• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /* Copyright 2013 Google Inc. All Rights Reserved.
2 
3    Distributed under MIT license.
4    See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
5 */
6 
7 #include <brotli/decode.h>
8 
9 #include <stdlib.h>  /* free, malloc */
10 #include <string.h>  /* memcpy, memset */
11 
12 #include "../common/constants.h"
13 #include "../common/context.h"
14 #include "../common/dictionary.h"
15 #include "../common/platform.h"
16 #include "../common/shared_dictionary_internal.h"
17 #include "../common/transform.h"
18 #include "../common/version.h"
19 #include "bit_reader.h"
20 #include "huffman.h"
21 #include "prefix.h"
22 #include "state.h"
23 
24 #if defined(BROTLI_TARGET_NEON)
25 #include <arm_neon.h>
26 #endif
27 
28 #if defined(__cplusplus) || defined(c_plusplus)
29 extern "C" {
30 #endif
31 
32 #define BROTLI_FAILURE(CODE) (BROTLI_DUMP(), CODE)
33 
34 #define BROTLI_LOG_UINT(name)                                       \
35   BROTLI_LOG(("[%s] %s = %lu\n", __func__, #name, (unsigned long)(name)))
36 #define BROTLI_LOG_ARRAY_INDEX(array_name, idx)                     \
37   BROTLI_LOG(("[%s] %s[%lu] = %lu\n", __func__, #array_name,        \
38          (unsigned long)(idx), (unsigned long)array_name[idx]))
39 
40 #define HUFFMAN_TABLE_BITS 8U
41 #define HUFFMAN_TABLE_MASK 0xFF
42 
43 /* We need the slack region for the following reasons:
44     - doing up to two 16-byte copies for fast backward copying
45     - inserting transformed dictionary word:
46         255 prefix + 32 base + 255 suffix */
47 static const brotli_reg_t kRingBufferWriteAheadSlack = 542;
48 
49 static const uint8_t kCodeLengthCodeOrder[BROTLI_CODE_LENGTH_CODES] = {
50   1, 2, 3, 4, 0, 5, 17, 6, 16, 7, 8, 9, 10, 11, 12, 13, 14, 15,
51 };
52 
53 /* Static prefix code for the complex code length code lengths. */
54 static const uint8_t kCodeLengthPrefixLength[16] = {
55   2, 2, 2, 3, 2, 2, 2, 4, 2, 2, 2, 3, 2, 2, 2, 4,
56 };
57 
58 static const uint8_t kCodeLengthPrefixValue[16] = {
59   0, 4, 3, 2, 0, 4, 3, 1, 0, 4, 3, 2, 0, 4, 3, 5,
60 };
61 
BrotliDecoderSetParameter(BrotliDecoderState * state,BrotliDecoderParameter p,uint32_t value)62 BROTLI_BOOL BrotliDecoderSetParameter(
63     BrotliDecoderState* state, BrotliDecoderParameter p, uint32_t value) {
64   if (state->state != BROTLI_STATE_UNINITED) return BROTLI_FALSE;
65   switch (p) {
66     case BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:
67       state->canny_ringbuffer_allocation = !!value ? 0 : 1;
68       return BROTLI_TRUE;
69 
70     case BROTLI_DECODER_PARAM_LARGE_WINDOW:
71       state->large_window = TO_BROTLI_BOOL(!!value);
72       return BROTLI_TRUE;
73 
74     default: return BROTLI_FALSE;
75   }
76 }
77 
BrotliDecoderCreateInstance(brotli_alloc_func alloc_func,brotli_free_func free_func,void * opaque)78 BrotliDecoderState* BrotliDecoderCreateInstance(
79     brotli_alloc_func alloc_func, brotli_free_func free_func, void* opaque) {
80   BrotliDecoderState* state = 0;
81   if (!alloc_func && !free_func) {
82     state = (BrotliDecoderState*)malloc(sizeof(BrotliDecoderState));
83   } else if (alloc_func && free_func) {
84     state = (BrotliDecoderState*)alloc_func(opaque, sizeof(BrotliDecoderState));
85   }
86   if (state == 0) {
87     BROTLI_DUMP();
88     return 0;
89   }
90   if (!BrotliDecoderStateInit(state, alloc_func, free_func, opaque)) {
91     BROTLI_DUMP();
92     if (!alloc_func && !free_func) {
93       free(state);
94     } else if (alloc_func && free_func) {
95       free_func(opaque, state);
96     }
97     return 0;
98   }
99   return state;
100 }
101 
102 /* Deinitializes and frees BrotliDecoderState instance. */
BrotliDecoderDestroyInstance(BrotliDecoderState * state)103 void BrotliDecoderDestroyInstance(BrotliDecoderState* state) {
104   if (!state) {
105     return;
106   } else {
107     brotli_free_func free_func = state->free_func;
108     void* opaque = state->memory_manager_opaque;
109     BrotliDecoderStateCleanup(state);
110     free_func(opaque, state);
111   }
112 }
113 
114 /* Saves error code and converts it to BrotliDecoderResult. */
SaveErrorCode(BrotliDecoderState * s,BrotliDecoderErrorCode e,size_t consumed_input)115 static BROTLI_NOINLINE BrotliDecoderResult SaveErrorCode(
116     BrotliDecoderState* s, BrotliDecoderErrorCode e, size_t consumed_input) {
117   s->error_code = (int)e;
118   s->used_input += consumed_input;
119   if ((s->buffer_length != 0) && (s->br.next_in == s->br.last_in)) {
120     /* If internal buffer is depleted at last, reset it. */
121     s->buffer_length = 0;
122   }
123   switch (e) {
124     case BROTLI_DECODER_SUCCESS:
125       return BROTLI_DECODER_RESULT_SUCCESS;
126 
127     case BROTLI_DECODER_NEEDS_MORE_INPUT:
128       return BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT;
129 
130     case BROTLI_DECODER_NEEDS_MORE_OUTPUT:
131       return BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT;
132 
133     default:
134       return BROTLI_DECODER_RESULT_ERROR;
135   }
136 }
137 
138 /* Decodes WBITS by reading 1 - 7 bits, or 0x11 for "Large Window Brotli".
139    Precondition: bit-reader accumulator has at least 8 bits. */
DecodeWindowBits(BrotliDecoderState * s,BrotliBitReader * br)140 static BrotliDecoderErrorCode DecodeWindowBits(BrotliDecoderState* s,
141                                                BrotliBitReader* br) {
142   brotli_reg_t n;
143   BROTLI_BOOL large_window = s->large_window;
144   s->large_window = BROTLI_FALSE;
145   BrotliTakeBits(br, 1, &n);
146   if (n == 0) {
147     s->window_bits = 16;
148     return BROTLI_DECODER_SUCCESS;
149   }
150   BrotliTakeBits(br, 3, &n);
151   if (n != 0) {
152     s->window_bits = (17u + n) & 63u;
153     return BROTLI_DECODER_SUCCESS;
154   }
155   BrotliTakeBits(br, 3, &n);
156   if (n == 1) {
157     if (large_window) {
158       BrotliTakeBits(br, 1, &n);
159       if (n == 1) {
160         return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS);
161       }
162       s->large_window = BROTLI_TRUE;
163       return BROTLI_DECODER_SUCCESS;
164     } else {
165       return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS);
166     }
167   }
168   if (n != 0) {
169     s->window_bits = (8u + n) & 63u;
170     return BROTLI_DECODER_SUCCESS;
171   }
172   s->window_bits = 17;
173   return BROTLI_DECODER_SUCCESS;
174 }
175 
memmove16(uint8_t * dst,uint8_t * src)176 static BROTLI_INLINE void memmove16(uint8_t* dst, uint8_t* src) {
177 #if defined(BROTLI_TARGET_NEON)
178   vst1q_u8(dst, vld1q_u8(src));
179 #else
180   uint32_t buffer[4];
181   memcpy(buffer, src, 16);
182   memcpy(dst, buffer, 16);
183 #endif
184 }
185 
186 /* Decodes a number in the range [0..255], by reading 1 - 11 bits. */
DecodeVarLenUint8(BrotliDecoderState * s,BrotliBitReader * br,brotli_reg_t * value)187 static BROTLI_NOINLINE BrotliDecoderErrorCode DecodeVarLenUint8(
188     BrotliDecoderState* s, BrotliBitReader* br, brotli_reg_t* value) {
189   brotli_reg_t bits;
190   switch (s->substate_decode_uint8) {
191     case BROTLI_STATE_DECODE_UINT8_NONE:
192       if (BROTLI_PREDICT_FALSE(!BrotliSafeReadBits(br, 1, &bits))) {
193         return BROTLI_DECODER_NEEDS_MORE_INPUT;
194       }
195       if (bits == 0) {
196         *value = 0;
197         return BROTLI_DECODER_SUCCESS;
198       }
199     /* Fall through. */
200 
201     case BROTLI_STATE_DECODE_UINT8_SHORT:
202       if (BROTLI_PREDICT_FALSE(!BrotliSafeReadBits(br, 3, &bits))) {
203         s->substate_decode_uint8 = BROTLI_STATE_DECODE_UINT8_SHORT;
204         return BROTLI_DECODER_NEEDS_MORE_INPUT;
205       }
206       if (bits == 0) {
207         *value = 1;
208         s->substate_decode_uint8 = BROTLI_STATE_DECODE_UINT8_NONE;
209         return BROTLI_DECODER_SUCCESS;
210       }
211       /* Use output value as a temporary storage. It MUST be persisted. */
212       *value = bits;
213     /* Fall through. */
214 
215     case BROTLI_STATE_DECODE_UINT8_LONG:
216       if (BROTLI_PREDICT_FALSE(!BrotliSafeReadBits(br, *value, &bits))) {
217         s->substate_decode_uint8 = BROTLI_STATE_DECODE_UINT8_LONG;
218         return BROTLI_DECODER_NEEDS_MORE_INPUT;
219       }
220       *value = (1U << *value) + bits;
221       s->substate_decode_uint8 = BROTLI_STATE_DECODE_UINT8_NONE;
222       return BROTLI_DECODER_SUCCESS;
223 
224     default:
225       return
226           BROTLI_FAILURE(BROTLI_DECODER_ERROR_UNREACHABLE);  /* COV_NF_LINE */
227   }
228 }
229 
230 /* Decodes a metablock length and flags by reading 2 - 31 bits. */
DecodeMetaBlockLength(BrotliDecoderState * s,BrotliBitReader * br)231 static BrotliDecoderErrorCode BROTLI_NOINLINE DecodeMetaBlockLength(
232     BrotliDecoderState* s, BrotliBitReader* br) {
233   brotli_reg_t bits;
234   int i;
235   for (;;) {
236     switch (s->substate_metablock_header) {
237       case BROTLI_STATE_METABLOCK_HEADER_NONE:
238         if (!BrotliSafeReadBits(br, 1, &bits)) {
239           return BROTLI_DECODER_NEEDS_MORE_INPUT;
240         }
241         s->is_last_metablock = bits ? 1 : 0;
242         s->meta_block_remaining_len = 0;
243         s->is_uncompressed = 0;
244         s->is_metadata = 0;
245         if (!s->is_last_metablock) {
246           s->substate_metablock_header = BROTLI_STATE_METABLOCK_HEADER_NIBBLES;
247           break;
248         }
249         s->substate_metablock_header = BROTLI_STATE_METABLOCK_HEADER_EMPTY;
250       /* Fall through. */
251 
252       case BROTLI_STATE_METABLOCK_HEADER_EMPTY:
253         if (!BrotliSafeReadBits(br, 1, &bits)) {
254           return BROTLI_DECODER_NEEDS_MORE_INPUT;
255         }
256         if (bits) {
257           s->substate_metablock_header = BROTLI_STATE_METABLOCK_HEADER_NONE;
258           return BROTLI_DECODER_SUCCESS;
259         }
260         s->substate_metablock_header = BROTLI_STATE_METABLOCK_HEADER_NIBBLES;
261       /* Fall through. */
262 
263       case BROTLI_STATE_METABLOCK_HEADER_NIBBLES:
264         if (!BrotliSafeReadBits(br, 2, &bits)) {
265           return BROTLI_DECODER_NEEDS_MORE_INPUT;
266         }
267         s->size_nibbles = (uint8_t)(bits + 4);
268         s->loop_counter = 0;
269         if (bits == 3) {
270           s->is_metadata = 1;
271           s->substate_metablock_header = BROTLI_STATE_METABLOCK_HEADER_RESERVED;
272           break;
273         }
274         s->substate_metablock_header = BROTLI_STATE_METABLOCK_HEADER_SIZE;
275       /* Fall through. */
276 
277       case BROTLI_STATE_METABLOCK_HEADER_SIZE:
278         i = s->loop_counter;
279         for (; i < (int)s->size_nibbles; ++i) {
280           if (!BrotliSafeReadBits(br, 4, &bits)) {
281             s->loop_counter = i;
282             return BROTLI_DECODER_NEEDS_MORE_INPUT;
283           }
284           if (i + 1 == (int)s->size_nibbles && s->size_nibbles > 4 &&
285               bits == 0) {
286             return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE);
287           }
288           s->meta_block_remaining_len |= (int)(bits << (i * 4));
289         }
290         s->substate_metablock_header =
291             BROTLI_STATE_METABLOCK_HEADER_UNCOMPRESSED;
292       /* Fall through. */
293 
294       case BROTLI_STATE_METABLOCK_HEADER_UNCOMPRESSED:
295         if (!s->is_last_metablock) {
296           if (!BrotliSafeReadBits(br, 1, &bits)) {
297             return BROTLI_DECODER_NEEDS_MORE_INPUT;
298           }
299           s->is_uncompressed = bits ? 1 : 0;
300         }
301         ++s->meta_block_remaining_len;
302         s->substate_metablock_header = BROTLI_STATE_METABLOCK_HEADER_NONE;
303         return BROTLI_DECODER_SUCCESS;
304 
305       case BROTLI_STATE_METABLOCK_HEADER_RESERVED:
306         if (!BrotliSafeReadBits(br, 1, &bits)) {
307           return BROTLI_DECODER_NEEDS_MORE_INPUT;
308         }
309         if (bits != 0) {
310           return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_RESERVED);
311         }
312         s->substate_metablock_header = BROTLI_STATE_METABLOCK_HEADER_BYTES;
313       /* Fall through. */
314 
315       case BROTLI_STATE_METABLOCK_HEADER_BYTES:
316         if (!BrotliSafeReadBits(br, 2, &bits)) {
317           return BROTLI_DECODER_NEEDS_MORE_INPUT;
318         }
319         if (bits == 0) {
320           s->substate_metablock_header = BROTLI_STATE_METABLOCK_HEADER_NONE;
321           return BROTLI_DECODER_SUCCESS;
322         }
323         s->size_nibbles = (uint8_t)bits;
324         s->substate_metablock_header = BROTLI_STATE_METABLOCK_HEADER_METADATA;
325       /* Fall through. */
326 
327       case BROTLI_STATE_METABLOCK_HEADER_METADATA:
328         i = s->loop_counter;
329         for (; i < (int)s->size_nibbles; ++i) {
330           if (!BrotliSafeReadBits(br, 8, &bits)) {
331             s->loop_counter = i;
332             return BROTLI_DECODER_NEEDS_MORE_INPUT;
333           }
334           if (i + 1 == (int)s->size_nibbles && s->size_nibbles > 1 &&
335               bits == 0) {
336             return BROTLI_FAILURE(
337                 BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE);
338           }
339           s->meta_block_remaining_len |= (int)(bits << (i * 8));
340         }
341         ++s->meta_block_remaining_len;
342         s->substate_metablock_header = BROTLI_STATE_METABLOCK_HEADER_NONE;
343         return BROTLI_DECODER_SUCCESS;
344 
345       default:
346         return
347             BROTLI_FAILURE(BROTLI_DECODER_ERROR_UNREACHABLE);  /* COV_NF_LINE */
348     }
349   }
350 }
351 
352 /* Decodes the Huffman code.
353    This method doesn't read data from the bit reader, BUT drops the amount of
354    bits that correspond to the decoded symbol.
355    bits MUST contain at least 15 (BROTLI_HUFFMAN_MAX_CODE_LENGTH) valid bits. */
DecodeSymbol(brotli_reg_t bits,const HuffmanCode * table,BrotliBitReader * br)356 static BROTLI_INLINE brotli_reg_t DecodeSymbol(brotli_reg_t bits,
357                                                const HuffmanCode* table,
358                                                BrotliBitReader* br) {
359   BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD(table);
360   BROTLI_HC_ADJUST_TABLE_INDEX(table, bits & HUFFMAN_TABLE_MASK);
361   if (BROTLI_HC_FAST_LOAD_BITS(table) > HUFFMAN_TABLE_BITS) {
362     brotli_reg_t nbits = BROTLI_HC_FAST_LOAD_BITS(table) - HUFFMAN_TABLE_BITS;
363     BrotliDropBits(br, HUFFMAN_TABLE_BITS);
364     BROTLI_HC_ADJUST_TABLE_INDEX(table,
365         BROTLI_HC_FAST_LOAD_VALUE(table) +
366         ((bits >> HUFFMAN_TABLE_BITS) & BitMask(nbits)));
367   }
368   BrotliDropBits(br, BROTLI_HC_FAST_LOAD_BITS(table));
369   return BROTLI_HC_FAST_LOAD_VALUE(table);
370 }
371 
372 /* Reads and decodes the next Huffman code from bit-stream.
373    This method peeks 16 bits of input and drops 0 - 15 of them. */
ReadSymbol(const HuffmanCode * table,BrotliBitReader * br)374 static BROTLI_INLINE brotli_reg_t ReadSymbol(const HuffmanCode* table,
375                                              BrotliBitReader* br) {
376   return DecodeSymbol(BrotliGet16BitsUnmasked(br), table, br);
377 }
378 
379 /* Same as DecodeSymbol, but it is known that there is less than 15 bits of
380    input are currently available. */
SafeDecodeSymbol(const HuffmanCode * table,BrotliBitReader * br,brotli_reg_t * result)381 static BROTLI_NOINLINE BROTLI_BOOL SafeDecodeSymbol(
382     const HuffmanCode* table, BrotliBitReader* br, brotli_reg_t* result) {
383   brotli_reg_t val;
384   brotli_reg_t available_bits = BrotliGetAvailableBits(br);
385   BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD(table);
386   if (available_bits == 0) {
387     if (BROTLI_HC_FAST_LOAD_BITS(table) == 0) {
388       *result = BROTLI_HC_FAST_LOAD_VALUE(table);
389       return BROTLI_TRUE;
390     }
391     return BROTLI_FALSE;  /* No valid bits at all. */
392   }
393   val = BrotliGetBitsUnmasked(br);
394   BROTLI_HC_ADJUST_TABLE_INDEX(table, val & HUFFMAN_TABLE_MASK);
395   if (BROTLI_HC_FAST_LOAD_BITS(table) <= HUFFMAN_TABLE_BITS) {
396     if (BROTLI_HC_FAST_LOAD_BITS(table) <= available_bits) {
397       BrotliDropBits(br, BROTLI_HC_FAST_LOAD_BITS(table));
398       *result = BROTLI_HC_FAST_LOAD_VALUE(table);
399       return BROTLI_TRUE;
400     } else {
401       return BROTLI_FALSE;  /* Not enough bits for the first level. */
402     }
403   }
404   if (available_bits <= HUFFMAN_TABLE_BITS) {
405     return BROTLI_FALSE;  /* Not enough bits to move to the second level. */
406   }
407 
408   /* Speculatively drop HUFFMAN_TABLE_BITS. */
409   val = (val & BitMask(BROTLI_HC_FAST_LOAD_BITS(table))) >> HUFFMAN_TABLE_BITS;
410   available_bits -= HUFFMAN_TABLE_BITS;
411   BROTLI_HC_ADJUST_TABLE_INDEX(table, BROTLI_HC_FAST_LOAD_VALUE(table) + val);
412   if (available_bits < BROTLI_HC_FAST_LOAD_BITS(table)) {
413     return BROTLI_FALSE;  /* Not enough bits for the second level. */
414   }
415 
416   BrotliDropBits(br, HUFFMAN_TABLE_BITS + BROTLI_HC_FAST_LOAD_BITS(table));
417   *result = BROTLI_HC_FAST_LOAD_VALUE(table);
418   return BROTLI_TRUE;
419 }
420 
SafeReadSymbol(const HuffmanCode * table,BrotliBitReader * br,brotli_reg_t * result)421 static BROTLI_INLINE BROTLI_BOOL SafeReadSymbol(
422     const HuffmanCode* table, BrotliBitReader* br, brotli_reg_t* result) {
423   brotli_reg_t val;
424   if (BROTLI_PREDICT_TRUE(BrotliSafeGetBits(br, 15, &val))) {
425     *result = DecodeSymbol(val, table, br);
426     return BROTLI_TRUE;
427   }
428   return SafeDecodeSymbol(table, br, result);
429 }
430 
431 /* Makes a look-up in first level Huffman table. Peeks 8 bits. */
PreloadSymbol(int safe,const HuffmanCode * table,BrotliBitReader * br,brotli_reg_t * bits,brotli_reg_t * value)432 static BROTLI_INLINE void PreloadSymbol(int safe,
433                                         const HuffmanCode* table,
434                                         BrotliBitReader* br,
435                                         brotli_reg_t* bits,
436                                         brotli_reg_t* value) {
437   if (safe) {
438     return;
439   }
440   BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD(table);
441   BROTLI_HC_ADJUST_TABLE_INDEX(table, BrotliGetBits(br, HUFFMAN_TABLE_BITS));
442   *bits = BROTLI_HC_FAST_LOAD_BITS(table);
443   *value = BROTLI_HC_FAST_LOAD_VALUE(table);
444 }
445 
446 /* Decodes the next Huffman code using data prepared by PreloadSymbol.
447    Reads 0 - 15 bits. Also peeks 8 following bits. */
ReadPreloadedSymbol(const HuffmanCode * table,BrotliBitReader * br,brotli_reg_t * bits,brotli_reg_t * value)448 static BROTLI_INLINE brotli_reg_t ReadPreloadedSymbol(const HuffmanCode* table,
449                                                   BrotliBitReader* br,
450                                                   brotli_reg_t* bits,
451                                                   brotli_reg_t* value) {
452   brotli_reg_t result = *value;
453   if (BROTLI_PREDICT_FALSE(*bits > HUFFMAN_TABLE_BITS)) {
454     brotli_reg_t val = BrotliGet16BitsUnmasked(br);
455     const HuffmanCode* ext = table + (val & HUFFMAN_TABLE_MASK) + *value;
456     brotli_reg_t mask = BitMask((*bits - HUFFMAN_TABLE_BITS));
457     BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD(ext);
458     BrotliDropBits(br, HUFFMAN_TABLE_BITS);
459     BROTLI_HC_ADJUST_TABLE_INDEX(ext, (val >> HUFFMAN_TABLE_BITS) & mask);
460     BrotliDropBits(br, BROTLI_HC_FAST_LOAD_BITS(ext));
461     result = BROTLI_HC_FAST_LOAD_VALUE(ext);
462   } else {
463     BrotliDropBits(br, *bits);
464   }
465   PreloadSymbol(0, table, br, bits, value);
466   return result;
467 }
468 
Log2Floor(brotli_reg_t x)469 static BROTLI_INLINE brotli_reg_t Log2Floor(brotli_reg_t x) {
470   brotli_reg_t result = 0;
471   while (x) {
472     x >>= 1;
473     ++result;
474   }
475   return result;
476 }
477 
478 /* Reads (s->symbol + 1) symbols.
479    Totally 1..4 symbols are read, 1..11 bits each.
480    The list of symbols MUST NOT contain duplicates. */
ReadSimpleHuffmanSymbols(brotli_reg_t alphabet_size_max,brotli_reg_t alphabet_size_limit,BrotliDecoderState * s)481 static BrotliDecoderErrorCode ReadSimpleHuffmanSymbols(
482     brotli_reg_t alphabet_size_max, brotli_reg_t alphabet_size_limit,
483     BrotliDecoderState* s) {
484   /* max_bits == 1..11; symbol == 0..3; 1..44 bits will be read. */
485   BrotliBitReader* br = &s->br;
486   BrotliMetablockHeaderArena* h = &s->arena.header;
487   brotli_reg_t max_bits = Log2Floor(alphabet_size_max - 1);
488   brotli_reg_t i = h->sub_loop_counter;
489   brotli_reg_t num_symbols = h->symbol;
490   while (i <= num_symbols) {
491     brotli_reg_t v;
492     if (BROTLI_PREDICT_FALSE(!BrotliSafeReadBits(br, max_bits, &v))) {
493       h->sub_loop_counter = i;
494       h->substate_huffman = BROTLI_STATE_HUFFMAN_SIMPLE_READ;
495       return BROTLI_DECODER_NEEDS_MORE_INPUT;
496     }
497     if (v >= alphabet_size_limit) {
498       return
499           BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET);
500     }
501     h->symbols_lists_array[i] = (uint16_t)v;
502     BROTLI_LOG_UINT(h->symbols_lists_array[i]);
503     ++i;
504   }
505 
506   for (i = 0; i < num_symbols; ++i) {
507     brotli_reg_t k = i + 1;
508     for (; k <= num_symbols; ++k) {
509       if (h->symbols_lists_array[i] == h->symbols_lists_array[k]) {
510         return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME);
511       }
512     }
513   }
514 
515   return BROTLI_DECODER_SUCCESS;
516 }
517 
518 /* Process single decoded symbol code length:
519     A) reset the repeat variable
520     B) remember code length (if it is not 0)
521     C) extend corresponding index-chain
522     D) reduce the Huffman space
523     E) update the histogram */
ProcessSingleCodeLength(brotli_reg_t code_len,brotli_reg_t * symbol,brotli_reg_t * repeat,brotli_reg_t * space,brotli_reg_t * prev_code_len,uint16_t * symbol_lists,uint16_t * code_length_histo,int * next_symbol)524 static BROTLI_INLINE void ProcessSingleCodeLength(brotli_reg_t code_len,
525     brotli_reg_t* symbol, brotli_reg_t* repeat, brotli_reg_t* space,
526     brotli_reg_t* prev_code_len, uint16_t* symbol_lists,
527     uint16_t* code_length_histo, int* next_symbol) {
528   *repeat = 0;
529   if (code_len != 0) {  /* code_len == 1..15 */
530     symbol_lists[next_symbol[code_len]] = (uint16_t)(*symbol);
531     next_symbol[code_len] = (int)(*symbol);
532     *prev_code_len = code_len;
533     *space -= 32768U >> code_len;
534     code_length_histo[code_len]++;
535     BROTLI_LOG(("[ReadHuffmanCode] code_length[%d] = %d\n",
536         (int)*symbol, (int)code_len));
537   }
538   (*symbol)++;
539 }
540 
541 /* Process repeated symbol code length.
542     A) Check if it is the extension of previous repeat sequence; if the decoded
543        value is not BROTLI_REPEAT_PREVIOUS_CODE_LENGTH, then it is a new
544        symbol-skip
545     B) Update repeat variable
546     C) Check if operation is feasible (fits alphabet)
547     D) For each symbol do the same operations as in ProcessSingleCodeLength
548 
549    PRECONDITION: code_len == BROTLI_REPEAT_PREVIOUS_CODE_LENGTH or
550                  code_len == BROTLI_REPEAT_ZERO_CODE_LENGTH */
ProcessRepeatedCodeLength(brotli_reg_t code_len,brotli_reg_t repeat_delta,brotli_reg_t alphabet_size,brotli_reg_t * symbol,brotli_reg_t * repeat,brotli_reg_t * space,brotli_reg_t * prev_code_len,brotli_reg_t * repeat_code_len,uint16_t * symbol_lists,uint16_t * code_length_histo,int * next_symbol)551 static BROTLI_INLINE void ProcessRepeatedCodeLength(brotli_reg_t code_len,
552     brotli_reg_t repeat_delta, brotli_reg_t alphabet_size, brotli_reg_t* symbol,
553     brotli_reg_t* repeat, brotli_reg_t* space, brotli_reg_t* prev_code_len,
554     brotli_reg_t* repeat_code_len, uint16_t* symbol_lists,
555     uint16_t* code_length_histo, int* next_symbol) {
556   brotli_reg_t old_repeat;
557   brotli_reg_t extra_bits = 3;  /* for BROTLI_REPEAT_ZERO_CODE_LENGTH */
558   brotli_reg_t new_len = 0;  /* for BROTLI_REPEAT_ZERO_CODE_LENGTH */
559   if (code_len == BROTLI_REPEAT_PREVIOUS_CODE_LENGTH) {
560     new_len = *prev_code_len;
561     extra_bits = 2;
562   }
563   if (*repeat_code_len != new_len) {
564     *repeat = 0;
565     *repeat_code_len = new_len;
566   }
567   old_repeat = *repeat;
568   if (*repeat > 0) {
569     *repeat -= 2;
570     *repeat <<= extra_bits;
571   }
572   *repeat += repeat_delta + 3U;
573   repeat_delta = *repeat - old_repeat;
574   if (*symbol + repeat_delta > alphabet_size) {
575     BROTLI_DUMP();
576     *symbol = alphabet_size;
577     *space = 0xFFFFF;
578     return;
579   }
580   BROTLI_LOG(("[ReadHuffmanCode] code_length[%d..%d] = %d\n",
581       (int)*symbol, (int)(*symbol + repeat_delta - 1), (int)*repeat_code_len));
582   if (*repeat_code_len != 0) {
583     brotli_reg_t last = *symbol + repeat_delta;
584     int next = next_symbol[*repeat_code_len];
585     do {
586       symbol_lists[next] = (uint16_t)*symbol;
587       next = (int)*symbol;
588     } while (++(*symbol) != last);
589     next_symbol[*repeat_code_len] = next;
590     *space -= repeat_delta << (15 - *repeat_code_len);
591     code_length_histo[*repeat_code_len] =
592         (uint16_t)(code_length_histo[*repeat_code_len] + repeat_delta);
593   } else {
594     *symbol += repeat_delta;
595   }
596 }
597 
598 /* Reads and decodes symbol codelengths. */
ReadSymbolCodeLengths(brotli_reg_t alphabet_size,BrotliDecoderState * s)599 static BrotliDecoderErrorCode ReadSymbolCodeLengths(
600     brotli_reg_t alphabet_size, BrotliDecoderState* s) {
601   BrotliBitReader* br = &s->br;
602   BrotliMetablockHeaderArena* h = &s->arena.header;
603   brotli_reg_t symbol = h->symbol;
604   brotli_reg_t repeat = h->repeat;
605   brotli_reg_t space = h->space;
606   brotli_reg_t prev_code_len = h->prev_code_len;
607   brotli_reg_t repeat_code_len = h->repeat_code_len;
608   uint16_t* symbol_lists = h->symbol_lists;
609   uint16_t* code_length_histo = h->code_length_histo;
610   int* next_symbol = h->next_symbol;
611   if (!BrotliWarmupBitReader(br)) {
612     return BROTLI_DECODER_NEEDS_MORE_INPUT;
613   }
614   while (symbol < alphabet_size && space > 0) {
615     const HuffmanCode* p = h->table;
616     brotli_reg_t code_len;
617     BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD(p);
618     if (!BrotliCheckInputAmount(br)) {
619       h->symbol = symbol;
620       h->repeat = repeat;
621       h->prev_code_len = prev_code_len;
622       h->repeat_code_len = repeat_code_len;
623       h->space = space;
624       return BROTLI_DECODER_NEEDS_MORE_INPUT;
625     }
626     BrotliFillBitWindow16(br);
627     BROTLI_HC_ADJUST_TABLE_INDEX(p, BrotliGetBitsUnmasked(br) &
628         BitMask(BROTLI_HUFFMAN_MAX_CODE_LENGTH_CODE_LENGTH));
629     BrotliDropBits(br, BROTLI_HC_FAST_LOAD_BITS(p));  /* Use 1..5 bits. */
630     code_len = BROTLI_HC_FAST_LOAD_VALUE(p);  /* code_len == 0..17 */
631     if (code_len < BROTLI_REPEAT_PREVIOUS_CODE_LENGTH) {
632       ProcessSingleCodeLength(code_len, &symbol, &repeat, &space,
633           &prev_code_len, symbol_lists, code_length_histo, next_symbol);
634     } else {  /* code_len == 16..17, extra_bits == 2..3 */
635       brotli_reg_t extra_bits =
636           (code_len == BROTLI_REPEAT_PREVIOUS_CODE_LENGTH) ? 2 : 3;
637       brotli_reg_t repeat_delta =
638           BrotliGetBitsUnmasked(br) & BitMask(extra_bits);
639       BrotliDropBits(br, extra_bits);
640       ProcessRepeatedCodeLength(code_len, repeat_delta, alphabet_size,
641           &symbol, &repeat, &space, &prev_code_len, &repeat_code_len,
642           symbol_lists, code_length_histo, next_symbol);
643     }
644   }
645   h->space = space;
646   return BROTLI_DECODER_SUCCESS;
647 }
648 
SafeReadSymbolCodeLengths(brotli_reg_t alphabet_size,BrotliDecoderState * s)649 static BrotliDecoderErrorCode SafeReadSymbolCodeLengths(
650     brotli_reg_t alphabet_size, BrotliDecoderState* s) {
651   BrotliBitReader* br = &s->br;
652   BrotliMetablockHeaderArena* h = &s->arena.header;
653   BROTLI_BOOL get_byte = BROTLI_FALSE;
654   while (h->symbol < alphabet_size && h->space > 0) {
655     const HuffmanCode* p = h->table;
656     brotli_reg_t code_len;
657     brotli_reg_t available_bits;
658     brotli_reg_t bits = 0;
659     BROTLI_HC_MARK_TABLE_FOR_FAST_LOAD(p);
660     if (get_byte && !BrotliPullByte(br)) return BROTLI_DECODER_NEEDS_MORE_INPUT;
661     get_byte = BROTLI_FALSE;
662     available_bits = BrotliGetAvailableBits(br);
663     if (available_bits != 0) {
664       bits = (uint32_t)BrotliGetBitsUnmasked(br);
665     }
666     BROTLI_HC_ADJUST_TABLE_INDEX(p,
667         bits & BitMask(BROTLI_HUFFMAN_MAX_CODE_LENGTH_CODE_LENGTH));
668     if (BROTLI_HC_FAST_LOAD_BITS(p) > available_bits) {
669       get_byte = BROTLI_TRUE;
670       continue;
671     }
672     code_len = BROTLI_HC_FAST_LOAD_VALUE(p);  /* code_len == 0..17 */
673     if (code_len < BROTLI_REPEAT_PREVIOUS_CODE_LENGTH) {
674       BrotliDropBits(br, BROTLI_HC_FAST_LOAD_BITS(p));
675       ProcessSingleCodeLength(code_len, &h->symbol, &h->repeat, &h->space,
676           &h->prev_code_len, h->symbol_lists, h->code_length_histo,
677           h->next_symbol);
678     } else {  /* code_len == 16..17, extra_bits == 2..3 */
679       brotli_reg_t extra_bits = code_len - 14U;
680       brotli_reg_t repeat_delta = (bits >> BROTLI_HC_FAST_LOAD_BITS(p)) &
681           BitMask(extra_bits);
682       if (available_bits < BROTLI_HC_FAST_LOAD_BITS(p) + extra_bits) {
683         get_byte = BROTLI_TRUE;
684         continue;
685       }
686       BrotliDropBits(br, BROTLI_HC_FAST_LOAD_BITS(p) + extra_bits);
687       ProcessRepeatedCodeLength(code_len, repeat_delta, alphabet_size,
688           &h->symbol, &h->repeat, &h->space, &h->prev_code_len,
689           &h->repeat_code_len, h->symbol_lists, h->code_length_histo,
690           h->next_symbol);
691     }
692   }
693   return BROTLI_DECODER_SUCCESS;
694 }
695 
696 /* Reads and decodes 15..18 codes using static prefix code.
697    Each code is 2..4 bits long. In total 30..72 bits are used. */
ReadCodeLengthCodeLengths(BrotliDecoderState * s)698 static BrotliDecoderErrorCode ReadCodeLengthCodeLengths(BrotliDecoderState* s) {
699   BrotliBitReader* br = &s->br;
700   BrotliMetablockHeaderArena* h = &s->arena.header;
701   brotli_reg_t num_codes = h->repeat;
702   brotli_reg_t space = h->space;
703   brotli_reg_t i = h->sub_loop_counter;
704   for (; i < BROTLI_CODE_LENGTH_CODES; ++i) {
705     const uint8_t code_len_idx = kCodeLengthCodeOrder[i];
706     brotli_reg_t ix;
707     brotli_reg_t v;
708     if (BROTLI_PREDICT_FALSE(!BrotliSafeGetBits(br, 4, &ix))) {
709       brotli_reg_t available_bits = BrotliGetAvailableBits(br);
710       if (available_bits != 0) {
711         ix = BrotliGetBitsUnmasked(br) & 0xF;
712       } else {
713         ix = 0;
714       }
715       if (kCodeLengthPrefixLength[ix] > available_bits) {
716         h->sub_loop_counter = i;
717         h->repeat = num_codes;
718         h->space = space;
719         h->substate_huffman = BROTLI_STATE_HUFFMAN_COMPLEX;
720         return BROTLI_DECODER_NEEDS_MORE_INPUT;
721       }
722     }
723     v = kCodeLengthPrefixValue[ix];
724     BrotliDropBits(br, kCodeLengthPrefixLength[ix]);
725     h->code_length_code_lengths[code_len_idx] = (uint8_t)v;
726     BROTLI_LOG_ARRAY_INDEX(h->code_length_code_lengths, code_len_idx);
727     if (v != 0) {
728       space = space - (32U >> v);
729       ++num_codes;
730       ++h->code_length_histo[v];
731       if (space - 1U >= 32U) {
732         /* space is 0 or wrapped around. */
733         break;
734       }
735     }
736   }
737   if (!(num_codes == 1 || space == 0)) {
738     return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_CL_SPACE);
739   }
740   return BROTLI_DECODER_SUCCESS;
741 }
742 
743 /* Decodes the Huffman tables.
744    There are 2 scenarios:
745     A) Huffman code contains only few symbols (1..4). Those symbols are read
746        directly; their code lengths are defined by the number of symbols.
747        For this scenario 4 - 49 bits will be read.
748 
749     B) 2-phase decoding:
750     B.1) Small Huffman table is decoded; it is specified with code lengths
751          encoded with predefined entropy code. 32 - 74 bits are used.
752     B.2) Decoded table is used to decode code lengths of symbols in resulting
753          Huffman table. In worst case 3520 bits are read. */
ReadHuffmanCode(brotli_reg_t alphabet_size_max,brotli_reg_t alphabet_size_limit,HuffmanCode * table,brotli_reg_t * opt_table_size,BrotliDecoderState * s)754 static BrotliDecoderErrorCode ReadHuffmanCode(brotli_reg_t alphabet_size_max,
755                                               brotli_reg_t alphabet_size_limit,
756                                               HuffmanCode* table,
757                                               brotli_reg_t* opt_table_size,
758                                               BrotliDecoderState* s) {
759   BrotliBitReader* br = &s->br;
760   BrotliMetablockHeaderArena* h = &s->arena.header;
761   /* State machine. */
762   for (;;) {
763     switch (h->substate_huffman) {
764       case BROTLI_STATE_HUFFMAN_NONE:
765         if (!BrotliSafeReadBits(br, 2, &h->sub_loop_counter)) {
766           return BROTLI_DECODER_NEEDS_MORE_INPUT;
767         }
768         BROTLI_LOG_UINT(h->sub_loop_counter);
769         /* The value is used as follows:
770            1 for simple code;
771            0 for no skipping, 2 skips 2 code lengths, 3 skips 3 code lengths */
772         if (h->sub_loop_counter != 1) {
773           h->space = 32;
774           h->repeat = 0;  /* num_codes */
775           memset(&h->code_length_histo[0], 0, sizeof(h->code_length_histo[0]) *
776               (BROTLI_HUFFMAN_MAX_CODE_LENGTH_CODE_LENGTH + 1));
777           memset(&h->code_length_code_lengths[0], 0,
778               sizeof(h->code_length_code_lengths));
779           h->substate_huffman = BROTLI_STATE_HUFFMAN_COMPLEX;
780           continue;
781         }
782       /* Fall through. */
783 
784       case BROTLI_STATE_HUFFMAN_SIMPLE_SIZE:
785         /* Read symbols, codes & code lengths directly. */
786         if (!BrotliSafeReadBits(br, 2, &h->symbol)) {  /* num_symbols */
787           h->substate_huffman = BROTLI_STATE_HUFFMAN_SIMPLE_SIZE;
788           return BROTLI_DECODER_NEEDS_MORE_INPUT;
789         }
790         h->sub_loop_counter = 0;
791       /* Fall through. */
792 
793       case BROTLI_STATE_HUFFMAN_SIMPLE_READ: {
794         BrotliDecoderErrorCode result =
795             ReadSimpleHuffmanSymbols(alphabet_size_max, alphabet_size_limit, s);
796         if (result != BROTLI_DECODER_SUCCESS) {
797           return result;
798         }
799       }
800       /* Fall through. */
801 
802       case BROTLI_STATE_HUFFMAN_SIMPLE_BUILD: {
803         brotli_reg_t table_size;
804         if (h->symbol == 3) {
805           brotli_reg_t bits;
806           if (!BrotliSafeReadBits(br, 1, &bits)) {
807             h->substate_huffman = BROTLI_STATE_HUFFMAN_SIMPLE_BUILD;
808             return BROTLI_DECODER_NEEDS_MORE_INPUT;
809           }
810           h->symbol += bits;
811         }
812         BROTLI_LOG_UINT(h->symbol);
813         table_size = BrotliBuildSimpleHuffmanTable(table, HUFFMAN_TABLE_BITS,
814                                                    h->symbols_lists_array,
815                                                    (uint32_t)h->symbol);
816         if (opt_table_size) {
817           *opt_table_size = table_size;
818         }
819         h->substate_huffman = BROTLI_STATE_HUFFMAN_NONE;
820         return BROTLI_DECODER_SUCCESS;
821       }
822 
823       /* Decode Huffman-coded code lengths. */
824       case BROTLI_STATE_HUFFMAN_COMPLEX: {
825         brotli_reg_t i;
826         BrotliDecoderErrorCode result = ReadCodeLengthCodeLengths(s);
827         if (result != BROTLI_DECODER_SUCCESS) {
828           return result;
829         }
830         BrotliBuildCodeLengthsHuffmanTable(h->table,
831                                            h->code_length_code_lengths,
832                                            h->code_length_histo);
833         memset(&h->code_length_histo[0], 0, sizeof(h->code_length_histo));
834         for (i = 0; i <= BROTLI_HUFFMAN_MAX_CODE_LENGTH; ++i) {
835           h->next_symbol[i] = (int)i - (BROTLI_HUFFMAN_MAX_CODE_LENGTH + 1);
836           h->symbol_lists[h->next_symbol[i]] = 0xFFFF;
837         }
838 
839         h->symbol = 0;
840         h->prev_code_len = BROTLI_INITIAL_REPEATED_CODE_LENGTH;
841         h->repeat = 0;
842         h->repeat_code_len = 0;
843         h->space = 32768;
844         h->substate_huffman = BROTLI_STATE_HUFFMAN_LENGTH_SYMBOLS;
845       }
846       /* Fall through. */
847 
848       case BROTLI_STATE_HUFFMAN_LENGTH_SYMBOLS: {
849         brotli_reg_t table_size;
850         BrotliDecoderErrorCode result = ReadSymbolCodeLengths(
851             alphabet_size_limit, s);
852         if (result == BROTLI_DECODER_NEEDS_MORE_INPUT) {
853           result = SafeReadSymbolCodeLengths(alphabet_size_limit, s);
854         }
855         if (result != BROTLI_DECODER_SUCCESS) {
856           return result;
857         }
858 
859         if (h->space != 0) {
860           BROTLI_LOG(("[ReadHuffmanCode] space = %d\n", (int)h->space));
861           return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE);
862         }
863         table_size = BrotliBuildHuffmanTable(
864             table, HUFFMAN_TABLE_BITS, h->symbol_lists, h->code_length_histo);
865         if (opt_table_size) {
866           *opt_table_size = table_size;
867         }
868         h->substate_huffman = BROTLI_STATE_HUFFMAN_NONE;
869         return BROTLI_DECODER_SUCCESS;
870       }
871 
872       default:
873         return
874             BROTLI_FAILURE(BROTLI_DECODER_ERROR_UNREACHABLE);  /* COV_NF_LINE */
875     }
876   }
877 }
878 
879 /* Decodes a block length by reading 3..39 bits. */
ReadBlockLength(const HuffmanCode * table,BrotliBitReader * br)880 static BROTLI_INLINE brotli_reg_t ReadBlockLength(const HuffmanCode* table,
881                                                   BrotliBitReader* br) {
882   brotli_reg_t code;
883   brotli_reg_t nbits;
884   code = ReadSymbol(table, br);
885   nbits = _kBrotliPrefixCodeRanges[code].nbits;  /* nbits == 2..24 */
886   return _kBrotliPrefixCodeRanges[code].offset + BrotliReadBits24(br, nbits);
887 }
888 
889 /* WARNING: if state is not BROTLI_STATE_READ_BLOCK_LENGTH_NONE, then
890    reading can't be continued with ReadBlockLength. */
SafeReadBlockLength(BrotliDecoderState * s,brotli_reg_t * result,const HuffmanCode * table,BrotliBitReader * br)891 static BROTLI_INLINE BROTLI_BOOL SafeReadBlockLength(
892     BrotliDecoderState* s, brotli_reg_t* result, const HuffmanCode* table,
893     BrotliBitReader* br) {
894   brotli_reg_t index;
895   if (s->substate_read_block_length == BROTLI_STATE_READ_BLOCK_LENGTH_NONE) {
896     if (!SafeReadSymbol(table, br, &index)) {
897       return BROTLI_FALSE;
898     }
899   } else {
900     index = s->block_length_index;
901   }
902   {
903     brotli_reg_t bits;
904     brotli_reg_t nbits = _kBrotliPrefixCodeRanges[index].nbits;
905     brotli_reg_t offset = _kBrotliPrefixCodeRanges[index].offset;
906     if (!BrotliSafeReadBits(br, nbits, &bits)) {
907       s->block_length_index = index;
908       s->substate_read_block_length = BROTLI_STATE_READ_BLOCK_LENGTH_SUFFIX;
909       return BROTLI_FALSE;
910     }
911     *result = offset + bits;
912     s->substate_read_block_length = BROTLI_STATE_READ_BLOCK_LENGTH_NONE;
913     return BROTLI_TRUE;
914   }
915 }
916 
917 /* Transform:
918     1) initialize list L with values 0, 1,... 255
919     2) For each input element X:
920     2.1) let Y = L[X]
921     2.2) remove X-th element from L
922     2.3) prepend Y to L
923     2.4) append Y to output
924 
925    In most cases max(Y) <= 7, so most of L remains intact.
926    To reduce the cost of initialization, we reuse L, remember the upper bound
927    of Y values, and reinitialize only first elements in L.
928 
929    Most of input values are 0 and 1. To reduce number of branches, we replace
930    inner for loop with do-while. */
InverseMoveToFrontTransform(uint8_t * v,brotli_reg_t v_len,BrotliDecoderState * state)931 static BROTLI_NOINLINE void InverseMoveToFrontTransform(
932     uint8_t* v, brotli_reg_t v_len, BrotliDecoderState* state) {
933   /* Reinitialize elements that could have been changed. */
934   brotli_reg_t i = 1;
935   brotli_reg_t upper_bound = state->mtf_upper_bound;
936   uint32_t* mtf = &state->mtf[1];  /* Make mtf[-1] addressable. */
937   uint8_t* mtf_u8 = (uint8_t*)mtf;
938   /* Load endian-aware constant. */
939   const uint8_t b0123[4] = {0, 1, 2, 3};
940   uint32_t pattern;
941   memcpy(&pattern, &b0123, 4);
942 
943   /* Initialize list using 4 consequent values pattern. */
944   mtf[0] = pattern;
945   do {
946     pattern += 0x04040404;  /* Advance all 4 values by 4. */
947     mtf[i] = pattern;
948     i++;
949   } while (i <= upper_bound);
950 
951   /* Transform the input. */
952   upper_bound = 0;
953   for (i = 0; i < v_len; ++i) {
954     int index = v[i];
955     uint8_t value = mtf_u8[index];
956     upper_bound |= v[i];
957     v[i] = value;
958     mtf_u8[-1] = value;
959     do {
960       index--;
961       mtf_u8[index + 1] = mtf_u8[index];
962     } while (index >= 0);
963   }
964   /* Remember amount of elements to be reinitialized. */
965   state->mtf_upper_bound = upper_bound >> 2;
966 }
967 
968 /* Decodes a series of Huffman table using ReadHuffmanCode function. */
HuffmanTreeGroupDecode(HuffmanTreeGroup * group,BrotliDecoderState * s)969 static BrotliDecoderErrorCode HuffmanTreeGroupDecode(
970     HuffmanTreeGroup* group, BrotliDecoderState* s) {
971   BrotliMetablockHeaderArena* h = &s->arena.header;
972   if (h->substate_tree_group != BROTLI_STATE_TREE_GROUP_LOOP) {
973     h->next = group->codes;
974     h->htree_index = 0;
975     h->substate_tree_group = BROTLI_STATE_TREE_GROUP_LOOP;
976   }
977   while (h->htree_index < group->num_htrees) {
978     brotli_reg_t table_size;
979     BrotliDecoderErrorCode result = ReadHuffmanCode(group->alphabet_size_max,
980         group->alphabet_size_limit, h->next, &table_size, s);
981     if (result != BROTLI_DECODER_SUCCESS) return result;
982     group->htrees[h->htree_index] = h->next;
983     h->next += table_size;
984     ++h->htree_index;
985   }
986   h->substate_tree_group = BROTLI_STATE_TREE_GROUP_NONE;
987   return BROTLI_DECODER_SUCCESS;
988 }
989 
990 /* Decodes a context map.
991    Decoding is done in 4 phases:
992     1) Read auxiliary information (6..16 bits) and allocate memory.
993        In case of trivial context map, decoding is finished at this phase.
994     2) Decode Huffman table using ReadHuffmanCode function.
995        This table will be used for reading context map items.
996     3) Read context map items; "0" values could be run-length encoded.
997     4) Optionally, apply InverseMoveToFront transform to the resulting map. */
DecodeContextMap(brotli_reg_t context_map_size,brotli_reg_t * num_htrees,uint8_t ** context_map_arg,BrotliDecoderState * s)998 static BrotliDecoderErrorCode DecodeContextMap(brotli_reg_t context_map_size,
999                                                brotli_reg_t* num_htrees,
1000                                                uint8_t** context_map_arg,
1001                                                BrotliDecoderState* s) {
1002   BrotliBitReader* br = &s->br;
1003   BrotliDecoderErrorCode result = BROTLI_DECODER_SUCCESS;
1004   BrotliMetablockHeaderArena* h = &s->arena.header;
1005 
1006   switch ((int)h->substate_context_map) {
1007     case BROTLI_STATE_CONTEXT_MAP_NONE:
1008       result = DecodeVarLenUint8(s, br, num_htrees);
1009       if (result != BROTLI_DECODER_SUCCESS) {
1010         return result;
1011       }
1012       (*num_htrees)++;
1013       h->context_index = 0;
1014       BROTLI_LOG_UINT(context_map_size);
1015       BROTLI_LOG_UINT(*num_htrees);
1016       *context_map_arg =
1017           (uint8_t*)BROTLI_DECODER_ALLOC(s, (size_t)context_map_size);
1018       if (*context_map_arg == 0) {
1019         return BROTLI_FAILURE(BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP);
1020       }
1021       if (*num_htrees <= 1) {
1022         memset(*context_map_arg, 0, (size_t)context_map_size);
1023         return BROTLI_DECODER_SUCCESS;
1024       }
1025       h->substate_context_map = BROTLI_STATE_CONTEXT_MAP_READ_PREFIX;
1026     /* Fall through. */
1027 
1028     case BROTLI_STATE_CONTEXT_MAP_READ_PREFIX: {
1029       brotli_reg_t bits;
1030       /* In next stage ReadHuffmanCode uses at least 4 bits, so it is safe
1031          to peek 4 bits ahead. */
1032       if (!BrotliSafeGetBits(br, 5, &bits)) {
1033         return BROTLI_DECODER_NEEDS_MORE_INPUT;
1034       }
1035       if ((bits & 1) != 0) { /* Use RLE for zeros. */
1036         h->max_run_length_prefix = (bits >> 1) + 1;
1037         BrotliDropBits(br, 5);
1038       } else {
1039         h->max_run_length_prefix = 0;
1040         BrotliDropBits(br, 1);
1041       }
1042       BROTLI_LOG_UINT(h->max_run_length_prefix);
1043       h->substate_context_map = BROTLI_STATE_CONTEXT_MAP_HUFFMAN;
1044     }
1045     /* Fall through. */
1046 
1047     case BROTLI_STATE_CONTEXT_MAP_HUFFMAN: {
1048       brotli_reg_t alphabet_size = *num_htrees + h->max_run_length_prefix;
1049       result = ReadHuffmanCode(alphabet_size, alphabet_size,
1050                                h->context_map_table, NULL, s);
1051       if (result != BROTLI_DECODER_SUCCESS) return result;
1052       h->code = 0xFFFF;
1053       h->substate_context_map = BROTLI_STATE_CONTEXT_MAP_DECODE;
1054     }
1055     /* Fall through. */
1056 
1057     case BROTLI_STATE_CONTEXT_MAP_DECODE: {
1058       brotli_reg_t context_index = h->context_index;
1059       brotli_reg_t max_run_length_prefix = h->max_run_length_prefix;
1060       uint8_t* context_map = *context_map_arg;
1061       brotli_reg_t code = h->code;
1062       BROTLI_BOOL skip_preamble = (code != 0xFFFF);
1063       while (context_index < context_map_size || skip_preamble) {
1064         if (!skip_preamble) {
1065           if (!SafeReadSymbol(h->context_map_table, br, &code)) {
1066             h->code = 0xFFFF;
1067             h->context_index = context_index;
1068             return BROTLI_DECODER_NEEDS_MORE_INPUT;
1069           }
1070           BROTLI_LOG_UINT(code);
1071 
1072           if (code == 0) {
1073             context_map[context_index++] = 0;
1074             continue;
1075           }
1076           if (code > max_run_length_prefix) {
1077             context_map[context_index++] =
1078                 (uint8_t)(code - max_run_length_prefix);
1079             continue;
1080           }
1081         } else {
1082           skip_preamble = BROTLI_FALSE;
1083         }
1084         /* RLE sub-stage. */
1085         {
1086           brotli_reg_t reps;
1087           if (!BrotliSafeReadBits(br, code, &reps)) {
1088             h->code = code;
1089             h->context_index = context_index;
1090             return BROTLI_DECODER_NEEDS_MORE_INPUT;
1091           }
1092           reps += 1U << code;
1093           BROTLI_LOG_UINT(reps);
1094           if (context_index + reps > context_map_size) {
1095             return
1096                 BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT);
1097           }
1098           do {
1099             context_map[context_index++] = 0;
1100           } while (--reps);
1101         }
1102       }
1103     }
1104     /* Fall through. */
1105 
1106     case BROTLI_STATE_CONTEXT_MAP_TRANSFORM: {
1107       brotli_reg_t bits;
1108       if (!BrotliSafeReadBits(br, 1, &bits)) {
1109         h->substate_context_map = BROTLI_STATE_CONTEXT_MAP_TRANSFORM;
1110         return BROTLI_DECODER_NEEDS_MORE_INPUT;
1111       }
1112       if (bits != 0) {
1113         InverseMoveToFrontTransform(*context_map_arg, context_map_size, s);
1114       }
1115       h->substate_context_map = BROTLI_STATE_CONTEXT_MAP_NONE;
1116       return BROTLI_DECODER_SUCCESS;
1117     }
1118 
1119     default:
1120       return
1121           BROTLI_FAILURE(BROTLI_DECODER_ERROR_UNREACHABLE);  /* COV_NF_LINE */
1122   }
1123 }
1124 
1125 /* Decodes a command or literal and updates block type ring-buffer.
1126    Reads 3..54 bits. */
DecodeBlockTypeAndLength(int safe,BrotliDecoderState * s,int tree_type)1127 static BROTLI_INLINE BROTLI_BOOL DecodeBlockTypeAndLength(
1128     int safe, BrotliDecoderState* s, int tree_type) {
1129   brotli_reg_t max_block_type = s->num_block_types[tree_type];
1130   const HuffmanCode* type_tree = &s->block_type_trees[
1131       tree_type * BROTLI_HUFFMAN_MAX_SIZE_258];
1132   const HuffmanCode* len_tree = &s->block_len_trees[
1133       tree_type * BROTLI_HUFFMAN_MAX_SIZE_26];
1134   BrotliBitReader* br = &s->br;
1135   brotli_reg_t* ringbuffer = &s->block_type_rb[tree_type * 2];
1136   brotli_reg_t block_type;
1137   if (max_block_type <= 1) {
1138     return BROTLI_FALSE;
1139   }
1140 
1141   /* Read 0..15 + 3..39 bits. */
1142   if (!safe) {
1143     block_type = ReadSymbol(type_tree, br);
1144     s->block_length[tree_type] = ReadBlockLength(len_tree, br);
1145   } else {
1146     BrotliBitReaderState memento;
1147     BrotliBitReaderSaveState(br, &memento);
1148     if (!SafeReadSymbol(type_tree, br, &block_type)) return BROTLI_FALSE;
1149     if (!SafeReadBlockLength(s, &s->block_length[tree_type], len_tree, br)) {
1150       s->substate_read_block_length = BROTLI_STATE_READ_BLOCK_LENGTH_NONE;
1151       BrotliBitReaderRestoreState(br, &memento);
1152       return BROTLI_FALSE;
1153     }
1154   }
1155 
1156   if (block_type == 1) {
1157     block_type = ringbuffer[1] + 1;
1158   } else if (block_type == 0) {
1159     block_type = ringbuffer[0];
1160   } else {
1161     block_type -= 2;
1162   }
1163   if (block_type >= max_block_type) {
1164     block_type -= max_block_type;
1165   }
1166   ringbuffer[0] = ringbuffer[1];
1167   ringbuffer[1] = block_type;
1168   return BROTLI_TRUE;
1169 }
1170 
DetectTrivialLiteralBlockTypes(BrotliDecoderState * s)1171 static BROTLI_INLINE void DetectTrivialLiteralBlockTypes(
1172     BrotliDecoderState* s) {
1173   size_t i;
1174   for (i = 0; i < 8; ++i) s->trivial_literal_contexts[i] = 0;
1175   for (i = 0; i < s->num_block_types[0]; i++) {
1176     size_t offset = i << BROTLI_LITERAL_CONTEXT_BITS;
1177     size_t error = 0;
1178     size_t sample = s->context_map[offset];
1179     size_t j;
1180     for (j = 0; j < (1u << BROTLI_LITERAL_CONTEXT_BITS);) {
1181       /* NOLINTNEXTLINE(bugprone-macro-repeated-side-effects) */
1182       BROTLI_REPEAT_4({ error |= s->context_map[offset + j++] ^ sample; })
1183     }
1184     if (error == 0) {
1185       s->trivial_literal_contexts[i >> 5] |= 1u << (i & 31);
1186     }
1187   }
1188 }
1189 
PrepareLiteralDecoding(BrotliDecoderState * s)1190 static BROTLI_INLINE void PrepareLiteralDecoding(BrotliDecoderState* s) {
1191   uint8_t context_mode;
1192   size_t trivial;
1193   brotli_reg_t block_type = s->block_type_rb[1];
1194   brotli_reg_t context_offset = block_type << BROTLI_LITERAL_CONTEXT_BITS;
1195   s->context_map_slice = s->context_map + context_offset;
1196   trivial = s->trivial_literal_contexts[block_type >> 5];
1197   s->trivial_literal_context = (trivial >> (block_type & 31)) & 1;
1198   s->literal_htree = s->literal_hgroup.htrees[s->context_map_slice[0]];
1199   context_mode = s->context_modes[block_type] & 3;
1200   s->context_lookup = BROTLI_CONTEXT_LUT(context_mode);
1201 }
1202 
1203 /* Decodes the block type and updates the state for literal context.
1204    Reads 3..54 bits. */
DecodeLiteralBlockSwitchInternal(int safe,BrotliDecoderState * s)1205 static BROTLI_INLINE BROTLI_BOOL DecodeLiteralBlockSwitchInternal(
1206     int safe, BrotliDecoderState* s) {
1207   if (!DecodeBlockTypeAndLength(safe, s, 0)) {
1208     return BROTLI_FALSE;
1209   }
1210   PrepareLiteralDecoding(s);
1211   return BROTLI_TRUE;
1212 }
1213 
DecodeLiteralBlockSwitch(BrotliDecoderState * s)1214 static void BROTLI_NOINLINE DecodeLiteralBlockSwitch(BrotliDecoderState* s) {
1215   DecodeLiteralBlockSwitchInternal(0, s);
1216 }
1217 
SafeDecodeLiteralBlockSwitch(BrotliDecoderState * s)1218 static BROTLI_BOOL BROTLI_NOINLINE SafeDecodeLiteralBlockSwitch(
1219     BrotliDecoderState* s) {
1220   return DecodeLiteralBlockSwitchInternal(1, s);
1221 }
1222 
1223 /* Block switch for insert/copy length.
1224    Reads 3..54 bits. */
DecodeCommandBlockSwitchInternal(int safe,BrotliDecoderState * s)1225 static BROTLI_INLINE BROTLI_BOOL DecodeCommandBlockSwitchInternal(
1226     int safe, BrotliDecoderState* s) {
1227   if (!DecodeBlockTypeAndLength(safe, s, 1)) {
1228     return BROTLI_FALSE;
1229   }
1230   s->htree_command = s->insert_copy_hgroup.htrees[s->block_type_rb[3]];
1231   return BROTLI_TRUE;
1232 }
1233 
DecodeCommandBlockSwitch(BrotliDecoderState * s)1234 static void BROTLI_NOINLINE DecodeCommandBlockSwitch(BrotliDecoderState* s) {
1235   DecodeCommandBlockSwitchInternal(0, s);
1236 }
1237 
SafeDecodeCommandBlockSwitch(BrotliDecoderState * s)1238 static BROTLI_BOOL BROTLI_NOINLINE SafeDecodeCommandBlockSwitch(
1239     BrotliDecoderState* s) {
1240   return DecodeCommandBlockSwitchInternal(1, s);
1241 }
1242 
1243 /* Block switch for distance codes.
1244    Reads 3..54 bits. */
DecodeDistanceBlockSwitchInternal(int safe,BrotliDecoderState * s)1245 static BROTLI_INLINE BROTLI_BOOL DecodeDistanceBlockSwitchInternal(
1246     int safe, BrotliDecoderState* s) {
1247   if (!DecodeBlockTypeAndLength(safe, s, 2)) {
1248     return BROTLI_FALSE;
1249   }
1250   s->dist_context_map_slice = s->dist_context_map +
1251       (s->block_type_rb[5] << BROTLI_DISTANCE_CONTEXT_BITS);
1252   s->dist_htree_index = s->dist_context_map_slice[s->distance_context];
1253   return BROTLI_TRUE;
1254 }
1255 
DecodeDistanceBlockSwitch(BrotliDecoderState * s)1256 static void BROTLI_NOINLINE DecodeDistanceBlockSwitch(BrotliDecoderState* s) {
1257   DecodeDistanceBlockSwitchInternal(0, s);
1258 }
1259 
SafeDecodeDistanceBlockSwitch(BrotliDecoderState * s)1260 static BROTLI_BOOL BROTLI_NOINLINE SafeDecodeDistanceBlockSwitch(
1261     BrotliDecoderState* s) {
1262   return DecodeDistanceBlockSwitchInternal(1, s);
1263 }
1264 
UnwrittenBytes(const BrotliDecoderState * s,BROTLI_BOOL wrap)1265 static size_t UnwrittenBytes(const BrotliDecoderState* s, BROTLI_BOOL wrap) {
1266   size_t pos = wrap && s->pos > s->ringbuffer_size ?
1267       (size_t)s->ringbuffer_size : (size_t)(s->pos);
1268   size_t partial_pos_rb = (s->rb_roundtrips * (size_t)s->ringbuffer_size) + pos;
1269   return partial_pos_rb - s->partial_pos_out;
1270 }
1271 
1272 /* Dumps output.
1273    Returns BROTLI_DECODER_NEEDS_MORE_OUTPUT only if there is more output to push
1274    and either ring-buffer is as big as window size, or |force| is true. */
WriteRingBuffer(BrotliDecoderState * s,size_t * available_out,uint8_t ** next_out,size_t * total_out,BROTLI_BOOL force)1275 static BrotliDecoderErrorCode BROTLI_NOINLINE WriteRingBuffer(
1276     BrotliDecoderState* s, size_t* available_out, uint8_t** next_out,
1277     size_t* total_out, BROTLI_BOOL force) {
1278   uint8_t* start =
1279       s->ringbuffer + (s->partial_pos_out & (size_t)s->ringbuffer_mask);
1280   size_t to_write = UnwrittenBytes(s, BROTLI_TRUE);
1281   size_t num_written = *available_out;
1282   if (num_written > to_write) {
1283     num_written = to_write;
1284   }
1285   if (s->meta_block_remaining_len < 0) {
1286     return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1);
1287   }
1288   if (next_out && !*next_out) {
1289     *next_out = start;
1290   } else {
1291     if (next_out) {
1292       memcpy(*next_out, start, num_written);
1293       *next_out += num_written;
1294     }
1295   }
1296   *available_out -= num_written;
1297   BROTLI_LOG_UINT(to_write);
1298   BROTLI_LOG_UINT(num_written);
1299   s->partial_pos_out += num_written;
1300   if (total_out) {
1301     *total_out = s->partial_pos_out;
1302   }
1303   if (num_written < to_write) {
1304     if (s->ringbuffer_size == (1 << s->window_bits) || force) {
1305       return BROTLI_DECODER_NEEDS_MORE_OUTPUT;
1306     } else {
1307       return BROTLI_DECODER_SUCCESS;
1308     }
1309   }
1310   /* Wrap ring buffer only if it has reached its maximal size. */
1311   if (s->ringbuffer_size == (1 << s->window_bits) &&
1312       s->pos >= s->ringbuffer_size) {
1313     s->pos -= s->ringbuffer_size;
1314     s->rb_roundtrips++;
1315     s->should_wrap_ringbuffer = (size_t)s->pos != 0 ? 1 : 0;
1316   }
1317   return BROTLI_DECODER_SUCCESS;
1318 }
1319 
WrapRingBuffer(BrotliDecoderState * s)1320 static void BROTLI_NOINLINE WrapRingBuffer(BrotliDecoderState* s) {
1321   if (s->should_wrap_ringbuffer) {
1322     memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
1323     s->should_wrap_ringbuffer = 0;
1324   }
1325 }
1326 
1327 /* Allocates ring-buffer.
1328 
1329    s->ringbuffer_size MUST be updated by BrotliCalculateRingBufferSize before
1330    this function is called.
1331 
1332    Last two bytes of ring-buffer are initialized to 0, so context calculation
1333    could be done uniformly for the first two and all other positions. */
BrotliEnsureRingBuffer(BrotliDecoderState * s)1334 static BROTLI_BOOL BROTLI_NOINLINE BrotliEnsureRingBuffer(
1335     BrotliDecoderState* s) {
1336   uint8_t* old_ringbuffer = s->ringbuffer;
1337   if (s->ringbuffer_size == s->new_ringbuffer_size) {
1338     return BROTLI_TRUE;
1339   }
1340 
1341   s->ringbuffer = (uint8_t*)BROTLI_DECODER_ALLOC(s,
1342       (size_t)(s->new_ringbuffer_size) + kRingBufferWriteAheadSlack);
1343   if (s->ringbuffer == 0) {
1344     /* Restore previous value. */
1345     s->ringbuffer = old_ringbuffer;
1346     return BROTLI_FALSE;
1347   }
1348   s->ringbuffer[s->new_ringbuffer_size - 2] = 0;
1349   s->ringbuffer[s->new_ringbuffer_size - 1] = 0;
1350 
1351   if (!!old_ringbuffer) {
1352     memcpy(s->ringbuffer, old_ringbuffer, (size_t)s->pos);
1353     BROTLI_DECODER_FREE(s, old_ringbuffer);
1354   }
1355 
1356   s->ringbuffer_size = s->new_ringbuffer_size;
1357   s->ringbuffer_mask = s->new_ringbuffer_size - 1;
1358   s->ringbuffer_end = s->ringbuffer + s->ringbuffer_size;
1359 
1360   return BROTLI_TRUE;
1361 }
1362 
1363 static BrotliDecoderErrorCode BROTLI_NOINLINE
SkipMetadataBlock(BrotliDecoderState * s)1364 SkipMetadataBlock(BrotliDecoderState* s) {
1365   BrotliBitReader* br = &s->br;
1366 
1367   if (s->meta_block_remaining_len == 0) {
1368     return BROTLI_DECODER_SUCCESS;
1369   }
1370 
1371   BROTLI_DCHECK((BrotliGetAvailableBits(br) & 7) == 0);
1372 
1373   /* Drain accumulator. */
1374   if (BrotliGetAvailableBits(br) >= 8) {
1375     uint8_t buffer[8];
1376     int nbytes = (int)(BrotliGetAvailableBits(br)) >> 3;
1377     BROTLI_DCHECK(nbytes <= 8);
1378     if (nbytes > s->meta_block_remaining_len) {
1379       nbytes = s->meta_block_remaining_len;
1380     }
1381     BrotliCopyBytes(buffer, br, (size_t)nbytes);
1382     if (s->metadata_chunk_func) {
1383       s->metadata_chunk_func(s->metadata_callback_opaque, buffer,
1384                              (size_t)nbytes);
1385     }
1386     s->meta_block_remaining_len -= nbytes;
1387     if (s->meta_block_remaining_len == 0) {
1388       return BROTLI_DECODER_SUCCESS;
1389     }
1390   }
1391 
1392   /* Direct access to metadata is possible. */
1393   int nbytes = (int)BrotliGetRemainingBytes(br);
1394   if (nbytes > s->meta_block_remaining_len) {
1395     nbytes = s->meta_block_remaining_len;
1396   }
1397   if (nbytes > 0) {
1398     if (s->metadata_chunk_func) {
1399       s->metadata_chunk_func(s->metadata_callback_opaque, br->next_in,
1400                              (size_t)nbytes);
1401     }
1402     BrotliDropBytes(br, (size_t)nbytes);
1403     s->meta_block_remaining_len -= nbytes;
1404     if (s->meta_block_remaining_len == 0) {
1405       return BROTLI_DECODER_SUCCESS;
1406     }
1407   }
1408 
1409   BROTLI_DCHECK(BrotliGetRemainingBytes(br) == 0);
1410 
1411   return BROTLI_DECODER_NEEDS_MORE_INPUT;
1412 }
1413 
CopyUncompressedBlockToOutput(size_t * available_out,uint8_t ** next_out,size_t * total_out,BrotliDecoderState * s)1414 static BrotliDecoderErrorCode BROTLI_NOINLINE CopyUncompressedBlockToOutput(
1415     size_t* available_out, uint8_t** next_out, size_t* total_out,
1416     BrotliDecoderState* s) {
1417   /* TODO(eustas): avoid allocation for single uncompressed block. */
1418   if (!BrotliEnsureRingBuffer(s)) {
1419     return BROTLI_FAILURE(BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1);
1420   }
1421 
1422   /* State machine */
1423   for (;;) {
1424     switch (s->substate_uncompressed) {
1425       case BROTLI_STATE_UNCOMPRESSED_NONE: {
1426         int nbytes = (int)BrotliGetRemainingBytes(&s->br);
1427         if (nbytes > s->meta_block_remaining_len) {
1428           nbytes = s->meta_block_remaining_len;
1429         }
1430         if (s->pos + nbytes > s->ringbuffer_size) {
1431           nbytes = s->ringbuffer_size - s->pos;
1432         }
1433         /* Copy remaining bytes from s->br.buf_ to ring-buffer. */
1434         BrotliCopyBytes(&s->ringbuffer[s->pos], &s->br, (size_t)nbytes);
1435         s->pos += nbytes;
1436         s->meta_block_remaining_len -= nbytes;
1437         if (s->pos < 1 << s->window_bits) {
1438           if (s->meta_block_remaining_len == 0) {
1439             return BROTLI_DECODER_SUCCESS;
1440           }
1441           return BROTLI_DECODER_NEEDS_MORE_INPUT;
1442         }
1443         s->substate_uncompressed = BROTLI_STATE_UNCOMPRESSED_WRITE;
1444       }
1445       /* Fall through. */
1446 
1447       case BROTLI_STATE_UNCOMPRESSED_WRITE: {
1448         BrotliDecoderErrorCode result;
1449         result = WriteRingBuffer(
1450             s, available_out, next_out, total_out, BROTLI_FALSE);
1451         if (result != BROTLI_DECODER_SUCCESS) {
1452           return result;
1453         }
1454         if (s->ringbuffer_size == 1 << s->window_bits) {
1455           s->max_distance = s->max_backward_distance;
1456         }
1457         s->substate_uncompressed = BROTLI_STATE_UNCOMPRESSED_NONE;
1458         break;
1459       }
1460     }
1461   }
1462   BROTLI_DCHECK(0);  /* Unreachable */
1463 }
1464 
AttachCompoundDictionary(BrotliDecoderState * state,const uint8_t * data,size_t size)1465 static BROTLI_BOOL AttachCompoundDictionary(
1466     BrotliDecoderState* state, const uint8_t* data, size_t size) {
1467   BrotliDecoderCompoundDictionary* addon = state->compound_dictionary;
1468   if (state->state != BROTLI_STATE_UNINITED) return BROTLI_FALSE;
1469   if (!addon) {
1470     addon = (BrotliDecoderCompoundDictionary*)BROTLI_DECODER_ALLOC(
1471         state, sizeof(BrotliDecoderCompoundDictionary));
1472     if (!addon) return BROTLI_FALSE;
1473     addon->num_chunks = 0;
1474     addon->total_size = 0;
1475     addon->br_length = 0;
1476     addon->br_copied = 0;
1477     addon->block_bits = -1;
1478     addon->chunk_offsets[0] = 0;
1479     state->compound_dictionary = addon;
1480   }
1481   if (addon->num_chunks == 15) return BROTLI_FALSE;
1482   addon->chunks[addon->num_chunks] = data;
1483   addon->num_chunks++;
1484   addon->total_size += (int)size;
1485   addon->chunk_offsets[addon->num_chunks] = addon->total_size;
1486   return BROTLI_TRUE;
1487 }
1488 
EnsureCoumpoundDictionaryInitialized(BrotliDecoderState * state)1489 static void EnsureCoumpoundDictionaryInitialized(BrotliDecoderState* state) {
1490   BrotliDecoderCompoundDictionary* addon = state->compound_dictionary;
1491   /* 256 = (1 << 8) slots in block map. */
1492   int block_bits = 8;
1493   int cursor = 0;
1494   int index = 0;
1495   if (addon->block_bits != -1) return;
1496   while (((addon->total_size - 1) >> block_bits) != 0) block_bits++;
1497   block_bits -= 8;
1498   addon->block_bits = block_bits;
1499   while (cursor < addon->total_size) {
1500     while (addon->chunk_offsets[index + 1] < cursor) index++;
1501     addon->block_map[cursor >> block_bits] = (uint8_t)index;
1502     cursor += 1 << block_bits;
1503   }
1504 }
1505 
InitializeCompoundDictionaryCopy(BrotliDecoderState * s,int address,int length)1506 static BROTLI_BOOL InitializeCompoundDictionaryCopy(BrotliDecoderState* s,
1507     int address, int length) {
1508   BrotliDecoderCompoundDictionary* addon = s->compound_dictionary;
1509   int index;
1510   EnsureCoumpoundDictionaryInitialized(s);
1511   index = addon->block_map[address >> addon->block_bits];
1512   while (address >= addon->chunk_offsets[index + 1]) index++;
1513   if (addon->total_size < address + length) return BROTLI_FALSE;
1514   /* Update the recent distances cache. */
1515   s->dist_rb[s->dist_rb_idx & 3] = s->distance_code;
1516   ++s->dist_rb_idx;
1517   s->meta_block_remaining_len -= length;
1518   addon->br_index = index;
1519   addon->br_offset = address - addon->chunk_offsets[index];
1520   addon->br_length = length;
1521   addon->br_copied = 0;
1522   return BROTLI_TRUE;
1523 }
1524 
GetCompoundDictionarySize(BrotliDecoderState * s)1525 static int GetCompoundDictionarySize(BrotliDecoderState* s) {
1526   return s->compound_dictionary ? s->compound_dictionary->total_size : 0;
1527 }
1528 
CopyFromCompoundDictionary(BrotliDecoderState * s,int pos)1529 static int CopyFromCompoundDictionary(BrotliDecoderState* s, int pos) {
1530   BrotliDecoderCompoundDictionary* addon = s->compound_dictionary;
1531   int orig_pos = pos;
1532   while (addon->br_length != addon->br_copied) {
1533     uint8_t* copy_dst = &s->ringbuffer[pos];
1534     const uint8_t* copy_src =
1535         addon->chunks[addon->br_index] + addon->br_offset;
1536     int space = s->ringbuffer_size - pos;
1537     int rem_chunk_length = (addon->chunk_offsets[addon->br_index + 1] -
1538         addon->chunk_offsets[addon->br_index]) - addon->br_offset;
1539     int length = addon->br_length - addon->br_copied;
1540     if (length > rem_chunk_length) length = rem_chunk_length;
1541     if (length > space) length = space;
1542     memcpy(copy_dst, copy_src, (size_t)length);
1543     pos += length;
1544     addon->br_offset += length;
1545     addon->br_copied += length;
1546     if (length == rem_chunk_length) {
1547       addon->br_index++;
1548       addon->br_offset = 0;
1549     }
1550     if (pos == s->ringbuffer_size) break;
1551   }
1552   return pos - orig_pos;
1553 }
1554 
BrotliDecoderAttachDictionary(BrotliDecoderState * state,BrotliSharedDictionaryType type,size_t data_size,const uint8_t data[BROTLI_ARRAY_PARAM (data_size)])1555 BROTLI_BOOL BrotliDecoderAttachDictionary(
1556     BrotliDecoderState* state, BrotliSharedDictionaryType type,
1557     size_t data_size, const uint8_t data[BROTLI_ARRAY_PARAM(data_size)]) {
1558   brotli_reg_t i;
1559   brotli_reg_t num_prefix_before = state->dictionary->num_prefix;
1560   if (state->state != BROTLI_STATE_UNINITED) return BROTLI_FALSE;
1561   if (!BrotliSharedDictionaryAttach(state->dictionary, type, data_size, data)) {
1562     return BROTLI_FALSE;
1563   }
1564   for (i = num_prefix_before; i < state->dictionary->num_prefix; i++) {
1565     if (!AttachCompoundDictionary(
1566         state, state->dictionary->prefix[i],
1567         state->dictionary->prefix_size[i])) {
1568       return BROTLI_FALSE;
1569     }
1570   }
1571   return BROTLI_TRUE;
1572 }
1573 
1574 /* Calculates the smallest feasible ring buffer.
1575 
1576    If we know the data size is small, do not allocate more ring buffer
1577    size than needed to reduce memory usage.
1578 
1579    When this method is called, metablock size and flags MUST be decoded. */
BrotliCalculateRingBufferSize(BrotliDecoderState * s)1580 static void BROTLI_NOINLINE BrotliCalculateRingBufferSize(
1581     BrotliDecoderState* s) {
1582   int window_size = 1 << s->window_bits;
1583   int new_ringbuffer_size = window_size;
1584   /* We need at least 2 bytes of ring buffer size to get the last two
1585      bytes for context from there */
1586   int min_size = s->ringbuffer_size ? s->ringbuffer_size : 1024;
1587   int output_size;
1588 
1589   /* If maximum is already reached, no further extension is retired. */
1590   if (s->ringbuffer_size == window_size) {
1591     return;
1592   }
1593 
1594   /* Metadata blocks does not touch ring buffer. */
1595   if (s->is_metadata) {
1596     return;
1597   }
1598 
1599   if (!s->ringbuffer) {
1600     output_size = 0;
1601   } else {
1602     output_size = s->pos;
1603   }
1604   output_size += s->meta_block_remaining_len;
1605   min_size = min_size < output_size ? output_size : min_size;
1606 
1607   if (!!s->canny_ringbuffer_allocation) {
1608     /* Reduce ring buffer size to save memory when server is unscrupulous.
1609        In worst case memory usage might be 1.5x bigger for a short period of
1610        ring buffer reallocation. */
1611     while ((new_ringbuffer_size >> 1) >= min_size) {
1612       new_ringbuffer_size >>= 1;
1613     }
1614   }
1615 
1616   s->new_ringbuffer_size = new_ringbuffer_size;
1617 }
1618 
1619 /* Reads 1..256 2-bit context modes. */
ReadContextModes(BrotliDecoderState * s)1620 static BrotliDecoderErrorCode ReadContextModes(BrotliDecoderState* s) {
1621   BrotliBitReader* br = &s->br;
1622   int i = s->loop_counter;
1623 
1624   while (i < (int)s->num_block_types[0]) {
1625     brotli_reg_t bits;
1626     if (!BrotliSafeReadBits(br, 2, &bits)) {
1627       s->loop_counter = i;
1628       return BROTLI_DECODER_NEEDS_MORE_INPUT;
1629     }
1630     s->context_modes[i] = (uint8_t)bits;
1631     BROTLI_LOG_ARRAY_INDEX(s->context_modes, i);
1632     i++;
1633   }
1634   return BROTLI_DECODER_SUCCESS;
1635 }
1636 
TakeDistanceFromRingBuffer(BrotliDecoderState * s)1637 static BROTLI_INLINE void TakeDistanceFromRingBuffer(BrotliDecoderState* s) {
1638   int offset = s->distance_code - 3;
1639   if (s->distance_code <= 3) {
1640     /* Compensate double distance-ring-buffer roll for dictionary items. */
1641     s->distance_context = 1 >> s->distance_code;
1642     s->distance_code = s->dist_rb[(s->dist_rb_idx - offset) & 3];
1643     s->dist_rb_idx -= s->distance_context;
1644   } else {
1645     int index_delta = 3;
1646     int delta;
1647     int base = s->distance_code - 10;
1648     if (s->distance_code < 10) {
1649       base = s->distance_code - 4;
1650     } else {
1651       index_delta = 2;
1652     }
1653     /* Unpack one of six 4-bit values. */
1654     delta = ((0x605142 >> (4 * base)) & 0xF) - 3;
1655     s->distance_code = s->dist_rb[(s->dist_rb_idx + index_delta) & 0x3] + delta;
1656     if (s->distance_code <= 0) {
1657       /* A huge distance will cause a BROTLI_FAILURE() soon.
1658          This is a little faster than failing here. */
1659       s->distance_code = 0x7FFFFFFF;
1660     }
1661   }
1662 }
1663 
SafeReadBits(BrotliBitReader * const br,brotli_reg_t n_bits,brotli_reg_t * val)1664 static BROTLI_INLINE BROTLI_BOOL SafeReadBits(
1665     BrotliBitReader* const br, brotli_reg_t n_bits, brotli_reg_t* val) {
1666   if (n_bits != 0) {
1667     return BrotliSafeReadBits(br, n_bits, val);
1668   } else {
1669     *val = 0;
1670     return BROTLI_TRUE;
1671   }
1672 }
1673 
SafeReadBits32(BrotliBitReader * const br,brotli_reg_t n_bits,brotli_reg_t * val)1674 static BROTLI_INLINE BROTLI_BOOL SafeReadBits32(
1675     BrotliBitReader* const br, brotli_reg_t n_bits, brotli_reg_t* val) {
1676   if (n_bits != 0) {
1677     return BrotliSafeReadBits32(br, n_bits, val);
1678   } else {
1679     *val = 0;
1680     return BROTLI_TRUE;
1681   }
1682 }
1683 
1684 /*
1685    RFC 7932 Section 4 with "..." shortenings and "[]" emendations.
1686 
1687    Each distance ... is represented with a pair <distance code, extra bits>...
1688    The distance code is encoded using a prefix code... The number of extra bits
1689    can be 0..24... Two additional parameters: NPOSTFIX (0..3), and ...
1690    NDIRECT (0..120) ... are encoded in the meta-block header...
1691 
1692    The first 16 distance symbols ... reference past distances... ring buffer ...
1693    Next NDIRECT distance symbols ... represent distances from 1 to NDIRECT...
1694    [For] distance symbols 16 + NDIRECT and greater ... the number of extra bits
1695    ... is given by the following formula:
1696 
1697    [ xcode = dcode - NDIRECT - 16 ]
1698    ndistbits = 1 + [ xcode ] >> (NPOSTFIX + 1)
1699 
1700    ...
1701 */
1702 
1703 /*
1704    RFC 7932 Section 9.2 with "..." shortenings and "[]" emendations.
1705 
1706    ... to get the actual value of the parameter NDIRECT, left-shift this
1707    four-bit number by NPOSTFIX bits ...
1708 */
1709 
1710 /* Remaining formulas from RFC 7932 Section 4 could be rewritten as following:
1711 
1712      alphabet_size = 16 + NDIRECT + (max_distbits << (NPOSTFIX + 1))
1713 
1714      half = ((xcode >> NPOSTFIX) & 1) << ndistbits
1715      postfix = xcode & ((1 << NPOSTFIX) - 1)
1716      range_start = 2 * (1 << ndistbits - 1 - 1)
1717 
1718      distance = (range_start + half + extra) << NPOSTFIX + postfix + NDIRECT + 1
1719 
1720    NB: ndistbits >= 1 -> range_start >= 0
1721    NB: range_start has factor 2, as the range is covered by 2 "halves"
1722    NB: extra -1 offset in range_start formula covers the absence of
1723        ndistbits = 0 case
1724    NB: when NPOSTFIX = 0, NDIRECT is not greater than 15
1725 
1726    In other words, xcode has the following binary structure - XXXHPPP:
1727     - XXX represent the number of extra distance bits
1728     - H selects upper / lower range of distances
1729     - PPP represent "postfix"
1730 
1731   "Regular" distance encoding has NPOSTFIX = 0; omitting the postfix part
1732   simplifies distance calculation.
1733 
1734   Using NPOSTFIX > 0 allows cheaper encoding of regular structures, e.g. where
1735   most of distances have the same reminder of division by 2/4/8. For example,
1736   the table of int32_t values that come from different sources; if it is likely
1737   that 3 highest bytes of values from the same source are the same, then
1738   copy distance often looks like 4x + y.
1739 
1740   Distance calculation could be rewritten to:
1741 
1742     ndistbits = NDISTBITS(NDIRECT, NPOSTFIX)[dcode]
1743     distance = OFFSET(NDIRECT, NPOSTFIX)[dcode] + extra << NPOSTFIX
1744 
1745   NDISTBITS and OFFSET could be pre-calculated, as NDIRECT and NPOSTFIX could
1746   change only once per meta-block.
1747 */
1748 
1749 /* Calculates distance lookup table.
1750    NB: it is possible to have all 64 tables precalculated. */
CalculateDistanceLut(BrotliDecoderState * s)1751 static void CalculateDistanceLut(BrotliDecoderState* s) {
1752   BrotliMetablockBodyArena* b = &s->arena.body;
1753   brotli_reg_t npostfix = s->distance_postfix_bits;
1754   brotli_reg_t ndirect = s->num_direct_distance_codes;
1755   brotli_reg_t alphabet_size_limit = s->distance_hgroup.alphabet_size_limit;
1756   brotli_reg_t postfix = 1u << npostfix;
1757   brotli_reg_t j;
1758   brotli_reg_t bits = 1;
1759   brotli_reg_t half = 0;
1760 
1761   /* Skip short codes. */
1762   brotli_reg_t i = BROTLI_NUM_DISTANCE_SHORT_CODES;
1763 
1764   /* Fill direct codes. */
1765   for (j = 0; j < ndirect; ++j) {
1766     b->dist_extra_bits[i] = 0;
1767     b->dist_offset[i] = j + 1;
1768     ++i;
1769   }
1770 
1771   /* Fill regular distance codes. */
1772   while (i < alphabet_size_limit) {
1773     brotli_reg_t base = ndirect + ((((2 + half) << bits) - 4) << npostfix) + 1;
1774     /* Always fill the complete group. */
1775     for (j = 0; j < postfix; ++j) {
1776       b->dist_extra_bits[i] = (uint8_t)bits;
1777       b->dist_offset[i] = base + j;
1778       ++i;
1779     }
1780     bits = bits + half;
1781     half = half ^ 1;
1782   }
1783 }
1784 
1785 /* Precondition: s->distance_code < 0. */
ReadDistanceInternal(int safe,BrotliDecoderState * s,BrotliBitReader * br)1786 static BROTLI_INLINE BROTLI_BOOL ReadDistanceInternal(
1787     int safe, BrotliDecoderState* s, BrotliBitReader* br) {
1788   BrotliMetablockBodyArena* b = &s->arena.body;
1789   brotli_reg_t code;
1790   brotli_reg_t bits;
1791   BrotliBitReaderState memento;
1792   HuffmanCode* distance_tree = s->distance_hgroup.htrees[s->dist_htree_index];
1793   if (!safe) {
1794     code = ReadSymbol(distance_tree, br);
1795   } else {
1796     BrotliBitReaderSaveState(br, &memento);
1797     if (!SafeReadSymbol(distance_tree, br, &code)) {
1798       return BROTLI_FALSE;
1799     }
1800   }
1801   --s->block_length[2];
1802   /* Convert the distance code to the actual distance by possibly
1803      looking up past distances from the s->dist_rb. */
1804   s->distance_context = 0;
1805   if ((code & ~0xFu) == 0) {
1806     s->distance_code = (int)code;
1807     TakeDistanceFromRingBuffer(s);
1808     return BROTLI_TRUE;
1809   }
1810   if (!safe) {
1811     bits = BrotliReadBits32(br, b->dist_extra_bits[code]);
1812   } else {
1813     if (!SafeReadBits32(br, b->dist_extra_bits[code], &bits)) {
1814       ++s->block_length[2];
1815       BrotliBitReaderRestoreState(br, &memento);
1816       return BROTLI_FALSE;
1817     }
1818   }
1819   s->distance_code =
1820       (int)(b->dist_offset[code] + (bits << s->distance_postfix_bits));
1821   return BROTLI_TRUE;
1822 }
1823 
ReadDistance(BrotliDecoderState * s,BrotliBitReader * br)1824 static BROTLI_INLINE void ReadDistance(
1825     BrotliDecoderState* s, BrotliBitReader* br) {
1826   ReadDistanceInternal(0, s, br);
1827 }
1828 
SafeReadDistance(BrotliDecoderState * s,BrotliBitReader * br)1829 static BROTLI_INLINE BROTLI_BOOL SafeReadDistance(
1830     BrotliDecoderState* s, BrotliBitReader* br) {
1831   return ReadDistanceInternal(1, s, br);
1832 }
1833 
ReadCommandInternal(int safe,BrotliDecoderState * s,BrotliBitReader * br,int * insert_length)1834 static BROTLI_INLINE BROTLI_BOOL ReadCommandInternal(
1835     int safe, BrotliDecoderState* s, BrotliBitReader* br, int* insert_length) {
1836   brotli_reg_t cmd_code;
1837   brotli_reg_t insert_len_extra = 0;
1838   brotli_reg_t copy_length;
1839   CmdLutElement v;
1840   BrotliBitReaderState memento;
1841   if (!safe) {
1842     cmd_code = ReadSymbol(s->htree_command, br);
1843   } else {
1844     BrotliBitReaderSaveState(br, &memento);
1845     if (!SafeReadSymbol(s->htree_command, br, &cmd_code)) {
1846       return BROTLI_FALSE;
1847     }
1848   }
1849   v = kCmdLut[cmd_code];
1850   s->distance_code = v.distance_code;
1851   s->distance_context = v.context;
1852   s->dist_htree_index = s->dist_context_map_slice[s->distance_context];
1853   *insert_length = v.insert_len_offset;
1854   if (!safe) {
1855     if (BROTLI_PREDICT_FALSE(v.insert_len_extra_bits != 0)) {
1856       insert_len_extra = BrotliReadBits24(br, v.insert_len_extra_bits);
1857     }
1858     copy_length = BrotliReadBits24(br, v.copy_len_extra_bits);
1859   } else {
1860     if (!SafeReadBits(br, v.insert_len_extra_bits, &insert_len_extra) ||
1861         !SafeReadBits(br, v.copy_len_extra_bits, &copy_length)) {
1862       BrotliBitReaderRestoreState(br, &memento);
1863       return BROTLI_FALSE;
1864     }
1865   }
1866   s->copy_length = (int)copy_length + v.copy_len_offset;
1867   --s->block_length[1];
1868   *insert_length += (int)insert_len_extra;
1869   return BROTLI_TRUE;
1870 }
1871 
ReadCommand(BrotliDecoderState * s,BrotliBitReader * br,int * insert_length)1872 static BROTLI_INLINE void ReadCommand(
1873     BrotliDecoderState* s, BrotliBitReader* br, int* insert_length) {
1874   ReadCommandInternal(0, s, br, insert_length);
1875 }
1876 
SafeReadCommand(BrotliDecoderState * s,BrotliBitReader * br,int * insert_length)1877 static BROTLI_INLINE BROTLI_BOOL SafeReadCommand(
1878     BrotliDecoderState* s, BrotliBitReader* br, int* insert_length) {
1879   return ReadCommandInternal(1, s, br, insert_length);
1880 }
1881 
CheckInputAmount(int safe,BrotliBitReader * const br)1882 static BROTLI_INLINE BROTLI_BOOL CheckInputAmount(
1883     int safe, BrotliBitReader* const br) {
1884   if (safe) {
1885     return BROTLI_TRUE;
1886   }
1887   return BrotliCheckInputAmount(br);
1888 }
1889 
1890 #define BROTLI_SAFE(METHOD)                       \
1891   {                                               \
1892     if (safe) {                                   \
1893       if (!Safe##METHOD) {                        \
1894         result = BROTLI_DECODER_NEEDS_MORE_INPUT; \
1895         goto saveStateAndReturn;                  \
1896       }                                           \
1897     } else {                                      \
1898       METHOD;                                     \
1899     }                                             \
1900   }
1901 
ProcessCommandsInternal(int safe,BrotliDecoderState * s)1902 static BROTLI_INLINE BrotliDecoderErrorCode ProcessCommandsInternal(
1903     int safe, BrotliDecoderState* s) {
1904   int pos = s->pos;
1905   int i = s->loop_counter;
1906   BrotliDecoderErrorCode result = BROTLI_DECODER_SUCCESS;
1907   BrotliBitReader* br = &s->br;
1908   int compound_dictionary_size = GetCompoundDictionarySize(s);
1909 
1910   if (!CheckInputAmount(safe, br)) {
1911     result = BROTLI_DECODER_NEEDS_MORE_INPUT;
1912     goto saveStateAndReturn;
1913   }
1914   if (!safe) {
1915     BROTLI_UNUSED(BrotliWarmupBitReader(br));
1916   }
1917 
1918   /* Jump into state machine. */
1919   if (s->state == BROTLI_STATE_COMMAND_BEGIN) {
1920     goto CommandBegin;
1921   } else if (s->state == BROTLI_STATE_COMMAND_INNER) {
1922     goto CommandInner;
1923   } else if (s->state == BROTLI_STATE_COMMAND_POST_DECODE_LITERALS) {
1924     goto CommandPostDecodeLiterals;
1925   } else if (s->state == BROTLI_STATE_COMMAND_POST_WRAP_COPY) {
1926     goto CommandPostWrapCopy;
1927   } else {
1928     return BROTLI_FAILURE(BROTLI_DECODER_ERROR_UNREACHABLE);  /* COV_NF_LINE */
1929   }
1930 
1931 CommandBegin:
1932   if (safe) {
1933     s->state = BROTLI_STATE_COMMAND_BEGIN;
1934   }
1935   if (!CheckInputAmount(safe, br)) {
1936     s->state = BROTLI_STATE_COMMAND_BEGIN;
1937     result = BROTLI_DECODER_NEEDS_MORE_INPUT;
1938     goto saveStateAndReturn;
1939   }
1940   if (BROTLI_PREDICT_FALSE(s->block_length[1] == 0)) {
1941     BROTLI_SAFE(DecodeCommandBlockSwitch(s));
1942     goto CommandBegin;
1943   }
1944   /* Read the insert/copy length in the command. */
1945   BROTLI_SAFE(ReadCommand(s, br, &i));
1946   BROTLI_LOG(("[ProcessCommandsInternal] pos = %d insert = %d copy = %d\n",
1947               pos, i, s->copy_length));
1948   if (i == 0) {
1949     goto CommandPostDecodeLiterals;
1950   }
1951   s->meta_block_remaining_len -= i;
1952 
1953 CommandInner:
1954   if (safe) {
1955     s->state = BROTLI_STATE_COMMAND_INNER;
1956   }
1957   /* Read the literals in the command. */
1958   if (s->trivial_literal_context) {
1959     brotli_reg_t bits;
1960     brotli_reg_t value;
1961     PreloadSymbol(safe, s->literal_htree, br, &bits, &value);
1962     do {
1963       if (!CheckInputAmount(safe, br)) {
1964         s->state = BROTLI_STATE_COMMAND_INNER;
1965         result = BROTLI_DECODER_NEEDS_MORE_INPUT;
1966         goto saveStateAndReturn;
1967       }
1968       if (BROTLI_PREDICT_FALSE(s->block_length[0] == 0)) {
1969         goto NextLiteralBlock;
1970       }
1971       if (!safe) {
1972         s->ringbuffer[pos] =
1973             (uint8_t)ReadPreloadedSymbol(s->literal_htree, br, &bits, &value);
1974       } else {
1975         brotli_reg_t literal;
1976         if (!SafeReadSymbol(s->literal_htree, br, &literal)) {
1977           result = BROTLI_DECODER_NEEDS_MORE_INPUT;
1978           goto saveStateAndReturn;
1979         }
1980         s->ringbuffer[pos] = (uint8_t)literal;
1981       }
1982       --s->block_length[0];
1983       BROTLI_LOG_ARRAY_INDEX(s->ringbuffer, pos);
1984       ++pos;
1985       if (BROTLI_PREDICT_FALSE(pos == s->ringbuffer_size)) {
1986         s->state = BROTLI_STATE_COMMAND_INNER_WRITE;
1987         --i;
1988         goto saveStateAndReturn;
1989       }
1990     } while (--i != 0);
1991   } else {
1992     uint8_t p1 = s->ringbuffer[(pos - 1) & s->ringbuffer_mask];
1993     uint8_t p2 = s->ringbuffer[(pos - 2) & s->ringbuffer_mask];
1994     do {
1995       const HuffmanCode* hc;
1996       uint8_t context;
1997       if (!CheckInputAmount(safe, br)) {
1998         s->state = BROTLI_STATE_COMMAND_INNER;
1999         result = BROTLI_DECODER_NEEDS_MORE_INPUT;
2000         goto saveStateAndReturn;
2001       }
2002       if (BROTLI_PREDICT_FALSE(s->block_length[0] == 0)) {
2003         goto NextLiteralBlock;
2004       }
2005       context = BROTLI_CONTEXT(p1, p2, s->context_lookup);
2006       BROTLI_LOG_UINT(context);
2007       hc = s->literal_hgroup.htrees[s->context_map_slice[context]];
2008       p2 = p1;
2009       if (!safe) {
2010         p1 = (uint8_t)ReadSymbol(hc, br);
2011       } else {
2012         brotli_reg_t literal;
2013         if (!SafeReadSymbol(hc, br, &literal)) {
2014           result = BROTLI_DECODER_NEEDS_MORE_INPUT;
2015           goto saveStateAndReturn;
2016         }
2017         p1 = (uint8_t)literal;
2018       }
2019       s->ringbuffer[pos] = p1;
2020       --s->block_length[0];
2021       BROTLI_LOG_UINT(s->context_map_slice[context]);
2022       BROTLI_LOG_ARRAY_INDEX(s->ringbuffer, pos & s->ringbuffer_mask);
2023       ++pos;
2024       if (BROTLI_PREDICT_FALSE(pos == s->ringbuffer_size)) {
2025         s->state = BROTLI_STATE_COMMAND_INNER_WRITE;
2026         --i;
2027         goto saveStateAndReturn;
2028       }
2029     } while (--i != 0);
2030   }
2031   BROTLI_LOG_UINT(s->meta_block_remaining_len);
2032   if (BROTLI_PREDICT_FALSE(s->meta_block_remaining_len <= 0)) {
2033     s->state = BROTLI_STATE_METABLOCK_DONE;
2034     goto saveStateAndReturn;
2035   }
2036 
2037 CommandPostDecodeLiterals:
2038   if (safe) {
2039     s->state = BROTLI_STATE_COMMAND_POST_DECODE_LITERALS;
2040   }
2041   if (s->distance_code >= 0) {
2042     /* Implicit distance case. */
2043     s->distance_context = s->distance_code ? 0 : 1;
2044     --s->dist_rb_idx;
2045     s->distance_code = s->dist_rb[s->dist_rb_idx & 3];
2046   } else {
2047     /* Read distance code in the command, unless it was implicitly zero. */
2048     if (BROTLI_PREDICT_FALSE(s->block_length[2] == 0)) {
2049       BROTLI_SAFE(DecodeDistanceBlockSwitch(s));
2050     }
2051     BROTLI_SAFE(ReadDistance(s, br));
2052   }
2053   BROTLI_LOG(("[ProcessCommandsInternal] pos = %d distance = %d\n",
2054               pos, s->distance_code));
2055   if (s->max_distance != s->max_backward_distance) {
2056     s->max_distance =
2057         (pos < s->max_backward_distance) ? pos : s->max_backward_distance;
2058   }
2059   i = s->copy_length;
2060   /* Apply copy of LZ77 back-reference, or static dictionary reference if
2061      the distance is larger than the max LZ77 distance */
2062   if (s->distance_code > s->max_distance) {
2063     /* The maximum allowed distance is BROTLI_MAX_ALLOWED_DISTANCE = 0x7FFFFFFC.
2064        With this choice, no signed overflow can occur after decoding
2065        a special distance code (e.g., after adding 3 to the last distance). */
2066     if (s->distance_code > BROTLI_MAX_ALLOWED_DISTANCE) {
2067       BROTLI_LOG(("Invalid backward reference. pos: %d distance: %d "
2068           "len: %d bytes left: %d\n",
2069           pos, s->distance_code, i, s->meta_block_remaining_len));
2070       return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_DISTANCE);
2071     }
2072     if (s->distance_code - s->max_distance - 1 < compound_dictionary_size) {
2073       int address = compound_dictionary_size -
2074           (s->distance_code - s->max_distance);
2075       if (!InitializeCompoundDictionaryCopy(s, address, i)) {
2076         return BROTLI_FAILURE(BROTLI_DECODER_ERROR_COMPOUND_DICTIONARY);
2077       }
2078       pos += CopyFromCompoundDictionary(s, pos);
2079       if (pos >= s->ringbuffer_size) {
2080         s->state = BROTLI_STATE_COMMAND_POST_WRITE_1;
2081         goto saveStateAndReturn;
2082       }
2083     } else if (i >= SHARED_BROTLI_MIN_DICTIONARY_WORD_LENGTH &&
2084                i <= SHARED_BROTLI_MAX_DICTIONARY_WORD_LENGTH) {
2085       uint8_t p1 = s->ringbuffer[(pos - 1) & s->ringbuffer_mask];
2086       uint8_t p2 = s->ringbuffer[(pos - 2) & s->ringbuffer_mask];
2087       uint8_t dict_id = s->dictionary->context_based ?
2088           s->dictionary->context_map[BROTLI_CONTEXT(p1, p2, s->context_lookup)]
2089           : 0;
2090       const BrotliDictionary* words = s->dictionary->words[dict_id];
2091       const BrotliTransforms* transforms = s->dictionary->transforms[dict_id];
2092       int offset = (int)words->offsets_by_length[i];
2093       brotli_reg_t shift = words->size_bits_by_length[i];
2094       int address =
2095           s->distance_code - s->max_distance - 1 - compound_dictionary_size;
2096       int mask = (int)BitMask(shift);
2097       int word_idx = address & mask;
2098       int transform_idx = address >> shift;
2099       /* Compensate double distance-ring-buffer roll. */
2100       s->dist_rb_idx += s->distance_context;
2101       offset += word_idx * i;
2102       /* If the distance is out of bound, select a next static dictionary if
2103          there exist multiple. */
2104       if ((transform_idx >= (int)transforms->num_transforms ||
2105           words->size_bits_by_length[i] == 0) &&
2106           s->dictionary->num_dictionaries > 1) {
2107         uint8_t dict_id2;
2108         int dist_remaining = address -
2109             (int)(((1u << shift) & ~1u)) * (int)transforms->num_transforms;
2110         for (dict_id2 = 0; dict_id2 < s->dictionary->num_dictionaries;
2111             dict_id2++) {
2112           const BrotliDictionary* words2 = s->dictionary->words[dict_id2];
2113           if (dict_id2 != dict_id && words2->size_bits_by_length[i] != 0) {
2114             const BrotliTransforms* transforms2 =
2115                 s->dictionary->transforms[dict_id2];
2116             brotli_reg_t shift2 = words2->size_bits_by_length[i];
2117             int num = (int)((1u << shift2) & ~1u) *
2118                 (int)transforms2->num_transforms;
2119             if (dist_remaining < num) {
2120               dict_id = dict_id2;
2121               words = words2;
2122               transforms = transforms2;
2123               address = dist_remaining;
2124               shift = shift2;
2125               mask = (int)BitMask(shift);
2126               word_idx = address & mask;
2127               transform_idx = address >> shift;
2128               offset = (int)words->offsets_by_length[i] + word_idx * i;
2129               break;
2130             }
2131             dist_remaining -= num;
2132           }
2133         }
2134       }
2135       if (BROTLI_PREDICT_FALSE(words->size_bits_by_length[i] == 0)) {
2136         BROTLI_LOG(("Invalid backward reference. pos: %d distance: %d "
2137             "len: %d bytes left: %d\n",
2138             pos, s->distance_code, i, s->meta_block_remaining_len));
2139         return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_DICTIONARY);
2140       }
2141       if (BROTLI_PREDICT_FALSE(!words->data)) {
2142         return BROTLI_FAILURE(BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET);
2143       }
2144       if (transform_idx < (int)transforms->num_transforms) {
2145         const uint8_t* word = &words->data[offset];
2146         int len = i;
2147         if (transform_idx == transforms->cutOffTransforms[0]) {
2148           memcpy(&s->ringbuffer[pos], word, (size_t)len);
2149           BROTLI_LOG(("[ProcessCommandsInternal] dictionary word: [%.*s]\n",
2150                       len, word));
2151         } else {
2152           len = BrotliTransformDictionaryWord(&s->ringbuffer[pos], word, len,
2153               transforms, transform_idx);
2154           BROTLI_LOG(("[ProcessCommandsInternal] dictionary word: [%.*s],"
2155                       " transform_idx = %d, transformed: [%.*s]\n",
2156                       i, word, transform_idx, len, &s->ringbuffer[pos]));
2157           if (len == 0 && s->distance_code <= 120) {
2158             BROTLI_LOG(("Invalid length-0 dictionary word after transform\n"));
2159             return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_TRANSFORM);
2160           }
2161         }
2162         pos += len;
2163         s->meta_block_remaining_len -= len;
2164         if (pos >= s->ringbuffer_size) {
2165           s->state = BROTLI_STATE_COMMAND_POST_WRITE_1;
2166           goto saveStateAndReturn;
2167         }
2168       } else {
2169         BROTLI_LOG(("Invalid backward reference. pos: %d distance: %d "
2170             "len: %d bytes left: %d\n",
2171             pos, s->distance_code, i, s->meta_block_remaining_len));
2172         return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_TRANSFORM);
2173       }
2174     } else {
2175       BROTLI_LOG(("Invalid backward reference. pos: %d distance: %d "
2176           "len: %d bytes left: %d\n",
2177           pos, s->distance_code, i, s->meta_block_remaining_len));
2178       return BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_DICTIONARY);
2179     }
2180   } else {
2181     int src_start = (pos - s->distance_code) & s->ringbuffer_mask;
2182     uint8_t* copy_dst = &s->ringbuffer[pos];
2183     uint8_t* copy_src = &s->ringbuffer[src_start];
2184     int dst_end = pos + i;
2185     int src_end = src_start + i;
2186     /* Update the recent distances cache. */
2187     s->dist_rb[s->dist_rb_idx & 3] = s->distance_code;
2188     ++s->dist_rb_idx;
2189     s->meta_block_remaining_len -= i;
2190     /* There are 32+ bytes of slack in the ring-buffer allocation.
2191        Also, we have 16 short codes, that make these 16 bytes irrelevant
2192        in the ring-buffer. Let's copy over them as a first guess. */
2193     memmove16(copy_dst, copy_src);
2194     if (src_end > pos && dst_end > src_start) {
2195       /* Regions intersect. */
2196       goto CommandPostWrapCopy;
2197     }
2198     if (dst_end >= s->ringbuffer_size || src_end >= s->ringbuffer_size) {
2199       /* At least one region wraps. */
2200       goto CommandPostWrapCopy;
2201     }
2202     pos += i;
2203     if (i > 16) {
2204       if (i > 32) {
2205         memcpy(copy_dst + 16, copy_src + 16, (size_t)(i - 16));
2206       } else {
2207         /* This branch covers about 45% cases.
2208            Fixed size short copy allows more compiler optimizations. */
2209         memmove16(copy_dst + 16, copy_src + 16);
2210       }
2211     }
2212   }
2213   BROTLI_LOG_UINT(s->meta_block_remaining_len);
2214   if (s->meta_block_remaining_len <= 0) {
2215     /* Next metablock, if any. */
2216     s->state = BROTLI_STATE_METABLOCK_DONE;
2217     goto saveStateAndReturn;
2218   } else {
2219     goto CommandBegin;
2220   }
2221 CommandPostWrapCopy:
2222   {
2223     int wrap_guard = s->ringbuffer_size - pos;
2224     while (--i >= 0) {
2225       s->ringbuffer[pos] =
2226           s->ringbuffer[(pos - s->distance_code) & s->ringbuffer_mask];
2227       ++pos;
2228       if (BROTLI_PREDICT_FALSE(--wrap_guard == 0)) {
2229         s->state = BROTLI_STATE_COMMAND_POST_WRITE_2;
2230         goto saveStateAndReturn;
2231       }
2232     }
2233   }
2234   if (s->meta_block_remaining_len <= 0) {
2235     /* Next metablock, if any. */
2236     s->state = BROTLI_STATE_METABLOCK_DONE;
2237     goto saveStateAndReturn;
2238   } else {
2239     goto CommandBegin;
2240   }
2241 
2242 NextLiteralBlock:
2243   BROTLI_SAFE(DecodeLiteralBlockSwitch(s));
2244   goto CommandInner;
2245 
2246 saveStateAndReturn:
2247   s->pos = pos;
2248   s->loop_counter = i;
2249   return result;
2250 }
2251 
2252 #undef BROTLI_SAFE
2253 
ProcessCommands(BrotliDecoderState * s)2254 static BROTLI_NOINLINE BrotliDecoderErrorCode ProcessCommands(
2255     BrotliDecoderState* s) {
2256   return ProcessCommandsInternal(0, s);
2257 }
2258 
SafeProcessCommands(BrotliDecoderState * s)2259 static BROTLI_NOINLINE BrotliDecoderErrorCode SafeProcessCommands(
2260     BrotliDecoderState* s) {
2261   return ProcessCommandsInternal(1, s);
2262 }
2263 
BrotliDecoderDecompress(size_t encoded_size,const uint8_t encoded_buffer[BROTLI_ARRAY_PARAM (encoded_size)],size_t * decoded_size,uint8_t decoded_buffer[BROTLI_ARRAY_PARAM (* decoded_size)])2264 BrotliDecoderResult BrotliDecoderDecompress(
2265     size_t encoded_size,
2266     const uint8_t encoded_buffer[BROTLI_ARRAY_PARAM(encoded_size)],
2267     size_t* decoded_size,
2268     uint8_t decoded_buffer[BROTLI_ARRAY_PARAM(*decoded_size)]) {
2269   BrotliDecoderState s;
2270   BrotliDecoderResult result;
2271   size_t total_out = 0;
2272   size_t available_in = encoded_size;
2273   const uint8_t* next_in = encoded_buffer;
2274   size_t available_out = *decoded_size;
2275   uint8_t* next_out = decoded_buffer;
2276   if (!BrotliDecoderStateInit(&s, 0, 0, 0)) {
2277     return BROTLI_DECODER_RESULT_ERROR;
2278   }
2279   result = BrotliDecoderDecompressStream(
2280       &s, &available_in, &next_in, &available_out, &next_out, &total_out);
2281   *decoded_size = total_out;
2282   BrotliDecoderStateCleanup(&s);
2283   if (result != BROTLI_DECODER_RESULT_SUCCESS) {
2284     result = BROTLI_DECODER_RESULT_ERROR;
2285   }
2286   return result;
2287 }
2288 
2289 /* Invariant: input stream is never overconsumed:
2290     - invalid input implies that the whole stream is invalid -> any amount of
2291       input could be read and discarded
2292     - when result is "needs more input", then at least one more byte is REQUIRED
2293       to complete decoding; all input data MUST be consumed by decoder, so
2294       client could swap the input buffer
2295     - when result is "needs more output" decoder MUST ensure that it doesn't
2296       hold more than 7 bits in bit reader; this saves client from swapping input
2297       buffer ahead of time
2298     - when result is "success" decoder MUST return all unused data back to input
2299       buffer; this is possible because the invariant is held on enter */
BrotliDecoderDecompressStream(BrotliDecoderState * s,size_t * available_in,const uint8_t ** next_in,size_t * available_out,uint8_t ** next_out,size_t * total_out)2300 BrotliDecoderResult BrotliDecoderDecompressStream(
2301     BrotliDecoderState* s, size_t* available_in, const uint8_t** next_in,
2302     size_t* available_out, uint8_t** next_out, size_t* total_out) {
2303   BrotliDecoderErrorCode result = BROTLI_DECODER_SUCCESS;
2304   BrotliBitReader* br = &s->br;
2305   size_t input_size = *available_in;
2306 #define BROTLI_SAVE_ERROR_CODE(code) \
2307     SaveErrorCode(s, (code), input_size - *available_in)
2308   /* Ensure that |total_out| is set, even if no data will ever be pushed out. */
2309   if (total_out) {
2310     *total_out = s->partial_pos_out;
2311   }
2312   /* Do not try to process further in a case of unrecoverable error. */
2313   if ((int)s->error_code < 0) {
2314     return BROTLI_DECODER_RESULT_ERROR;
2315   }
2316   if (*available_out && (!next_out || !*next_out)) {
2317     return BROTLI_SAVE_ERROR_CODE(
2318         BROTLI_FAILURE(BROTLI_DECODER_ERROR_INVALID_ARGUMENTS));
2319   }
2320   if (!*available_out) next_out = 0;
2321   if (s->buffer_length == 0) {  /* Just connect bit reader to input stream. */
2322     BrotliBitReaderSetInput(br, *next_in, *available_in);
2323   } else {
2324     /* At least one byte of input is required. More than one byte of input may
2325        be required to complete the transaction -> reading more data must be
2326        done in a loop -> do it in a main loop. */
2327     result = BROTLI_DECODER_NEEDS_MORE_INPUT;
2328     BrotliBitReaderSetInput(br, &s->buffer.u8[0], s->buffer_length);
2329   }
2330   /* State machine */
2331   for (;;) {
2332     if (result != BROTLI_DECODER_SUCCESS) {
2333       /* Error, needs more input/output. */
2334       if (result == BROTLI_DECODER_NEEDS_MORE_INPUT) {
2335         if (s->ringbuffer != 0) {  /* Pro-actively push output. */
2336           BrotliDecoderErrorCode intermediate_result = WriteRingBuffer(s,
2337               available_out, next_out, total_out, BROTLI_TRUE);
2338           /* WriteRingBuffer checks s->meta_block_remaining_len validity. */
2339           if ((int)intermediate_result < 0) {
2340             result = intermediate_result;
2341             break;
2342           }
2343         }
2344         if (s->buffer_length != 0) {  /* Used with internal buffer. */
2345           if (br->next_in == br->last_in) {
2346             /* Successfully finished read transaction.
2347                Accumulator contains less than 8 bits, because internal buffer
2348                is expanded byte-by-byte until it is enough to complete read. */
2349             s->buffer_length = 0;
2350             /* Switch to input stream and restart. */
2351             result = BROTLI_DECODER_SUCCESS;
2352             BrotliBitReaderSetInput(br, *next_in, *available_in);
2353             continue;
2354           } else if (*available_in != 0) {
2355             /* Not enough data in buffer, but can take one more byte from
2356                input stream. */
2357             result = BROTLI_DECODER_SUCCESS;
2358             BROTLI_DCHECK(s->buffer_length < 8);
2359             s->buffer.u8[s->buffer_length] = **next_in;
2360             s->buffer_length++;
2361             BrotliBitReaderSetInput(br, &s->buffer.u8[0], s->buffer_length);
2362             (*next_in)++;
2363             (*available_in)--;
2364             /* Retry with more data in buffer. */
2365             continue;
2366           }
2367           /* Can't finish reading and no more input. */
2368           break;
2369         } else {  /* Input stream doesn't contain enough input. */
2370           /* Copy tail to internal buffer and return. */
2371           *next_in = br->next_in;
2372           *available_in = BrotliBitReaderGetAvailIn(br);
2373           while (*available_in) {
2374             s->buffer.u8[s->buffer_length] = **next_in;
2375             s->buffer_length++;
2376             (*next_in)++;
2377             (*available_in)--;
2378           }
2379           break;
2380         }
2381         /* Unreachable. */
2382       }
2383 
2384       /* Fail or needs more output. */
2385 
2386       if (s->buffer_length != 0) {
2387         /* Just consumed the buffered input and produced some output. Otherwise
2388            it would result in "needs more input". Reset internal buffer. */
2389         s->buffer_length = 0;
2390       } else {
2391         /* Using input stream in last iteration. When decoder switches to input
2392            stream it has less than 8 bits in accumulator, so it is safe to
2393            return unused accumulator bits there. */
2394         BrotliBitReaderUnload(br);
2395         *available_in = BrotliBitReaderGetAvailIn(br);
2396         *next_in = br->next_in;
2397       }
2398       break;
2399     }
2400     switch (s->state) {
2401       case BROTLI_STATE_UNINITED:
2402         /* Prepare to the first read. */
2403         if (!BrotliWarmupBitReader(br)) {
2404           result = BROTLI_DECODER_NEEDS_MORE_INPUT;
2405           break;
2406         }
2407         /* Decode window size. */
2408         result = DecodeWindowBits(s, br);  /* Reads 1..8 bits. */
2409         if (result != BROTLI_DECODER_SUCCESS) {
2410           break;
2411         }
2412         if (s->large_window) {
2413           s->state = BROTLI_STATE_LARGE_WINDOW_BITS;
2414           break;
2415         }
2416         s->state = BROTLI_STATE_INITIALIZE;
2417         break;
2418 
2419       case BROTLI_STATE_LARGE_WINDOW_BITS: {
2420         brotli_reg_t bits;
2421         if (!BrotliSafeReadBits(br, 6, &bits)) {
2422           result = BROTLI_DECODER_NEEDS_MORE_INPUT;
2423           break;
2424         }
2425         s->window_bits = bits & 63u;
2426         if (s->window_bits < BROTLI_LARGE_MIN_WBITS ||
2427             s->window_bits > BROTLI_LARGE_MAX_WBITS) {
2428           result = BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS);
2429           break;
2430         }
2431         s->state = BROTLI_STATE_INITIALIZE;
2432       }
2433       /* Fall through. */
2434 
2435       case BROTLI_STATE_INITIALIZE:
2436         BROTLI_LOG_UINT(s->window_bits);
2437         /* Maximum distance, see section 9.1. of the spec. */
2438         s->max_backward_distance = (1 << s->window_bits) - BROTLI_WINDOW_GAP;
2439 
2440         /* Allocate memory for both block_type_trees and block_len_trees. */
2441         s->block_type_trees = (HuffmanCode*)BROTLI_DECODER_ALLOC(s,
2442             sizeof(HuffmanCode) * 3 *
2443                 (BROTLI_HUFFMAN_MAX_SIZE_258 + BROTLI_HUFFMAN_MAX_SIZE_26));
2444         if (s->block_type_trees == 0) {
2445           result = BROTLI_FAILURE(BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES);
2446           break;
2447         }
2448         s->block_len_trees =
2449             s->block_type_trees + 3 * BROTLI_HUFFMAN_MAX_SIZE_258;
2450 
2451         s->state = BROTLI_STATE_METABLOCK_BEGIN;
2452       /* Fall through. */
2453 
2454       case BROTLI_STATE_METABLOCK_BEGIN:
2455         BrotliDecoderStateMetablockBegin(s);
2456         BROTLI_LOG_UINT(s->pos);
2457         s->state = BROTLI_STATE_METABLOCK_HEADER;
2458       /* Fall through. */
2459 
2460       case BROTLI_STATE_METABLOCK_HEADER:
2461         result = DecodeMetaBlockLength(s, br);  /* Reads 2 - 31 bits. */
2462         if (result != BROTLI_DECODER_SUCCESS) {
2463           break;
2464         }
2465         BROTLI_LOG_UINT(s->is_last_metablock);
2466         BROTLI_LOG_UINT(s->meta_block_remaining_len);
2467         BROTLI_LOG_UINT(s->is_metadata);
2468         BROTLI_LOG_UINT(s->is_uncompressed);
2469         if (s->is_metadata || s->is_uncompressed) {
2470           if (!BrotliJumpToByteBoundary(br)) {
2471             result = BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_PADDING_1);
2472             break;
2473           }
2474         }
2475         if (s->is_metadata) {
2476           s->state = BROTLI_STATE_METADATA;
2477           if (s->metadata_start_func) {
2478             s->metadata_start_func(s->metadata_callback_opaque,
2479                                    (size_t)s->meta_block_remaining_len);
2480           }
2481           break;
2482         }
2483         if (s->meta_block_remaining_len == 0) {
2484           s->state = BROTLI_STATE_METABLOCK_DONE;
2485           break;
2486         }
2487         BrotliCalculateRingBufferSize(s);
2488         if (s->is_uncompressed) {
2489           s->state = BROTLI_STATE_UNCOMPRESSED;
2490           break;
2491         }
2492         s->state = BROTLI_STATE_BEFORE_COMPRESSED_METABLOCK_HEADER;
2493       /* Fall through. */
2494 
2495       case BROTLI_STATE_BEFORE_COMPRESSED_METABLOCK_HEADER: {
2496         BrotliMetablockHeaderArena* h = &s->arena.header;
2497         s->loop_counter = 0;
2498         /* Initialize compressed metablock header arena. */
2499         h->sub_loop_counter = 0;
2500         /* Make small negative indexes addressable. */
2501         h->symbol_lists =
2502             &h->symbols_lists_array[BROTLI_HUFFMAN_MAX_CODE_LENGTH + 1];
2503         h->substate_huffman = BROTLI_STATE_HUFFMAN_NONE;
2504         h->substate_tree_group = BROTLI_STATE_TREE_GROUP_NONE;
2505         h->substate_context_map = BROTLI_STATE_CONTEXT_MAP_NONE;
2506         s->state = BROTLI_STATE_HUFFMAN_CODE_0;
2507       }
2508       /* Fall through. */
2509 
2510       case BROTLI_STATE_HUFFMAN_CODE_0:
2511         if (s->loop_counter >= 3) {
2512           s->state = BROTLI_STATE_METABLOCK_HEADER_2;
2513           break;
2514         }
2515         /* Reads 1..11 bits. */
2516         result = DecodeVarLenUint8(s, br, &s->num_block_types[s->loop_counter]);
2517         if (result != BROTLI_DECODER_SUCCESS) {
2518           break;
2519         }
2520         s->num_block_types[s->loop_counter]++;
2521         BROTLI_LOG_UINT(s->num_block_types[s->loop_counter]);
2522         if (s->num_block_types[s->loop_counter] < 2) {
2523           s->loop_counter++;
2524           break;
2525         }
2526         s->state = BROTLI_STATE_HUFFMAN_CODE_1;
2527       /* Fall through. */
2528 
2529       case BROTLI_STATE_HUFFMAN_CODE_1: {
2530         brotli_reg_t alphabet_size = s->num_block_types[s->loop_counter] + 2;
2531         int tree_offset = s->loop_counter * BROTLI_HUFFMAN_MAX_SIZE_258;
2532         result = ReadHuffmanCode(alphabet_size, alphabet_size,
2533             &s->block_type_trees[tree_offset], NULL, s);
2534         if (result != BROTLI_DECODER_SUCCESS) break;
2535         s->state = BROTLI_STATE_HUFFMAN_CODE_2;
2536       }
2537       /* Fall through. */
2538 
2539       case BROTLI_STATE_HUFFMAN_CODE_2: {
2540         brotli_reg_t alphabet_size = BROTLI_NUM_BLOCK_LEN_SYMBOLS;
2541         int tree_offset = s->loop_counter * BROTLI_HUFFMAN_MAX_SIZE_26;
2542         result = ReadHuffmanCode(alphabet_size, alphabet_size,
2543             &s->block_len_trees[tree_offset], NULL, s);
2544         if (result != BROTLI_DECODER_SUCCESS) break;
2545         s->state = BROTLI_STATE_HUFFMAN_CODE_3;
2546       }
2547       /* Fall through. */
2548 
2549       case BROTLI_STATE_HUFFMAN_CODE_3: {
2550         int tree_offset = s->loop_counter * BROTLI_HUFFMAN_MAX_SIZE_26;
2551         if (!SafeReadBlockLength(s, &s->block_length[s->loop_counter],
2552             &s->block_len_trees[tree_offset], br)) {
2553           result = BROTLI_DECODER_NEEDS_MORE_INPUT;
2554           break;
2555         }
2556         BROTLI_LOG_UINT(s->block_length[s->loop_counter]);
2557         s->loop_counter++;
2558         s->state = BROTLI_STATE_HUFFMAN_CODE_0;
2559         break;
2560       }
2561 
2562       case BROTLI_STATE_UNCOMPRESSED: {
2563         result = CopyUncompressedBlockToOutput(
2564             available_out, next_out, total_out, s);
2565         if (result != BROTLI_DECODER_SUCCESS) {
2566           break;
2567         }
2568         s->state = BROTLI_STATE_METABLOCK_DONE;
2569         break;
2570       }
2571 
2572       case BROTLI_STATE_METADATA:
2573         result = SkipMetadataBlock(s);
2574         if (result != BROTLI_DECODER_SUCCESS) {
2575           break;
2576         }
2577         s->state = BROTLI_STATE_METABLOCK_DONE;
2578         break;
2579 
2580       case BROTLI_STATE_METABLOCK_HEADER_2: {
2581         brotli_reg_t bits;
2582         if (!BrotliSafeReadBits(br, 6, &bits)) {
2583           result = BROTLI_DECODER_NEEDS_MORE_INPUT;
2584           break;
2585         }
2586         s->distance_postfix_bits = bits & BitMask(2);
2587         bits >>= 2;
2588         s->num_direct_distance_codes = bits << s->distance_postfix_bits;
2589         BROTLI_LOG_UINT(s->num_direct_distance_codes);
2590         BROTLI_LOG_UINT(s->distance_postfix_bits);
2591         s->context_modes =
2592             (uint8_t*)BROTLI_DECODER_ALLOC(s, (size_t)s->num_block_types[0]);
2593         if (s->context_modes == 0) {
2594           result = BROTLI_FAILURE(BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES);
2595           break;
2596         }
2597         s->loop_counter = 0;
2598         s->state = BROTLI_STATE_CONTEXT_MODES;
2599       }
2600       /* Fall through. */
2601 
2602       case BROTLI_STATE_CONTEXT_MODES:
2603         result = ReadContextModes(s);
2604         if (result != BROTLI_DECODER_SUCCESS) {
2605           break;
2606         }
2607         s->state = BROTLI_STATE_CONTEXT_MAP_1;
2608       /* Fall through. */
2609 
2610       case BROTLI_STATE_CONTEXT_MAP_1:
2611         result = DecodeContextMap(
2612             s->num_block_types[0] << BROTLI_LITERAL_CONTEXT_BITS,
2613             &s->num_literal_htrees, &s->context_map, s);
2614         if (result != BROTLI_DECODER_SUCCESS) {
2615           break;
2616         }
2617         DetectTrivialLiteralBlockTypes(s);
2618         s->state = BROTLI_STATE_CONTEXT_MAP_2;
2619       /* Fall through. */
2620 
2621       case BROTLI_STATE_CONTEXT_MAP_2: {
2622         brotli_reg_t npostfix = s->distance_postfix_bits;
2623         brotli_reg_t ndirect = s->num_direct_distance_codes;
2624         brotli_reg_t distance_alphabet_size_max = BROTLI_DISTANCE_ALPHABET_SIZE(
2625             npostfix, ndirect, BROTLI_MAX_DISTANCE_BITS);
2626         brotli_reg_t distance_alphabet_size_limit = distance_alphabet_size_max;
2627         BROTLI_BOOL allocation_success = BROTLI_TRUE;
2628         if (s->large_window) {
2629           BrotliDistanceCodeLimit limit = BrotliCalculateDistanceCodeLimit(
2630               BROTLI_MAX_ALLOWED_DISTANCE, (uint32_t)npostfix,
2631               (uint32_t)ndirect);
2632           distance_alphabet_size_max = BROTLI_DISTANCE_ALPHABET_SIZE(
2633               npostfix, ndirect, BROTLI_LARGE_MAX_DISTANCE_BITS);
2634           distance_alphabet_size_limit = limit.max_alphabet_size;
2635         }
2636         result = DecodeContextMap(
2637             s->num_block_types[2] << BROTLI_DISTANCE_CONTEXT_BITS,
2638             &s->num_dist_htrees, &s->dist_context_map, s);
2639         if (result != BROTLI_DECODER_SUCCESS) {
2640           break;
2641         }
2642         allocation_success &= BrotliDecoderHuffmanTreeGroupInit(
2643             s, &s->literal_hgroup, BROTLI_NUM_LITERAL_SYMBOLS,
2644             BROTLI_NUM_LITERAL_SYMBOLS, s->num_literal_htrees);
2645         allocation_success &= BrotliDecoderHuffmanTreeGroupInit(
2646             s, &s->insert_copy_hgroup, BROTLI_NUM_COMMAND_SYMBOLS,
2647             BROTLI_NUM_COMMAND_SYMBOLS, s->num_block_types[1]);
2648         allocation_success &= BrotliDecoderHuffmanTreeGroupInit(
2649             s, &s->distance_hgroup, distance_alphabet_size_max,
2650             distance_alphabet_size_limit, s->num_dist_htrees);
2651         if (!allocation_success) {
2652           return BROTLI_SAVE_ERROR_CODE(
2653               BROTLI_FAILURE(BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS));
2654         }
2655         s->loop_counter = 0;
2656         s->state = BROTLI_STATE_TREE_GROUP;
2657       }
2658       /* Fall through. */
2659 
2660       case BROTLI_STATE_TREE_GROUP: {
2661         HuffmanTreeGroup* hgroup = NULL;
2662         switch (s->loop_counter) {
2663           case 0: hgroup = &s->literal_hgroup; break;
2664           case 1: hgroup = &s->insert_copy_hgroup; break;
2665           case 2: hgroup = &s->distance_hgroup; break;
2666           default: return BROTLI_SAVE_ERROR_CODE(BROTLI_FAILURE(
2667               BROTLI_DECODER_ERROR_UNREACHABLE));  /* COV_NF_LINE */
2668         }
2669         result = HuffmanTreeGroupDecode(hgroup, s);
2670         if (result != BROTLI_DECODER_SUCCESS) break;
2671         s->loop_counter++;
2672         if (s->loop_counter < 3) {
2673           break;
2674         }
2675         s->state = BROTLI_STATE_BEFORE_COMPRESSED_METABLOCK_BODY;
2676       }
2677       /* Fall through. */
2678 
2679       case BROTLI_STATE_BEFORE_COMPRESSED_METABLOCK_BODY:
2680         PrepareLiteralDecoding(s);
2681         s->dist_context_map_slice = s->dist_context_map;
2682         s->htree_command = s->insert_copy_hgroup.htrees[0];
2683         if (!BrotliEnsureRingBuffer(s)) {
2684           result = BROTLI_FAILURE(BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2);
2685           break;
2686         }
2687         CalculateDistanceLut(s);
2688         s->state = BROTLI_STATE_COMMAND_BEGIN;
2689       /* Fall through. */
2690 
2691       case BROTLI_STATE_COMMAND_BEGIN:
2692       /* Fall through. */
2693       case BROTLI_STATE_COMMAND_INNER:
2694       /* Fall through. */
2695       case BROTLI_STATE_COMMAND_POST_DECODE_LITERALS:
2696       /* Fall through. */
2697       case BROTLI_STATE_COMMAND_POST_WRAP_COPY:
2698         result = ProcessCommands(s);
2699         if (result == BROTLI_DECODER_NEEDS_MORE_INPUT) {
2700           result = SafeProcessCommands(s);
2701         }
2702         break;
2703 
2704       case BROTLI_STATE_COMMAND_INNER_WRITE:
2705       /* Fall through. */
2706       case BROTLI_STATE_COMMAND_POST_WRITE_1:
2707       /* Fall through. */
2708       case BROTLI_STATE_COMMAND_POST_WRITE_2:
2709         result = WriteRingBuffer(
2710             s, available_out, next_out, total_out, BROTLI_FALSE);
2711         if (result != BROTLI_DECODER_SUCCESS) {
2712           break;
2713         }
2714         WrapRingBuffer(s);
2715         if (s->ringbuffer_size == 1 << s->window_bits) {
2716           s->max_distance = s->max_backward_distance;
2717         }
2718         if (s->state == BROTLI_STATE_COMMAND_POST_WRITE_1) {
2719           BrotliDecoderCompoundDictionary* addon = s->compound_dictionary;
2720           if (addon && (addon->br_length != addon->br_copied)) {
2721             s->pos += CopyFromCompoundDictionary(s, s->pos);
2722             if (s->pos >= s->ringbuffer_size) continue;
2723           }
2724           if (s->meta_block_remaining_len == 0) {
2725             /* Next metablock, if any. */
2726             s->state = BROTLI_STATE_METABLOCK_DONE;
2727           } else {
2728             s->state = BROTLI_STATE_COMMAND_BEGIN;
2729           }
2730           break;
2731         } else if (s->state == BROTLI_STATE_COMMAND_POST_WRITE_2) {
2732           s->state = BROTLI_STATE_COMMAND_POST_WRAP_COPY;
2733         } else {  /* BROTLI_STATE_COMMAND_INNER_WRITE */
2734           if (s->loop_counter == 0) {
2735             if (s->meta_block_remaining_len == 0) {
2736               s->state = BROTLI_STATE_METABLOCK_DONE;
2737             } else {
2738               s->state = BROTLI_STATE_COMMAND_POST_DECODE_LITERALS;
2739             }
2740             break;
2741           }
2742           s->state = BROTLI_STATE_COMMAND_INNER;
2743         }
2744         break;
2745 
2746       case BROTLI_STATE_METABLOCK_DONE:
2747         if (s->meta_block_remaining_len < 0) {
2748           result = BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2);
2749           break;
2750         }
2751         BrotliDecoderStateCleanupAfterMetablock(s);
2752         if (!s->is_last_metablock) {
2753           s->state = BROTLI_STATE_METABLOCK_BEGIN;
2754           break;
2755         }
2756         if (!BrotliJumpToByteBoundary(br)) {
2757           result = BROTLI_FAILURE(BROTLI_DECODER_ERROR_FORMAT_PADDING_2);
2758           break;
2759         }
2760         if (s->buffer_length == 0) {
2761           BrotliBitReaderUnload(br);
2762           *available_in = BrotliBitReaderGetAvailIn(br);
2763           *next_in = br->next_in;
2764         }
2765         s->state = BROTLI_STATE_DONE;
2766       /* Fall through. */
2767 
2768       case BROTLI_STATE_DONE:
2769         if (s->ringbuffer != 0) {
2770           result = WriteRingBuffer(
2771               s, available_out, next_out, total_out, BROTLI_TRUE);
2772           if (result != BROTLI_DECODER_SUCCESS) {
2773             break;
2774           }
2775         }
2776         return BROTLI_SAVE_ERROR_CODE(result);
2777     }
2778   }
2779   return BROTLI_SAVE_ERROR_CODE(result);
2780 #undef BROTLI_SAVE_ERROR_CODE
2781 }
2782 
BrotliDecoderHasMoreOutput(const BrotliDecoderState * s)2783 BROTLI_BOOL BrotliDecoderHasMoreOutput(const BrotliDecoderState* s) {
2784   /* After unrecoverable error remaining output is considered nonsensical. */
2785   if ((int)s->error_code < 0) {
2786     return BROTLI_FALSE;
2787   }
2788   return TO_BROTLI_BOOL(
2789       s->ringbuffer != 0 && UnwrittenBytes(s, BROTLI_FALSE) != 0);
2790 }
2791 
BrotliDecoderTakeOutput(BrotliDecoderState * s,size_t * size)2792 const uint8_t* BrotliDecoderTakeOutput(BrotliDecoderState* s, size_t* size) {
2793   uint8_t* result = 0;
2794   size_t available_out = *size ? *size : 1u << 24;
2795   size_t requested_out = available_out;
2796   BrotliDecoderErrorCode status;
2797   if ((s->ringbuffer == 0) || ((int)s->error_code < 0)) {
2798     *size = 0;
2799     return 0;
2800   }
2801   WrapRingBuffer(s);
2802   status = WriteRingBuffer(s, &available_out, &result, 0, BROTLI_TRUE);
2803   /* Either WriteRingBuffer returns those "success" codes... */
2804   if (status == BROTLI_DECODER_SUCCESS ||
2805       status == BROTLI_DECODER_NEEDS_MORE_OUTPUT) {
2806     *size = requested_out - available_out;
2807   } else {
2808     /* ... or stream is broken. Normally this should be caught by
2809        BrotliDecoderDecompressStream, this is just a safeguard. */
2810     if ((int)status < 0) SaveErrorCode(s, status, 0);
2811     *size = 0;
2812     result = 0;
2813   }
2814   return result;
2815 }
2816 
BrotliDecoderIsUsed(const BrotliDecoderState * s)2817 BROTLI_BOOL BrotliDecoderIsUsed(const BrotliDecoderState* s) {
2818   return TO_BROTLI_BOOL(s->state != BROTLI_STATE_UNINITED ||
2819       BrotliGetAvailableBits(&s->br) != 0);
2820 }
2821 
BrotliDecoderIsFinished(const BrotliDecoderState * s)2822 BROTLI_BOOL BrotliDecoderIsFinished(const BrotliDecoderState* s) {
2823   return TO_BROTLI_BOOL(s->state == BROTLI_STATE_DONE) &&
2824       !BrotliDecoderHasMoreOutput(s);
2825 }
2826 
BrotliDecoderGetErrorCode(const BrotliDecoderState * s)2827 BrotliDecoderErrorCode BrotliDecoderGetErrorCode(const BrotliDecoderState* s) {
2828   return (BrotliDecoderErrorCode)s->error_code;
2829 }
2830 
BrotliDecoderErrorString(BrotliDecoderErrorCode c)2831 const char* BrotliDecoderErrorString(BrotliDecoderErrorCode c) {
2832   switch (c) {
2833 #define BROTLI_ERROR_CODE_CASE_(PREFIX, NAME, CODE) \
2834     case BROTLI_DECODER ## PREFIX ## NAME: return #PREFIX #NAME;
2835 #define BROTLI_NOTHING_
2836     BROTLI_DECODER_ERROR_CODES_LIST(BROTLI_ERROR_CODE_CASE_, BROTLI_NOTHING_)
2837 #undef BROTLI_ERROR_CODE_CASE_
2838 #undef BROTLI_NOTHING_
2839     default: return "INVALID";
2840   }
2841 }
2842 
BrotliDecoderVersion(void)2843 uint32_t BrotliDecoderVersion(void) {
2844   return BROTLI_VERSION;
2845 }
2846 
BrotliDecoderSetMetadataCallbacks(BrotliDecoderState * state,brotli_decoder_metadata_start_func start_func,brotli_decoder_metadata_chunk_func chunk_func,void * opaque)2847 void BrotliDecoderSetMetadataCallbacks(
2848     BrotliDecoderState* state,
2849     brotli_decoder_metadata_start_func start_func,
2850     brotli_decoder_metadata_chunk_func chunk_func, void* opaque) {
2851   state->metadata_start_func = start_func;
2852   state->metadata_chunk_func = chunk_func;
2853   state->metadata_callback_opaque = opaque;
2854 }
2855 
2856 /* Escalate internal functions visibility; for testing purposes only. */
2857 #if defined(BROTLI_TEST)
2858 BROTLI_BOOL SafeReadSymbolForTest(
2859     const HuffmanCode*, BrotliBitReader*, brotli_reg_t*);
SafeReadSymbolForTest(const HuffmanCode * table,BrotliBitReader * br,brotli_reg_t * result)2860 BROTLI_BOOL SafeReadSymbolForTest(
2861     const HuffmanCode* table, BrotliBitReader* br, brotli_reg_t* result) {
2862   return SafeReadSymbol(table, br, result);
2863 }
2864 
2865 void InverseMoveToFrontTransformForTest(
2866     uint8_t*, brotli_reg_t, BrotliDecoderState*);
InverseMoveToFrontTransformForTest(uint8_t * v,brotli_reg_t l,BrotliDecoderState * s)2867 void InverseMoveToFrontTransformForTest(
2868     uint8_t* v, brotli_reg_t l, BrotliDecoderState* s) {
2869   InverseMoveToFrontTransform(v, l, s);
2870 }
2871 #endif
2872 
2873 #if defined(__cplusplus) || defined(c_plusplus)
2874 }  /* extern "C" */
2875 #endif
2876