• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * WebP (.webp) image decoder
3  * Copyright (c) 2013 Aneesh Dogra <aneesh@sugarlabs.org>
4  * Copyright (c) 2013 Justin Ruggles <justin.ruggles@gmail.com>
5  *
6  * This file is part of FFmpeg.
7  *
8  * FFmpeg is free software; you can redistribute it and/or
9  * modify it under the terms of the GNU Lesser General Public
10  * License as published by the Free Software Foundation; either
11  * version 2.1 of the License, or (at your option) any later version.
12  *
13  * FFmpeg is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16  * Lesser General Public License for more details.
17  *
18  * You should have received a copy of the GNU Lesser General Public
19  * License along with FFmpeg; if not, write to the Free Software
20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
21  */
22 
23 /**
24  * @file
25  * WebP image decoder
26  *
27  * @author Aneesh Dogra <aneesh@sugarlabs.org>
28  * Container and Lossy decoding
29  *
30  * @author Justin Ruggles <justin.ruggles@gmail.com>
31  * Lossless decoder
32  * Compressed alpha for lossy
33  *
34  * @author James Almer <jamrial@gmail.com>
35  * Exif metadata
36  * ICC profile
37  *
38  * Unimplemented:
39  *   - Animation
40  *   - XMP metadata
41  */
42 
43 #include "libavutil/imgutils.h"
44 
45 #define BITSTREAM_READER_LE
46 #include "avcodec.h"
47 #include "bytestream.h"
48 #include "exif.h"
49 #include "get_bits.h"
50 #include "internal.h"
51 #include "thread.h"
52 #include "vp8.h"
53 
54 #define VP8X_FLAG_ANIMATION             0x02
55 #define VP8X_FLAG_XMP_METADATA          0x04
56 #define VP8X_FLAG_EXIF_METADATA         0x08
57 #define VP8X_FLAG_ALPHA                 0x10
58 #define VP8X_FLAG_ICC                   0x20
59 
60 #define MAX_PALETTE_SIZE                256
61 #define MAX_CACHE_BITS                  11
62 #define NUM_CODE_LENGTH_CODES           19
63 #define HUFFMAN_CODES_PER_META_CODE     5
64 #define NUM_LITERAL_CODES               256
65 #define NUM_LENGTH_CODES                24
66 #define NUM_DISTANCE_CODES              40
67 #define NUM_SHORT_DISTANCES             120
68 #define MAX_HUFFMAN_CODE_LENGTH         15
69 
70 static const uint16_t alphabet_sizes[HUFFMAN_CODES_PER_META_CODE] = {
71     NUM_LITERAL_CODES + NUM_LENGTH_CODES,
72     NUM_LITERAL_CODES, NUM_LITERAL_CODES, NUM_LITERAL_CODES,
73     NUM_DISTANCE_CODES
74 };
75 
76 static const uint8_t code_length_code_order[NUM_CODE_LENGTH_CODES] = {
77     17, 18, 0, 1, 2, 3, 4, 5, 16, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
78 };
79 
80 static const int8_t lz77_distance_offsets[NUM_SHORT_DISTANCES][2] = {
81     {  0, 1 }, {  1, 0 }, {  1, 1 }, { -1, 1 }, {  0, 2 }, {  2, 0 }, {  1, 2 }, { -1, 2 },
82     {  2, 1 }, { -2, 1 }, {  2, 2 }, { -2, 2 }, {  0, 3 }, {  3, 0 }, {  1, 3 }, { -1, 3 },
83     {  3, 1 }, { -3, 1 }, {  2, 3 }, { -2, 3 }, {  3, 2 }, { -3, 2 }, {  0, 4 }, {  4, 0 },
84     {  1, 4 }, { -1, 4 }, {  4, 1 }, { -4, 1 }, {  3, 3 }, { -3, 3 }, {  2, 4 }, { -2, 4 },
85     {  4, 2 }, { -4, 2 }, {  0, 5 }, {  3, 4 }, { -3, 4 }, {  4, 3 }, { -4, 3 }, {  5, 0 },
86     {  1, 5 }, { -1, 5 }, {  5, 1 }, { -5, 1 }, {  2, 5 }, { -2, 5 }, {  5, 2 }, { -5, 2 },
87     {  4, 4 }, { -4, 4 }, {  3, 5 }, { -3, 5 }, {  5, 3 }, { -5, 3 }, {  0, 6 }, {  6, 0 },
88     {  1, 6 }, { -1, 6 }, {  6, 1 }, { -6, 1 }, {  2, 6 }, { -2, 6 }, {  6, 2 }, { -6, 2 },
89     {  4, 5 }, { -4, 5 }, {  5, 4 }, { -5, 4 }, {  3, 6 }, { -3, 6 }, {  6, 3 }, { -6, 3 },
90     {  0, 7 }, {  7, 0 }, {  1, 7 }, { -1, 7 }, {  5, 5 }, { -5, 5 }, {  7, 1 }, { -7, 1 },
91     {  4, 6 }, { -4, 6 }, {  6, 4 }, { -6, 4 }, {  2, 7 }, { -2, 7 }, {  7, 2 }, { -7, 2 },
92     {  3, 7 }, { -3, 7 }, {  7, 3 }, { -7, 3 }, {  5, 6 }, { -5, 6 }, {  6, 5 }, { -6, 5 },
93     {  8, 0 }, {  4, 7 }, { -4, 7 }, {  7, 4 }, { -7, 4 }, {  8, 1 }, {  8, 2 }, {  6, 6 },
94     { -6, 6 }, {  8, 3 }, {  5, 7 }, { -5, 7 }, {  7, 5 }, { -7, 5 }, {  8, 4 }, {  6, 7 },
95     { -6, 7 }, {  7, 6 }, { -7, 6 }, {  8, 5 }, {  7, 7 }, { -7, 7 }, {  8, 6 }, {  8, 7 }
96 };
97 
98 enum AlphaCompression {
99     ALPHA_COMPRESSION_NONE,
100     ALPHA_COMPRESSION_VP8L,
101 };
102 
103 enum AlphaFilter {
104     ALPHA_FILTER_NONE,
105     ALPHA_FILTER_HORIZONTAL,
106     ALPHA_FILTER_VERTICAL,
107     ALPHA_FILTER_GRADIENT,
108 };
109 
110 enum TransformType {
111     PREDICTOR_TRANSFORM      = 0,
112     COLOR_TRANSFORM          = 1,
113     SUBTRACT_GREEN           = 2,
114     COLOR_INDEXING_TRANSFORM = 3,
115 };
116 
117 enum PredictionMode {
118     PRED_MODE_BLACK,
119     PRED_MODE_L,
120     PRED_MODE_T,
121     PRED_MODE_TR,
122     PRED_MODE_TL,
123     PRED_MODE_AVG_T_AVG_L_TR,
124     PRED_MODE_AVG_L_TL,
125     PRED_MODE_AVG_L_T,
126     PRED_MODE_AVG_TL_T,
127     PRED_MODE_AVG_T_TR,
128     PRED_MODE_AVG_AVG_L_TL_AVG_T_TR,
129     PRED_MODE_SELECT,
130     PRED_MODE_ADD_SUBTRACT_FULL,
131     PRED_MODE_ADD_SUBTRACT_HALF,
132 };
133 
134 enum HuffmanIndex {
135     HUFF_IDX_GREEN = 0,
136     HUFF_IDX_RED   = 1,
137     HUFF_IDX_BLUE  = 2,
138     HUFF_IDX_ALPHA = 3,
139     HUFF_IDX_DIST  = 4
140 };
141 
142 /* The structure of WebP lossless is an optional series of transformation data,
143  * followed by the primary image. The primary image also optionally contains
144  * an entropy group mapping if there are multiple entropy groups. There is a
145  * basic image type called an "entropy coded image" that is used for all of
146  * these. The type of each entropy coded image is referred to by the
147  * specification as its role. */
148 enum ImageRole {
149     /* Primary Image: Stores the actual pixels of the image. */
150     IMAGE_ROLE_ARGB,
151 
152     /* Entropy Image: Defines which Huffman group to use for different areas of
153      *                the primary image. */
154     IMAGE_ROLE_ENTROPY,
155 
156     /* Predictors: Defines which predictor type to use for different areas of
157      *             the primary image. */
158     IMAGE_ROLE_PREDICTOR,
159 
160     /* Color Transform Data: Defines the color transformation for different
161      *                       areas of the primary image. */
162     IMAGE_ROLE_COLOR_TRANSFORM,
163 
164     /* Color Index: Stored as an image of height == 1. */
165     IMAGE_ROLE_COLOR_INDEXING,
166 
167     IMAGE_ROLE_NB,
168 };
169 
170 typedef struct HuffReader {
171     VLC vlc;                            /* Huffman decoder context */
172     int simple;                         /* whether to use simple mode */
173     int nb_symbols;                     /* number of coded symbols */
174     uint16_t simple_symbols[2];         /* symbols for simple mode */
175 } HuffReader;
176 
177 typedef struct ImageContext {
178     enum ImageRole role;                /* role of this image */
179     AVFrame *frame;                     /* AVFrame for data */
180     int color_cache_bits;               /* color cache size, log2 */
181     uint32_t *color_cache;              /* color cache data */
182     int nb_huffman_groups;              /* number of huffman groups */
183     HuffReader *huffman_groups;         /* reader for each huffman group */
184     int size_reduction;                 /* relative size compared to primary image, log2 */
185     int is_alpha_primary;
186 } ImageContext;
187 
188 typedef struct WebPContext {
189     VP8Context v;                       /* VP8 Context used for lossy decoding */
190     GetBitContext gb;                   /* bitstream reader for main image chunk */
191     AVFrame *alpha_frame;               /* AVFrame for alpha data decompressed from VP8L */
192     AVPacket *pkt;                      /* AVPacket to be passed to the underlying VP8 decoder */
193     AVCodecContext *avctx;              /* parent AVCodecContext */
194     int initialized;                    /* set once the VP8 context is initialized */
195     int has_alpha;                      /* has a separate alpha chunk */
196     enum AlphaCompression alpha_compression; /* compression type for alpha chunk */
197     enum AlphaFilter alpha_filter;      /* filtering method for alpha chunk */
198     uint8_t *alpha_data;                /* alpha chunk data */
199     int alpha_data_size;                /* alpha chunk data size */
200     int has_exif;                       /* set after an EXIF chunk has been processed */
201     int has_iccp;                       /* set after an ICCP chunk has been processed */
202     int width;                          /* image width */
203     int height;                         /* image height */
204     int lossless;                       /* indicates lossless or lossy */
205 
206     int nb_transforms;                  /* number of transforms */
207     enum TransformType transforms[4];   /* transformations used in the image, in order */
208     int reduced_width;                  /* reduced width for index image, if applicable */
209     int nb_huffman_groups;              /* number of huffman groups in the primary image */
210     ImageContext image[IMAGE_ROLE_NB];  /* image context for each role */
211 } WebPContext;
212 
213 #define GET_PIXEL(frame, x, y) \
214     ((frame)->data[0] + (y) * frame->linesize[0] + 4 * (x))
215 
216 #define GET_PIXEL_COMP(frame, x, y, c) \
217     (*((frame)->data[0] + (y) * frame->linesize[0] + 4 * (x) + c))
218 
image_ctx_free(ImageContext * img)219 static void image_ctx_free(ImageContext *img)
220 {
221     int i, j;
222 
223     av_free(img->color_cache);
224     if (img->role != IMAGE_ROLE_ARGB && !img->is_alpha_primary)
225         av_frame_free(&img->frame);
226     if (img->huffman_groups) {
227         for (i = 0; i < img->nb_huffman_groups; i++) {
228             for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; j++)
229                 ff_free_vlc(&img->huffman_groups[i * HUFFMAN_CODES_PER_META_CODE + j].vlc);
230         }
231         av_free(img->huffman_groups);
232     }
233     memset(img, 0, sizeof(*img));
234 }
235 
huff_reader_get_symbol(HuffReader * r,GetBitContext * gb)236 static int huff_reader_get_symbol(HuffReader *r, GetBitContext *gb)
237 {
238     if (r->simple) {
239         if (r->nb_symbols == 1)
240             return r->simple_symbols[0];
241         else
242             return r->simple_symbols[get_bits1(gb)];
243     } else
244         return get_vlc2(gb, r->vlc.table, 8, 2);
245 }
246 
huff_reader_build_canonical(HuffReader * r,const uint8_t * code_lengths,int alphabet_size)247 static int huff_reader_build_canonical(HuffReader *r, const uint8_t *code_lengths,
248                                        int alphabet_size)
249 {
250     int len = 0, sym, code = 0, ret;
251     int max_code_length = 0;
252     uint16_t *codes;
253 
254     /* special-case 1 symbol since the vlc reader cannot handle it */
255     for (sym = 0; sym < alphabet_size; sym++) {
256         if (code_lengths[sym] > 0) {
257             len++;
258             code = sym;
259             if (len > 1)
260                 break;
261         }
262     }
263     if (len == 1) {
264         r->nb_symbols = 1;
265         r->simple_symbols[0] = code;
266         r->simple = 1;
267         return 0;
268     }
269 
270     for (sym = 0; sym < alphabet_size; sym++)
271         max_code_length = FFMAX(max_code_length, code_lengths[sym]);
272 
273     if (max_code_length == 0 || max_code_length > MAX_HUFFMAN_CODE_LENGTH)
274         return AVERROR(EINVAL);
275 
276     codes = av_malloc_array(alphabet_size, sizeof(*codes));
277     if (!codes)
278         return AVERROR(ENOMEM);
279 
280     code = 0;
281     r->nb_symbols = 0;
282     for (len = 1; len <= max_code_length; len++) {
283         for (sym = 0; sym < alphabet_size; sym++) {
284             if (code_lengths[sym] != len)
285                 continue;
286             codes[sym] = code++;
287             r->nb_symbols++;
288         }
289         code <<= 1;
290     }
291     if (!r->nb_symbols) {
292         av_free(codes);
293         return AVERROR_INVALIDDATA;
294     }
295 
296     ret = init_vlc(&r->vlc, 8, alphabet_size,
297                    code_lengths, sizeof(*code_lengths), sizeof(*code_lengths),
298                    codes, sizeof(*codes), sizeof(*codes), INIT_VLC_OUTPUT_LE);
299     if (ret < 0) {
300         av_free(codes);
301         return ret;
302     }
303     r->simple = 0;
304 
305     av_free(codes);
306     return 0;
307 }
308 
read_huffman_code_simple(WebPContext * s,HuffReader * hc)309 static void read_huffman_code_simple(WebPContext *s, HuffReader *hc)
310 {
311     hc->nb_symbols = get_bits1(&s->gb) + 1;
312 
313     if (get_bits1(&s->gb))
314         hc->simple_symbols[0] = get_bits(&s->gb, 8);
315     else
316         hc->simple_symbols[0] = get_bits1(&s->gb);
317 
318     if (hc->nb_symbols == 2)
319         hc->simple_symbols[1] = get_bits(&s->gb, 8);
320 
321     hc->simple = 1;
322 }
323 
read_huffman_code_normal(WebPContext * s,HuffReader * hc,int alphabet_size)324 static int read_huffman_code_normal(WebPContext *s, HuffReader *hc,
325                                     int alphabet_size)
326 {
327     HuffReader code_len_hc = { { 0 }, 0, 0, { 0 } };
328     uint8_t *code_lengths;
329     uint8_t code_length_code_lengths[NUM_CODE_LENGTH_CODES] = { 0 };
330     int i, symbol, max_symbol, prev_code_len, ret;
331     int num_codes = 4 + get_bits(&s->gb, 4);
332 
333     av_assert1(num_codes <= NUM_CODE_LENGTH_CODES);
334 
335     for (i = 0; i < num_codes; i++)
336         code_length_code_lengths[code_length_code_order[i]] = get_bits(&s->gb, 3);
337 
338     ret = huff_reader_build_canonical(&code_len_hc, code_length_code_lengths,
339                                       NUM_CODE_LENGTH_CODES);
340     if (ret < 0)
341         return ret;
342 
343     code_lengths = av_mallocz(alphabet_size);
344     if (!code_lengths) {
345         ret = AVERROR(ENOMEM);
346         goto finish;
347     }
348 
349     if (get_bits1(&s->gb)) {
350         int bits   = 2 + 2 * get_bits(&s->gb, 3);
351         max_symbol = 2 + get_bits(&s->gb, bits);
352         if (max_symbol > alphabet_size) {
353             av_log(s->avctx, AV_LOG_ERROR, "max symbol %d > alphabet size %d\n",
354                    max_symbol, alphabet_size);
355             ret = AVERROR_INVALIDDATA;
356             goto finish;
357         }
358     } else {
359         max_symbol = alphabet_size;
360     }
361 
362     prev_code_len = 8;
363     symbol        = 0;
364     while (symbol < alphabet_size) {
365         int code_len;
366 
367         if (!max_symbol--)
368             break;
369         code_len = huff_reader_get_symbol(&code_len_hc, &s->gb);
370         if (code_len < 16) {
371             /* Code length code [0..15] indicates literal code lengths. */
372             code_lengths[symbol++] = code_len;
373             if (code_len)
374                 prev_code_len = code_len;
375         } else {
376             int repeat = 0, length = 0;
377             switch (code_len) {
378             case 16:
379                 /* Code 16 repeats the previous non-zero value [3..6] times,
380                  * i.e., 3 + ReadBits(2) times. If code 16 is used before a
381                  * non-zero value has been emitted, a value of 8 is repeated. */
382                 repeat = 3 + get_bits(&s->gb, 2);
383                 length = prev_code_len;
384                 break;
385             case 17:
386                 /* Code 17 emits a streak of zeros [3..10], i.e.,
387                  * 3 + ReadBits(3) times. */
388                 repeat = 3 + get_bits(&s->gb, 3);
389                 break;
390             case 18:
391                 /* Code 18 emits a streak of zeros of length [11..138], i.e.,
392                  * 11 + ReadBits(7) times. */
393                 repeat = 11 + get_bits(&s->gb, 7);
394                 break;
395             }
396             if (symbol + repeat > alphabet_size) {
397                 av_log(s->avctx, AV_LOG_ERROR,
398                        "invalid symbol %d + repeat %d > alphabet size %d\n",
399                        symbol, repeat, alphabet_size);
400                 ret = AVERROR_INVALIDDATA;
401                 goto finish;
402             }
403             while (repeat-- > 0)
404                 code_lengths[symbol++] = length;
405         }
406     }
407 
408     ret = huff_reader_build_canonical(hc, code_lengths, alphabet_size);
409 
410 finish:
411     ff_free_vlc(&code_len_hc.vlc);
412     av_free(code_lengths);
413     return ret;
414 }
415 
416 static int decode_entropy_coded_image(WebPContext *s, enum ImageRole role,
417                                       int w, int h);
418 
419 #define PARSE_BLOCK_SIZE(w, h) do {                                         \
420     block_bits = get_bits(&s->gb, 3) + 2;                                   \
421     blocks_w   = FFALIGN((w), 1 << block_bits) >> block_bits;               \
422     blocks_h   = FFALIGN((h), 1 << block_bits) >> block_bits;               \
423 } while (0)
424 
decode_entropy_image(WebPContext * s)425 static int decode_entropy_image(WebPContext *s)
426 {
427     ImageContext *img;
428     int ret, block_bits, width, blocks_w, blocks_h, x, y, max;
429 
430     width = s->width;
431     if (s->reduced_width > 0)
432         width = s->reduced_width;
433 
434     PARSE_BLOCK_SIZE(width, s->height);
435 
436     ret = decode_entropy_coded_image(s, IMAGE_ROLE_ENTROPY, blocks_w, blocks_h);
437     if (ret < 0)
438         return ret;
439 
440     img = &s->image[IMAGE_ROLE_ENTROPY];
441     img->size_reduction = block_bits;
442 
443     /* the number of huffman groups is determined by the maximum group number
444      * coded in the entropy image */
445     max = 0;
446     for (y = 0; y < img->frame->height; y++) {
447         for (x = 0; x < img->frame->width; x++) {
448             int p0 = GET_PIXEL_COMP(img->frame, x, y, 1);
449             int p1 = GET_PIXEL_COMP(img->frame, x, y, 2);
450             int p  = p0 << 8 | p1;
451             max = FFMAX(max, p);
452         }
453     }
454     s->nb_huffman_groups = max + 1;
455 
456     return 0;
457 }
458 
parse_transform_predictor(WebPContext * s)459 static int parse_transform_predictor(WebPContext *s)
460 {
461     int block_bits, blocks_w, blocks_h, ret;
462 
463     PARSE_BLOCK_SIZE(s->width, s->height);
464 
465     ret = decode_entropy_coded_image(s, IMAGE_ROLE_PREDICTOR, blocks_w,
466                                      blocks_h);
467     if (ret < 0)
468         return ret;
469 
470     s->image[IMAGE_ROLE_PREDICTOR].size_reduction = block_bits;
471 
472     return 0;
473 }
474 
parse_transform_color(WebPContext * s)475 static int parse_transform_color(WebPContext *s)
476 {
477     int block_bits, blocks_w, blocks_h, ret;
478 
479     PARSE_BLOCK_SIZE(s->width, s->height);
480 
481     ret = decode_entropy_coded_image(s, IMAGE_ROLE_COLOR_TRANSFORM, blocks_w,
482                                      blocks_h);
483     if (ret < 0)
484         return ret;
485 
486     s->image[IMAGE_ROLE_COLOR_TRANSFORM].size_reduction = block_bits;
487 
488     return 0;
489 }
490 
parse_transform_color_indexing(WebPContext * s)491 static int parse_transform_color_indexing(WebPContext *s)
492 {
493     ImageContext *img;
494     int width_bits, index_size, ret, x;
495     uint8_t *ct;
496 
497     index_size = get_bits(&s->gb, 8) + 1;
498 
499     if (index_size <= 2)
500         width_bits = 3;
501     else if (index_size <= 4)
502         width_bits = 2;
503     else if (index_size <= 16)
504         width_bits = 1;
505     else
506         width_bits = 0;
507 
508     ret = decode_entropy_coded_image(s, IMAGE_ROLE_COLOR_INDEXING,
509                                      index_size, 1);
510     if (ret < 0)
511         return ret;
512 
513     img = &s->image[IMAGE_ROLE_COLOR_INDEXING];
514     img->size_reduction = width_bits;
515     if (width_bits > 0)
516         s->reduced_width = (s->width + ((1 << width_bits) - 1)) >> width_bits;
517 
518     /* color index values are delta-coded */
519     ct  = img->frame->data[0] + 4;
520     for (x = 4; x < img->frame->width * 4; x++, ct++)
521         ct[0] += ct[-4];
522 
523     return 0;
524 }
525 
get_huffman_group(WebPContext * s,ImageContext * img,int x,int y)526 static HuffReader *get_huffman_group(WebPContext *s, ImageContext *img,
527                                      int x, int y)
528 {
529     ImageContext *gimg = &s->image[IMAGE_ROLE_ENTROPY];
530     int group = 0;
531 
532     if (gimg->size_reduction > 0) {
533         int group_x = x >> gimg->size_reduction;
534         int group_y = y >> gimg->size_reduction;
535         int g0      = GET_PIXEL_COMP(gimg->frame, group_x, group_y, 1);
536         int g1      = GET_PIXEL_COMP(gimg->frame, group_x, group_y, 2);
537         group       = g0 << 8 | g1;
538     }
539 
540     return &img->huffman_groups[group * HUFFMAN_CODES_PER_META_CODE];
541 }
542 
color_cache_put(ImageContext * img,uint32_t c)543 static av_always_inline void color_cache_put(ImageContext *img, uint32_t c)
544 {
545     uint32_t cache_idx = (0x1E35A7BD * c) >> (32 - img->color_cache_bits);
546     img->color_cache[cache_idx] = c;
547 }
548 
decode_entropy_coded_image(WebPContext * s,enum ImageRole role,int w,int h)549 static int decode_entropy_coded_image(WebPContext *s, enum ImageRole role,
550                                       int w, int h)
551 {
552     ImageContext *img;
553     HuffReader *hg;
554     int i, j, ret, x, y, width;
555 
556     img       = &s->image[role];
557     img->role = role;
558 
559     if (!img->frame) {
560         img->frame = av_frame_alloc();
561         if (!img->frame)
562             return AVERROR(ENOMEM);
563     }
564 
565     img->frame->format = AV_PIX_FMT_ARGB;
566     img->frame->width  = w;
567     img->frame->height = h;
568 
569     if (role == IMAGE_ROLE_ARGB && !img->is_alpha_primary) {
570         ThreadFrame pt = { .f = img->frame };
571         ret = ff_thread_get_buffer(s->avctx, &pt, 0);
572     } else
573         ret = av_frame_get_buffer(img->frame, 1);
574     if (ret < 0)
575         return ret;
576 
577     if (get_bits1(&s->gb)) {
578         img->color_cache_bits = get_bits(&s->gb, 4);
579         if (img->color_cache_bits < 1 || img->color_cache_bits > 11) {
580             av_log(s->avctx, AV_LOG_ERROR, "invalid color cache bits: %d\n",
581                    img->color_cache_bits);
582             return AVERROR_INVALIDDATA;
583         }
584         img->color_cache = av_mallocz_array(1 << img->color_cache_bits,
585                                             sizeof(*img->color_cache));
586         if (!img->color_cache)
587             return AVERROR(ENOMEM);
588     } else {
589         img->color_cache_bits = 0;
590     }
591 
592     img->nb_huffman_groups = 1;
593     if (role == IMAGE_ROLE_ARGB && get_bits1(&s->gb)) {
594         ret = decode_entropy_image(s);
595         if (ret < 0)
596             return ret;
597         img->nb_huffman_groups = s->nb_huffman_groups;
598     }
599     img->huffman_groups = av_mallocz_array(img->nb_huffman_groups *
600                                            HUFFMAN_CODES_PER_META_CODE,
601                                            sizeof(*img->huffman_groups));
602     if (!img->huffman_groups)
603         return AVERROR(ENOMEM);
604 
605     for (i = 0; i < img->nb_huffman_groups; i++) {
606         hg = &img->huffman_groups[i * HUFFMAN_CODES_PER_META_CODE];
607         for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; j++) {
608             int alphabet_size = alphabet_sizes[j];
609             if (!j && img->color_cache_bits > 0)
610                 alphabet_size += 1 << img->color_cache_bits;
611 
612             if (get_bits1(&s->gb)) {
613                 read_huffman_code_simple(s, &hg[j]);
614             } else {
615                 ret = read_huffman_code_normal(s, &hg[j], alphabet_size);
616                 if (ret < 0)
617                     return ret;
618             }
619         }
620     }
621 
622     width = img->frame->width;
623     if (role == IMAGE_ROLE_ARGB && s->reduced_width > 0)
624         width = s->reduced_width;
625 
626     x = 0; y = 0;
627     while (y < img->frame->height) {
628         int v;
629 
630         if (get_bits_left(&s->gb) < 0)
631             return AVERROR_INVALIDDATA;
632 
633         hg = get_huffman_group(s, img, x, y);
634         v = huff_reader_get_symbol(&hg[HUFF_IDX_GREEN], &s->gb);
635         if (v < NUM_LITERAL_CODES) {
636             /* literal pixel values */
637             uint8_t *p = GET_PIXEL(img->frame, x, y);
638             p[2] = v;
639             p[1] = huff_reader_get_symbol(&hg[HUFF_IDX_RED],   &s->gb);
640             p[3] = huff_reader_get_symbol(&hg[HUFF_IDX_BLUE],  &s->gb);
641             p[0] = huff_reader_get_symbol(&hg[HUFF_IDX_ALPHA], &s->gb);
642             if (img->color_cache_bits)
643                 color_cache_put(img, AV_RB32(p));
644             x++;
645             if (x == width) {
646                 x = 0;
647                 y++;
648             }
649         } else if (v < NUM_LITERAL_CODES + NUM_LENGTH_CODES) {
650             /* LZ77 backwards mapping */
651             int prefix_code, length, distance, ref_x, ref_y;
652 
653             /* parse length and distance */
654             prefix_code = v - NUM_LITERAL_CODES;
655             if (prefix_code < 4) {
656                 length = prefix_code + 1;
657             } else {
658                 int extra_bits = (prefix_code - 2) >> 1;
659                 int offset     = 2 + (prefix_code & 1) << extra_bits;
660                 length = offset + get_bits(&s->gb, extra_bits) + 1;
661             }
662             prefix_code = huff_reader_get_symbol(&hg[HUFF_IDX_DIST], &s->gb);
663             if (prefix_code > 39U) {
664                 av_log(s->avctx, AV_LOG_ERROR,
665                        "distance prefix code too large: %d\n", prefix_code);
666                 return AVERROR_INVALIDDATA;
667             }
668             if (prefix_code < 4) {
669                 distance = prefix_code + 1;
670             } else {
671                 int extra_bits = prefix_code - 2 >> 1;
672                 int offset     = 2 + (prefix_code & 1) << extra_bits;
673                 distance = offset + get_bits(&s->gb, extra_bits) + 1;
674             }
675 
676             /* find reference location */
677             if (distance <= NUM_SHORT_DISTANCES) {
678                 int xi = lz77_distance_offsets[distance - 1][0];
679                 int yi = lz77_distance_offsets[distance - 1][1];
680                 distance = FFMAX(1, xi + yi * width);
681             } else {
682                 distance -= NUM_SHORT_DISTANCES;
683             }
684             ref_x = x;
685             ref_y = y;
686             if (distance <= x) {
687                 ref_x -= distance;
688                 distance = 0;
689             } else {
690                 ref_x = 0;
691                 distance -= x;
692             }
693             while (distance >= width) {
694                 ref_y--;
695                 distance -= width;
696             }
697             if (distance > 0) {
698                 ref_x = width - distance;
699                 ref_y--;
700             }
701             ref_x = FFMAX(0, ref_x);
702             ref_y = FFMAX(0, ref_y);
703 
704             /* copy pixels
705              * source and dest regions can overlap and wrap lines, so just
706              * copy per-pixel */
707             for (i = 0; i < length; i++) {
708                 uint8_t *p_ref = GET_PIXEL(img->frame, ref_x, ref_y);
709                 uint8_t *p     = GET_PIXEL(img->frame,     x,     y);
710 
711                 AV_COPY32(p, p_ref);
712                 if (img->color_cache_bits)
713                     color_cache_put(img, AV_RB32(p));
714                 x++;
715                 ref_x++;
716                 if (x == width) {
717                     x = 0;
718                     y++;
719                 }
720                 if (ref_x == width) {
721                     ref_x = 0;
722                     ref_y++;
723                 }
724                 if (y == img->frame->height || ref_y == img->frame->height)
725                     break;
726             }
727         } else {
728             /* read from color cache */
729             uint8_t *p = GET_PIXEL(img->frame, x, y);
730             int cache_idx = v - (NUM_LITERAL_CODES + NUM_LENGTH_CODES);
731 
732             if (!img->color_cache_bits) {
733                 av_log(s->avctx, AV_LOG_ERROR, "color cache not found\n");
734                 return AVERROR_INVALIDDATA;
735             }
736             if (cache_idx >= 1 << img->color_cache_bits) {
737                 av_log(s->avctx, AV_LOG_ERROR,
738                        "color cache index out-of-bounds\n");
739                 return AVERROR_INVALIDDATA;
740             }
741             AV_WB32(p, img->color_cache[cache_idx]);
742             x++;
743             if (x == width) {
744                 x = 0;
745                 y++;
746             }
747         }
748     }
749 
750     return 0;
751 }
752 
753 /* PRED_MODE_BLACK */
inv_predict_0(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)754 static void inv_predict_0(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
755                           const uint8_t *p_t, const uint8_t *p_tr)
756 {
757     AV_WB32(p, 0xFF000000);
758 }
759 
760 /* PRED_MODE_L */
inv_predict_1(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)761 static void inv_predict_1(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
762                           const uint8_t *p_t, const uint8_t *p_tr)
763 {
764     AV_COPY32(p, p_l);
765 }
766 
767 /* PRED_MODE_T */
inv_predict_2(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)768 static void inv_predict_2(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
769                           const uint8_t *p_t, const uint8_t *p_tr)
770 {
771     AV_COPY32(p, p_t);
772 }
773 
774 /* PRED_MODE_TR */
inv_predict_3(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)775 static void inv_predict_3(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
776                           const uint8_t *p_t, const uint8_t *p_tr)
777 {
778     AV_COPY32(p, p_tr);
779 }
780 
781 /* PRED_MODE_TL */
inv_predict_4(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)782 static void inv_predict_4(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
783                           const uint8_t *p_t, const uint8_t *p_tr)
784 {
785     AV_COPY32(p, p_tl);
786 }
787 
788 /* PRED_MODE_AVG_T_AVG_L_TR */
inv_predict_5(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)789 static void inv_predict_5(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
790                           const uint8_t *p_t, const uint8_t *p_tr)
791 {
792     p[0] = p_t[0] + (p_l[0] + p_tr[0] >> 1) >> 1;
793     p[1] = p_t[1] + (p_l[1] + p_tr[1] >> 1) >> 1;
794     p[2] = p_t[2] + (p_l[2] + p_tr[2] >> 1) >> 1;
795     p[3] = p_t[3] + (p_l[3] + p_tr[3] >> 1) >> 1;
796 }
797 
798 /* PRED_MODE_AVG_L_TL */
inv_predict_6(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)799 static void inv_predict_6(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
800                           const uint8_t *p_t, const uint8_t *p_tr)
801 {
802     p[0] = p_l[0] + p_tl[0] >> 1;
803     p[1] = p_l[1] + p_tl[1] >> 1;
804     p[2] = p_l[2] + p_tl[2] >> 1;
805     p[3] = p_l[3] + p_tl[3] >> 1;
806 }
807 
808 /* PRED_MODE_AVG_L_T */
inv_predict_7(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)809 static void inv_predict_7(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
810                           const uint8_t *p_t, const uint8_t *p_tr)
811 {
812     p[0] = p_l[0] + p_t[0] >> 1;
813     p[1] = p_l[1] + p_t[1] >> 1;
814     p[2] = p_l[2] + p_t[2] >> 1;
815     p[3] = p_l[3] + p_t[3] >> 1;
816 }
817 
818 /* PRED_MODE_AVG_TL_T */
inv_predict_8(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)819 static void inv_predict_8(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
820                           const uint8_t *p_t, const uint8_t *p_tr)
821 {
822     p[0] = p_tl[0] + p_t[0] >> 1;
823     p[1] = p_tl[1] + p_t[1] >> 1;
824     p[2] = p_tl[2] + p_t[2] >> 1;
825     p[3] = p_tl[3] + p_t[3] >> 1;
826 }
827 
828 /* PRED_MODE_AVG_T_TR */
inv_predict_9(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)829 static void inv_predict_9(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
830                           const uint8_t *p_t, const uint8_t *p_tr)
831 {
832     p[0] = p_t[0] + p_tr[0] >> 1;
833     p[1] = p_t[1] + p_tr[1] >> 1;
834     p[2] = p_t[2] + p_tr[2] >> 1;
835     p[3] = p_t[3] + p_tr[3] >> 1;
836 }
837 
838 /* PRED_MODE_AVG_AVG_L_TL_AVG_T_TR */
inv_predict_10(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)839 static void inv_predict_10(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
840                            const uint8_t *p_t, const uint8_t *p_tr)
841 {
842     p[0] = (p_l[0] + p_tl[0] >> 1) + (p_t[0] + p_tr[0] >> 1) >> 1;
843     p[1] = (p_l[1] + p_tl[1] >> 1) + (p_t[1] + p_tr[1] >> 1) >> 1;
844     p[2] = (p_l[2] + p_tl[2] >> 1) + (p_t[2] + p_tr[2] >> 1) >> 1;
845     p[3] = (p_l[3] + p_tl[3] >> 1) + (p_t[3] + p_tr[3] >> 1) >> 1;
846 }
847 
848 /* PRED_MODE_SELECT */
inv_predict_11(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)849 static void inv_predict_11(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
850                            const uint8_t *p_t, const uint8_t *p_tr)
851 {
852     int diff = (FFABS(p_l[0] - p_tl[0]) - FFABS(p_t[0] - p_tl[0])) +
853                (FFABS(p_l[1] - p_tl[1]) - FFABS(p_t[1] - p_tl[1])) +
854                (FFABS(p_l[2] - p_tl[2]) - FFABS(p_t[2] - p_tl[2])) +
855                (FFABS(p_l[3] - p_tl[3]) - FFABS(p_t[3] - p_tl[3]));
856     if (diff <= 0)
857         AV_COPY32(p, p_t);
858     else
859         AV_COPY32(p, p_l);
860 }
861 
862 /* PRED_MODE_ADD_SUBTRACT_FULL */
inv_predict_12(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)863 static void inv_predict_12(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
864                            const uint8_t *p_t, const uint8_t *p_tr)
865 {
866     p[0] = av_clip_uint8(p_l[0] + p_t[0] - p_tl[0]);
867     p[1] = av_clip_uint8(p_l[1] + p_t[1] - p_tl[1]);
868     p[2] = av_clip_uint8(p_l[2] + p_t[2] - p_tl[2]);
869     p[3] = av_clip_uint8(p_l[3] + p_t[3] - p_tl[3]);
870 }
871 
clamp_add_subtract_half(int a,int b,int c)872 static av_always_inline uint8_t clamp_add_subtract_half(int a, int b, int c)
873 {
874     int d = a + b >> 1;
875     return av_clip_uint8(d + (d - c) / 2);
876 }
877 
878 /* PRED_MODE_ADD_SUBTRACT_HALF */
inv_predict_13(uint8_t * p,const uint8_t * p_l,const uint8_t * p_tl,const uint8_t * p_t,const uint8_t * p_tr)879 static void inv_predict_13(uint8_t *p, const uint8_t *p_l, const uint8_t *p_tl,
880                            const uint8_t *p_t, const uint8_t *p_tr)
881 {
882     p[0] = clamp_add_subtract_half(p_l[0], p_t[0], p_tl[0]);
883     p[1] = clamp_add_subtract_half(p_l[1], p_t[1], p_tl[1]);
884     p[2] = clamp_add_subtract_half(p_l[2], p_t[2], p_tl[2]);
885     p[3] = clamp_add_subtract_half(p_l[3], p_t[3], p_tl[3]);
886 }
887 
888 typedef void (*inv_predict_func)(uint8_t *p, const uint8_t *p_l,
889                                  const uint8_t *p_tl, const uint8_t *p_t,
890                                  const uint8_t *p_tr);
891 
892 static const inv_predict_func inverse_predict[14] = {
893     inv_predict_0,  inv_predict_1,  inv_predict_2,  inv_predict_3,
894     inv_predict_4,  inv_predict_5,  inv_predict_6,  inv_predict_7,
895     inv_predict_8,  inv_predict_9,  inv_predict_10, inv_predict_11,
896     inv_predict_12, inv_predict_13,
897 };
898 
inverse_prediction(AVFrame * frame,enum PredictionMode m,int x,int y)899 static void inverse_prediction(AVFrame *frame, enum PredictionMode m, int x, int y)
900 {
901     uint8_t *dec, *p_l, *p_tl, *p_t, *p_tr;
902     uint8_t p[4];
903 
904     dec  = GET_PIXEL(frame, x,     y);
905     p_l  = GET_PIXEL(frame, x - 1, y);
906     p_tl = GET_PIXEL(frame, x - 1, y - 1);
907     p_t  = GET_PIXEL(frame, x,     y - 1);
908     if (x == frame->width - 1)
909         p_tr = GET_PIXEL(frame, 0, y);
910     else
911         p_tr = GET_PIXEL(frame, x + 1, y - 1);
912 
913     inverse_predict[m](p, p_l, p_tl, p_t, p_tr);
914 
915     dec[0] += p[0];
916     dec[1] += p[1];
917     dec[2] += p[2];
918     dec[3] += p[3];
919 }
920 
apply_predictor_transform(WebPContext * s)921 static int apply_predictor_transform(WebPContext *s)
922 {
923     ImageContext *img  = &s->image[IMAGE_ROLE_ARGB];
924     ImageContext *pimg = &s->image[IMAGE_ROLE_PREDICTOR];
925     int x, y;
926 
927     for (y = 0; y < img->frame->height; y++) {
928         for (x = 0; x < img->frame->width; x++) {
929             int tx = x >> pimg->size_reduction;
930             int ty = y >> pimg->size_reduction;
931             enum PredictionMode m = GET_PIXEL_COMP(pimg->frame, tx, ty, 2);
932 
933             if (x == 0) {
934                 if (y == 0)
935                     m = PRED_MODE_BLACK;
936                 else
937                     m = PRED_MODE_T;
938             } else if (y == 0)
939                 m = PRED_MODE_L;
940 
941             if (m > 13) {
942                 av_log(s->avctx, AV_LOG_ERROR,
943                        "invalid predictor mode: %d\n", m);
944                 return AVERROR_INVALIDDATA;
945             }
946             inverse_prediction(img->frame, m, x, y);
947         }
948     }
949     return 0;
950 }
951 
color_transform_delta(uint8_t color_pred,uint8_t color)952 static av_always_inline uint8_t color_transform_delta(uint8_t color_pred,
953                                                       uint8_t color)
954 {
955     return (int)ff_u8_to_s8(color_pred) * ff_u8_to_s8(color) >> 5;
956 }
957 
apply_color_transform(WebPContext * s)958 static int apply_color_transform(WebPContext *s)
959 {
960     ImageContext *img, *cimg;
961     int x, y, cx, cy;
962     uint8_t *p, *cp;
963 
964     img  = &s->image[IMAGE_ROLE_ARGB];
965     cimg = &s->image[IMAGE_ROLE_COLOR_TRANSFORM];
966 
967     for (y = 0; y < img->frame->height; y++) {
968         for (x = 0; x < img->frame->width; x++) {
969             cx = x >> cimg->size_reduction;
970             cy = y >> cimg->size_reduction;
971             cp = GET_PIXEL(cimg->frame, cx, cy);
972             p  = GET_PIXEL(img->frame,   x,  y);
973 
974             p[1] += color_transform_delta(cp[3], p[2]);
975             p[3] += color_transform_delta(cp[2], p[2]) +
976                     color_transform_delta(cp[1], p[1]);
977         }
978     }
979     return 0;
980 }
981 
apply_subtract_green_transform(WebPContext * s)982 static int apply_subtract_green_transform(WebPContext *s)
983 {
984     int x, y;
985     ImageContext *img = &s->image[IMAGE_ROLE_ARGB];
986 
987     for (y = 0; y < img->frame->height; y++) {
988         for (x = 0; x < img->frame->width; x++) {
989             uint8_t *p = GET_PIXEL(img->frame, x, y);
990             p[1] += p[2];
991             p[3] += p[2];
992         }
993     }
994     return 0;
995 }
996 
apply_color_indexing_transform(WebPContext * s)997 static int apply_color_indexing_transform(WebPContext *s)
998 {
999     ImageContext *img;
1000     ImageContext *pal;
1001     int i, x, y;
1002     uint8_t *p;
1003 
1004     img = &s->image[IMAGE_ROLE_ARGB];
1005     pal = &s->image[IMAGE_ROLE_COLOR_INDEXING];
1006 
1007     if (pal->size_reduction > 0) {
1008         GetBitContext gb_g;
1009         uint8_t *line;
1010         int pixel_bits = 8 >> pal->size_reduction;
1011 
1012         line = av_malloc(img->frame->linesize[0] + AV_INPUT_BUFFER_PADDING_SIZE);
1013         if (!line)
1014             return AVERROR(ENOMEM);
1015 
1016         for (y = 0; y < img->frame->height; y++) {
1017             p = GET_PIXEL(img->frame, 0, y);
1018             memcpy(line, p, img->frame->linesize[0]);
1019             init_get_bits(&gb_g, line, img->frame->linesize[0] * 8);
1020             skip_bits(&gb_g, 16);
1021             i = 0;
1022             for (x = 0; x < img->frame->width; x++) {
1023                 p    = GET_PIXEL(img->frame, x, y);
1024                 p[2] = get_bits(&gb_g, pixel_bits);
1025                 i++;
1026                 if (i == 1 << pal->size_reduction) {
1027                     skip_bits(&gb_g, 24);
1028                     i = 0;
1029                 }
1030             }
1031         }
1032         av_free(line);
1033     }
1034 
1035     // switch to local palette if it's worth initializing it
1036     if (img->frame->height * img->frame->width > 300) {
1037         uint8_t palette[256 * 4];
1038         const int size = pal->frame->width * 4;
1039         av_assert0(size <= 1024U);
1040         memcpy(palette, GET_PIXEL(pal->frame, 0, 0), size);   // copy palette
1041         // set extra entries to transparent black
1042         memset(palette + size, 0, 256 * 4 - size);
1043         for (y = 0; y < img->frame->height; y++) {
1044             for (x = 0; x < img->frame->width; x++) {
1045                 p = GET_PIXEL(img->frame, x, y);
1046                 i = p[2];
1047                 AV_COPY32(p, &palette[i * 4]);
1048             }
1049         }
1050     } else {
1051         for (y = 0; y < img->frame->height; y++) {
1052             for (x = 0; x < img->frame->width; x++) {
1053                 p = GET_PIXEL(img->frame, x, y);
1054                 i = p[2];
1055                 if (i >= pal->frame->width) {
1056                     AV_WB32(p, 0x00000000);
1057                 } else {
1058                     const uint8_t *pi = GET_PIXEL(pal->frame, i, 0);
1059                     AV_COPY32(p, pi);
1060                 }
1061             }
1062         }
1063     }
1064 
1065     return 0;
1066 }
1067 
update_canvas_size(AVCodecContext * avctx,int w,int h)1068 static void update_canvas_size(AVCodecContext *avctx, int w, int h)
1069 {
1070     WebPContext *s = avctx->priv_data;
1071     if (s->width && s->width != w) {
1072         av_log(avctx, AV_LOG_WARNING, "Width mismatch. %d != %d\n",
1073                s->width, w);
1074     }
1075     s->width = w;
1076     if (s->height && s->height != h) {
1077         av_log(avctx, AV_LOG_WARNING, "Height mismatch. %d != %d\n",
1078                s->height, h);
1079     }
1080     s->height = h;
1081 }
1082 
vp8_lossless_decode_frame(AVCodecContext * avctx,AVFrame * p,int * got_frame,uint8_t * data_start,unsigned int data_size,int is_alpha_chunk)1083 static int vp8_lossless_decode_frame(AVCodecContext *avctx, AVFrame *p,
1084                                      int *got_frame, uint8_t *data_start,
1085                                      unsigned int data_size, int is_alpha_chunk)
1086 {
1087     WebPContext *s = avctx->priv_data;
1088     int w, h, ret, i, used;
1089 
1090     if (!is_alpha_chunk) {
1091         s->lossless = 1;
1092         avctx->pix_fmt = AV_PIX_FMT_ARGB;
1093     }
1094 
1095     ret = init_get_bits8(&s->gb, data_start, data_size);
1096     if (ret < 0)
1097         return ret;
1098 
1099     if (!is_alpha_chunk) {
1100         if (get_bits(&s->gb, 8) != 0x2F) {
1101             av_log(avctx, AV_LOG_ERROR, "Invalid WebP Lossless signature\n");
1102             return AVERROR_INVALIDDATA;
1103         }
1104 
1105         w = get_bits(&s->gb, 14) + 1;
1106         h = get_bits(&s->gb, 14) + 1;
1107 
1108         update_canvas_size(avctx, w, h);
1109 
1110         ret = ff_set_dimensions(avctx, s->width, s->height);
1111         if (ret < 0)
1112             return ret;
1113 
1114         s->has_alpha = get_bits1(&s->gb);
1115 
1116         if (get_bits(&s->gb, 3) != 0x0) {
1117             av_log(avctx, AV_LOG_ERROR, "Invalid WebP Lossless version\n");
1118             return AVERROR_INVALIDDATA;
1119         }
1120     } else {
1121         if (!s->width || !s->height)
1122             return AVERROR_BUG;
1123         w = s->width;
1124         h = s->height;
1125     }
1126 
1127     /* parse transformations */
1128     s->nb_transforms = 0;
1129     s->reduced_width = 0;
1130     used = 0;
1131     while (get_bits1(&s->gb)) {
1132         enum TransformType transform = get_bits(&s->gb, 2);
1133         if (used & (1 << transform)) {
1134             av_log(avctx, AV_LOG_ERROR, "Transform %d used more than once\n",
1135                    transform);
1136             ret = AVERROR_INVALIDDATA;
1137             goto free_and_return;
1138         }
1139         used |= (1 << transform);
1140         s->transforms[s->nb_transforms++] = transform;
1141         switch (transform) {
1142         case PREDICTOR_TRANSFORM:
1143             ret = parse_transform_predictor(s);
1144             break;
1145         case COLOR_TRANSFORM:
1146             ret = parse_transform_color(s);
1147             break;
1148         case COLOR_INDEXING_TRANSFORM:
1149             ret = parse_transform_color_indexing(s);
1150             break;
1151         }
1152         if (ret < 0)
1153             goto free_and_return;
1154     }
1155 
1156     /* decode primary image */
1157     s->image[IMAGE_ROLE_ARGB].frame = p;
1158     if (is_alpha_chunk)
1159         s->image[IMAGE_ROLE_ARGB].is_alpha_primary = 1;
1160     ret = decode_entropy_coded_image(s, IMAGE_ROLE_ARGB, w, h);
1161     if (ret < 0)
1162         goto free_and_return;
1163 
1164     /* apply transformations */
1165     for (i = s->nb_transforms - 1; i >= 0; i--) {
1166         switch (s->transforms[i]) {
1167         case PREDICTOR_TRANSFORM:
1168             ret = apply_predictor_transform(s);
1169             break;
1170         case COLOR_TRANSFORM:
1171             ret = apply_color_transform(s);
1172             break;
1173         case SUBTRACT_GREEN:
1174             ret = apply_subtract_green_transform(s);
1175             break;
1176         case COLOR_INDEXING_TRANSFORM:
1177             ret = apply_color_indexing_transform(s);
1178             break;
1179         }
1180         if (ret < 0)
1181             goto free_and_return;
1182     }
1183 
1184     *got_frame   = 1;
1185     p->pict_type = AV_PICTURE_TYPE_I;
1186     p->key_frame = 1;
1187     ret          = data_size;
1188 
1189 free_and_return:
1190     for (i = 0; i < IMAGE_ROLE_NB; i++)
1191         image_ctx_free(&s->image[i]);
1192 
1193     return ret;
1194 }
1195 
alpha_inverse_prediction(AVFrame * frame,enum AlphaFilter m)1196 static void alpha_inverse_prediction(AVFrame *frame, enum AlphaFilter m)
1197 {
1198     int x, y, ls;
1199     uint8_t *dec;
1200 
1201     ls = frame->linesize[3];
1202 
1203     /* filter first row using horizontal filter */
1204     dec = frame->data[3] + 1;
1205     for (x = 1; x < frame->width; x++, dec++)
1206         *dec += *(dec - 1);
1207 
1208     /* filter first column using vertical filter */
1209     dec = frame->data[3] + ls;
1210     for (y = 1; y < frame->height; y++, dec += ls)
1211         *dec += *(dec - ls);
1212 
1213     /* filter the rest using the specified filter */
1214     switch (m) {
1215     case ALPHA_FILTER_HORIZONTAL:
1216         for (y = 1; y < frame->height; y++) {
1217             dec = frame->data[3] + y * ls + 1;
1218             for (x = 1; x < frame->width; x++, dec++)
1219                 *dec += *(dec - 1);
1220         }
1221         break;
1222     case ALPHA_FILTER_VERTICAL:
1223         for (y = 1; y < frame->height; y++) {
1224             dec = frame->data[3] + y * ls + 1;
1225             for (x = 1; x < frame->width; x++, dec++)
1226                 *dec += *(dec - ls);
1227         }
1228         break;
1229     case ALPHA_FILTER_GRADIENT:
1230         for (y = 1; y < frame->height; y++) {
1231             dec = frame->data[3] + y * ls + 1;
1232             for (x = 1; x < frame->width; x++, dec++)
1233                 dec[0] += av_clip_uint8(*(dec - 1) + *(dec - ls) - *(dec - ls - 1));
1234         }
1235         break;
1236     }
1237 }
1238 
vp8_lossy_decode_alpha(AVCodecContext * avctx,AVFrame * p,uint8_t * data_start,unsigned int data_size)1239 static int vp8_lossy_decode_alpha(AVCodecContext *avctx, AVFrame *p,
1240                                   uint8_t *data_start,
1241                                   unsigned int data_size)
1242 {
1243     WebPContext *s = avctx->priv_data;
1244     int x, y, ret;
1245 
1246     if (s->alpha_compression == ALPHA_COMPRESSION_NONE) {
1247         GetByteContext gb;
1248 
1249         bytestream2_init(&gb, data_start, data_size);
1250         for (y = 0; y < s->height; y++)
1251             bytestream2_get_buffer(&gb, p->data[3] + p->linesize[3] * y,
1252                                    s->width);
1253     } else if (s->alpha_compression == ALPHA_COMPRESSION_VP8L) {
1254         uint8_t *ap, *pp;
1255         int alpha_got_frame = 0;
1256 
1257         s->alpha_frame = av_frame_alloc();
1258         if (!s->alpha_frame)
1259             return AVERROR(ENOMEM);
1260 
1261         ret = vp8_lossless_decode_frame(avctx, s->alpha_frame, &alpha_got_frame,
1262                                         data_start, data_size, 1);
1263         if (ret < 0) {
1264             av_frame_free(&s->alpha_frame);
1265             return ret;
1266         }
1267         if (!alpha_got_frame) {
1268             av_frame_free(&s->alpha_frame);
1269             return AVERROR_INVALIDDATA;
1270         }
1271 
1272         /* copy green component of alpha image to alpha plane of primary image */
1273         for (y = 0; y < s->height; y++) {
1274             ap = GET_PIXEL(s->alpha_frame, 0, y) + 2;
1275             pp = p->data[3] + p->linesize[3] * y;
1276             for (x = 0; x < s->width; x++) {
1277                 *pp = *ap;
1278                 pp++;
1279                 ap += 4;
1280             }
1281         }
1282         av_frame_free(&s->alpha_frame);
1283     }
1284 
1285     /* apply alpha filtering */
1286     if (s->alpha_filter)
1287         alpha_inverse_prediction(p, s->alpha_filter);
1288 
1289     return 0;
1290 }
1291 
vp8_lossy_decode_frame(AVCodecContext * avctx,AVFrame * p,int * got_frame,uint8_t * data_start,unsigned int data_size)1292 static int vp8_lossy_decode_frame(AVCodecContext *avctx, AVFrame *p,
1293                                   int *got_frame, uint8_t *data_start,
1294                                   unsigned int data_size)
1295 {
1296     WebPContext *s = avctx->priv_data;
1297     int ret;
1298 
1299     if (!s->initialized) {
1300         ff_vp8_decode_init(avctx);
1301         s->initialized = 1;
1302         s->v.actually_webp = 1;
1303     }
1304     avctx->pix_fmt = s->has_alpha ? AV_PIX_FMT_YUVA420P : AV_PIX_FMT_YUV420P;
1305     s->lossless = 0;
1306 
1307     if (data_size > INT_MAX) {
1308         av_log(avctx, AV_LOG_ERROR, "unsupported chunk size\n");
1309         return AVERROR_PATCHWELCOME;
1310     }
1311 
1312     av_packet_unref(s->pkt);
1313     s->pkt->data = data_start;
1314     s->pkt->size = data_size;
1315 
1316     ret = ff_vp8_decode_frame(avctx, p, got_frame, s->pkt);
1317     if (ret < 0)
1318         return ret;
1319 
1320     if (!*got_frame)
1321         return AVERROR_INVALIDDATA;
1322 
1323     update_canvas_size(avctx, avctx->width, avctx->height);
1324 
1325     if (s->has_alpha) {
1326         ret = vp8_lossy_decode_alpha(avctx, p, s->alpha_data,
1327                                      s->alpha_data_size);
1328         if (ret < 0)
1329             return ret;
1330     }
1331     return ret;
1332 }
1333 
webp_decode_frame(AVCodecContext * avctx,void * data,int * got_frame,AVPacket * avpkt)1334 static int webp_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
1335                              AVPacket *avpkt)
1336 {
1337     AVFrame * const p = data;
1338     WebPContext *s = avctx->priv_data;
1339     GetByteContext gb;
1340     int ret;
1341     uint32_t chunk_type, chunk_size;
1342     int vp8x_flags = 0;
1343 
1344     s->avctx     = avctx;
1345     s->width     = 0;
1346     s->height    = 0;
1347     *got_frame   = 0;
1348     s->has_alpha = 0;
1349     s->has_exif  = 0;
1350     s->has_iccp  = 0;
1351     bytestream2_init(&gb, avpkt->data, avpkt->size);
1352 
1353     if (bytestream2_get_bytes_left(&gb) < 12)
1354         return AVERROR_INVALIDDATA;
1355 
1356     if (bytestream2_get_le32(&gb) != MKTAG('R', 'I', 'F', 'F')) {
1357         av_log(avctx, AV_LOG_ERROR, "missing RIFF tag\n");
1358         return AVERROR_INVALIDDATA;
1359     }
1360 
1361     chunk_size = bytestream2_get_le32(&gb);
1362     if (bytestream2_get_bytes_left(&gb) < chunk_size)
1363         return AVERROR_INVALIDDATA;
1364 
1365     if (bytestream2_get_le32(&gb) != MKTAG('W', 'E', 'B', 'P')) {
1366         av_log(avctx, AV_LOG_ERROR, "missing WEBP tag\n");
1367         return AVERROR_INVALIDDATA;
1368     }
1369 
1370     while (bytestream2_get_bytes_left(&gb) > 8) {
1371         char chunk_str[5] = { 0 };
1372 
1373         chunk_type = bytestream2_get_le32(&gb);
1374         chunk_size = bytestream2_get_le32(&gb);
1375         if (chunk_size == UINT32_MAX)
1376             return AVERROR_INVALIDDATA;
1377         chunk_size += chunk_size & 1;
1378 
1379         if (bytestream2_get_bytes_left(&gb) < chunk_size) {
1380            /* we seem to be running out of data, but it could also be that the
1381               bitstream has trailing junk leading to bogus chunk_size. */
1382             break;
1383         }
1384 
1385         switch (chunk_type) {
1386         case MKTAG('V', 'P', '8', ' '):
1387             if (!*got_frame) {
1388                 ret = vp8_lossy_decode_frame(avctx, p, got_frame,
1389                                              avpkt->data + bytestream2_tell(&gb),
1390                                              chunk_size);
1391                 if (ret < 0)
1392                     return ret;
1393             }
1394             bytestream2_skip(&gb, chunk_size);
1395             break;
1396         case MKTAG('V', 'P', '8', 'L'):
1397             if (!*got_frame) {
1398                 ret = vp8_lossless_decode_frame(avctx, p, got_frame,
1399                                                 avpkt->data + bytestream2_tell(&gb),
1400                                                 chunk_size, 0);
1401                 if (ret < 0)
1402                     return ret;
1403                 avctx->properties |= FF_CODEC_PROPERTY_LOSSLESS;
1404             }
1405             bytestream2_skip(&gb, chunk_size);
1406             break;
1407         case MKTAG('V', 'P', '8', 'X'):
1408             if (s->width || s->height || *got_frame) {
1409                 av_log(avctx, AV_LOG_ERROR, "Canvas dimensions are already set\n");
1410                 return AVERROR_INVALIDDATA;
1411             }
1412             vp8x_flags = bytestream2_get_byte(&gb);
1413             bytestream2_skip(&gb, 3);
1414             s->width  = bytestream2_get_le24(&gb) + 1;
1415             s->height = bytestream2_get_le24(&gb) + 1;
1416             ret = av_image_check_size(s->width, s->height, 0, avctx);
1417             if (ret < 0)
1418                 return ret;
1419             break;
1420         case MKTAG('A', 'L', 'P', 'H'): {
1421             int alpha_header, filter_m, compression;
1422 
1423             if (!(vp8x_flags & VP8X_FLAG_ALPHA)) {
1424                 av_log(avctx, AV_LOG_WARNING,
1425                        "ALPHA chunk present, but alpha bit not set in the "
1426                        "VP8X header\n");
1427             }
1428             if (chunk_size == 0) {
1429                 av_log(avctx, AV_LOG_ERROR, "invalid ALPHA chunk size\n");
1430                 return AVERROR_INVALIDDATA;
1431             }
1432             alpha_header       = bytestream2_get_byte(&gb);
1433             s->alpha_data      = avpkt->data + bytestream2_tell(&gb);
1434             s->alpha_data_size = chunk_size - 1;
1435             bytestream2_skip(&gb, s->alpha_data_size);
1436 
1437             filter_m    = (alpha_header >> 2) & 0x03;
1438             compression =  alpha_header       & 0x03;
1439 
1440             if (compression > ALPHA_COMPRESSION_VP8L) {
1441                 av_log(avctx, AV_LOG_VERBOSE,
1442                        "skipping unsupported ALPHA chunk\n");
1443             } else {
1444                 s->has_alpha         = 1;
1445                 s->alpha_compression = compression;
1446                 s->alpha_filter      = filter_m;
1447             }
1448 
1449             break;
1450         }
1451         case MKTAG('E', 'X', 'I', 'F'): {
1452             int le, ifd_offset, exif_offset = bytestream2_tell(&gb);
1453             AVDictionary *exif_metadata = NULL;
1454             GetByteContext exif_gb;
1455 
1456             if (s->has_exif) {
1457                 av_log(avctx, AV_LOG_VERBOSE, "Ignoring extra EXIF chunk\n");
1458                 goto exif_end;
1459             }
1460             if (!(vp8x_flags & VP8X_FLAG_EXIF_METADATA))
1461                 av_log(avctx, AV_LOG_WARNING,
1462                        "EXIF chunk present, but Exif bit not set in the "
1463                        "VP8X header\n");
1464 
1465             s->has_exif = 1;
1466             bytestream2_init(&exif_gb, avpkt->data + exif_offset,
1467                              avpkt->size - exif_offset);
1468             if (ff_tdecode_header(&exif_gb, &le, &ifd_offset) < 0) {
1469                 av_log(avctx, AV_LOG_ERROR, "invalid TIFF header "
1470                        "in Exif data\n");
1471                 goto exif_end;
1472             }
1473 
1474             bytestream2_seek(&exif_gb, ifd_offset, SEEK_SET);
1475             if (ff_exif_decode_ifd(avctx, &exif_gb, le, 0, &exif_metadata) < 0) {
1476                 av_log(avctx, AV_LOG_ERROR, "error decoding Exif data\n");
1477                 goto exif_end;
1478             }
1479 
1480             av_dict_copy(&((AVFrame *) data)->metadata, exif_metadata, 0);
1481 
1482 exif_end:
1483             av_dict_free(&exif_metadata);
1484             bytestream2_skip(&gb, chunk_size);
1485             break;
1486         }
1487         case MKTAG('I', 'C', 'C', 'P'): {
1488             AVFrameSideData *sd;
1489 
1490             if (s->has_iccp) {
1491                 av_log(avctx, AV_LOG_VERBOSE, "Ignoring extra ICCP chunk\n");
1492                 bytestream2_skip(&gb, chunk_size);
1493                 break;
1494             }
1495             if (!(vp8x_flags & VP8X_FLAG_ICC))
1496                 av_log(avctx, AV_LOG_WARNING,
1497                        "ICCP chunk present, but ICC Profile bit not set in the "
1498                        "VP8X header\n");
1499 
1500             s->has_iccp = 1;
1501             sd = av_frame_new_side_data(p, AV_FRAME_DATA_ICC_PROFILE, chunk_size);
1502             if (!sd)
1503                 return AVERROR(ENOMEM);
1504 
1505             bytestream2_get_buffer(&gb, sd->data, chunk_size);
1506             break;
1507         }
1508         case MKTAG('A', 'N', 'I', 'M'):
1509         case MKTAG('A', 'N', 'M', 'F'):
1510         case MKTAG('X', 'M', 'P', ' '):
1511             AV_WL32(chunk_str, chunk_type);
1512             av_log(avctx, AV_LOG_WARNING, "skipping unsupported chunk: %s\n",
1513                    chunk_str);
1514             bytestream2_skip(&gb, chunk_size);
1515             break;
1516         default:
1517             AV_WL32(chunk_str, chunk_type);
1518             av_log(avctx, AV_LOG_VERBOSE, "skipping unknown chunk: %s\n",
1519                    chunk_str);
1520             bytestream2_skip(&gb, chunk_size);
1521             break;
1522         }
1523     }
1524 
1525     if (!*got_frame) {
1526         av_log(avctx, AV_LOG_ERROR, "image data not found\n");
1527         return AVERROR_INVALIDDATA;
1528     }
1529 
1530     return avpkt->size;
1531 }
1532 
webp_decode_init(AVCodecContext * avctx)1533 static av_cold int webp_decode_init(AVCodecContext *avctx)
1534 {
1535     WebPContext *s = avctx->priv_data;
1536 
1537     s->pkt = av_packet_alloc();
1538     if (!s->pkt)
1539         return AVERROR(ENOMEM);
1540 
1541     return 0;
1542 }
1543 
webp_decode_close(AVCodecContext * avctx)1544 static av_cold int webp_decode_close(AVCodecContext *avctx)
1545 {
1546     WebPContext *s = avctx->priv_data;
1547 
1548     av_packet_free(&s->pkt);
1549 
1550     if (s->initialized)
1551         return ff_vp8_decode_free(avctx);
1552 
1553     return 0;
1554 }
1555 
1556 AVCodec ff_webp_decoder = {
1557     .name           = "webp",
1558     .long_name      = NULL_IF_CONFIG_SMALL("WebP image"),
1559     .type           = AVMEDIA_TYPE_VIDEO,
1560     .id             = AV_CODEC_ID_WEBP,
1561     .priv_data_size = sizeof(WebPContext),
1562     .init           = webp_decode_init,
1563     .decode         = webp_decode_frame,
1564     .close          = webp_decode_close,
1565     .capabilities   = AV_CODEC_CAP_DR1 | AV_CODEC_CAP_FRAME_THREADS,
1566 };
1567