0] as i32).wrapping_add(128 * 8) / 8;
|
|
0 commit comments