1 /*
2 * rdtarga.c
3 *
4 * This file was part of the Independent JPEG Group's software:
5 * Copyright (C) 1991-1996, Thomas G. Lane.
6 * Modified 2017 by Guido Vollbeding.
7 * libjpeg-turbo Modifications:
8 * Copyright (C) 2018, 2021, D. R. Commander.
9 * For conditions of distribution and use, see the accompanying README.ijg
10 * file.
11 *
12 * This file contains routines to read input images in Targa format.
13 *
14 * These routines may need modification for non-Unix environments or
15 * specialized applications. As they stand, they assume input from
16 * an ordinary stdio stream. They further assume that reading begins
17 * at the start of the file; start_input may need work if the
18 * user interface has already read some data (e.g., to determine that
19 * the file is indeed Targa format).
20 *
21 * Based on code contributed by Lee Daniel Crocker.
22 */
23
24 #include "cdjpeg.h" /* Common decls for cjpeg/djpeg applications */
25
26 #ifdef TARGA_SUPPORTED
27
28
29 /* Macros to deal with unsigned chars as efficiently as compiler allows */
30
31 typedef unsigned char U_CHAR;
32 #define UCH(x) ((int)(x))
33
34
35 #define ReadOK(file, buffer, len) \
36 (JFREAD(file, buffer, len) == ((size_t)(len)))
37
38
39 /* Private version of data source object */
40
41 typedef struct _tga_source_struct *tga_source_ptr;
42
43 typedef struct _tga_source_struct {
44 struct cjpeg_source_struct pub; /* public fields */
45
46 j_compress_ptr cinfo; /* back link saves passing separate parm */
47
48 JSAMPARRAY colormap; /* Targa colormap (converted to my format) */
49
50 jvirt_sarray_ptr whole_image; /* Needed if funny input row order */
51 JDIMENSION current_row; /* Current logical row number to read */
52
53 /* Pointer to routine to extract next Targa pixel from input file */
54 void (*read_pixel) (tga_source_ptr sinfo);
55
56 /* Result of read_pixel is delivered here: */
57 U_CHAR tga_pixel[4];
58
59 int pixel_size; /* Bytes per Targa pixel (1 to 4) */
60 int cmap_length; /* colormap length */
61
62 /* State info for reading RLE-coded pixels; both counts must be init to 0 */
63 int block_count; /* # of pixels remaining in RLE block */
64 int dup_pixel_count; /* # of times to duplicate previous pixel */
65
66 /* This saves the correct pixel-row-expansion method for preload_image */
67 JDIMENSION (*get_pixel_rows) (j_compress_ptr cinfo, cjpeg_source_ptr sinfo);
68 } tga_source_struct;
69
70
71 /* For expanding 5-bit pixel values to 8-bit with best rounding */
72
73 static const UINT8 c5to8bits[32] = {
74 0, 8, 16, 25, 33, 41, 49, 58,
75 66, 74, 82, 90, 99, 107, 115, 123,
76 132, 140, 148, 156, 165, 173, 181, 189,
77 197, 206, 214, 222, 230, 239, 247, 255
78 };
79
80
81
82 LOCAL(int)
read_byte(tga_source_ptr sinfo)83 read_byte(tga_source_ptr sinfo)
84 /* Read next byte from Targa file */
85 {
86 register FILE *infile = sinfo->pub.input_file;
87 register int c;
88
89 if ((c = getc(infile)) == EOF)
90 ERREXIT(sinfo->cinfo, JERR_INPUT_EOF);
91 return c;
92 }
93
94
95 LOCAL(void)
read_colormap(tga_source_ptr sinfo,int cmaplen,int mapentrysize)96 read_colormap(tga_source_ptr sinfo, int cmaplen, int mapentrysize)
97 /* Read the colormap from a Targa file */
98 {
99 int i;
100
101 /* Presently only handles 24-bit BGR format */
102 if (mapentrysize != 24)
103 ERREXIT(sinfo->cinfo, JERR_TGA_BADCMAP);
104
105 for (i = 0; i < cmaplen; i++) {
106 sinfo->colormap[2][i] = (JSAMPLE)read_byte(sinfo);
107 sinfo->colormap[1][i] = (JSAMPLE)read_byte(sinfo);
108 sinfo->colormap[0][i] = (JSAMPLE)read_byte(sinfo);
109 }
110 }
111
112
113 /*
114 * read_pixel methods: get a single pixel from Targa file into tga_pixel[]
115 */
116
117 METHODDEF(void)
read_non_rle_pixel(tga_source_ptr sinfo)118 read_non_rle_pixel(tga_source_ptr sinfo)
119 /* Read one Targa pixel from the input file; no RLE expansion */
120 {
121 register int i;
122
123 for (i = 0; i < sinfo->pixel_size; i++) {
124 sinfo->tga_pixel[i] = (U_CHAR)read_byte(sinfo);
125 }
126 }
127
128
129 METHODDEF(void)
read_rle_pixel(tga_source_ptr sinfo)130 read_rle_pixel(tga_source_ptr sinfo)
131 /* Read one Targa pixel from the input file, expanding RLE data as needed */
132 {
133 register int i;
134
135 /* Duplicate previously read pixel? */
136 if (sinfo->dup_pixel_count > 0) {
137 sinfo->dup_pixel_count--;
138 return;
139 }
140
141 /* Time to read RLE block header? */
142 if (--sinfo->block_count < 0) { /* decrement pixels remaining in block */
143 i = read_byte(sinfo);
144 if (i & 0x80) { /* Start of duplicate-pixel block? */
145 sinfo->dup_pixel_count = i & 0x7F; /* number of dups after this one */
146 sinfo->block_count = 0; /* then read new block header */
147 } else {
148 sinfo->block_count = i & 0x7F; /* number of pixels after this one */
149 }
150 }
151
152 /* Read next pixel */
153 for (i = 0; i < sinfo->pixel_size; i++) {
154 sinfo->tga_pixel[i] = (U_CHAR)read_byte(sinfo);
155 }
156 }
157
158
159 /*
160 * Read one row of pixels.
161 *
162 * We provide several different versions depending on input file format.
163 */
164
165
166 METHODDEF(JDIMENSION)
get_8bit_gray_row(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)167 get_8bit_gray_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
168 /* This version is for reading 8-bit grayscale pixels */
169 {
170 tga_source_ptr source = (tga_source_ptr)sinfo;
171 register JSAMPROW ptr;
172 register JDIMENSION col;
173
174 ptr = source->pub.buffer[0];
175 for (col = cinfo->image_width; col > 0; col--) {
176 (*source->read_pixel) (source); /* Load next pixel into tga_pixel */
177 *ptr++ = (JSAMPLE)UCH(source->tga_pixel[0]);
178 }
179 return 1;
180 }
181
182 METHODDEF(JDIMENSION)
get_8bit_row(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)183 get_8bit_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
184 /* This version is for reading 8-bit colormap indexes */
185 {
186 tga_source_ptr source = (tga_source_ptr)sinfo;
187 register int t;
188 register JSAMPROW ptr;
189 register JDIMENSION col;
190 register JSAMPARRAY colormap = source->colormap;
191 int cmaplen = source->cmap_length;
192
193 ptr = source->pub.buffer[0];
194 for (col = cinfo->image_width; col > 0; col--) {
195 (*source->read_pixel) (source); /* Load next pixel into tga_pixel */
196 t = UCH(source->tga_pixel[0]);
197 if (t >= cmaplen)
198 ERREXIT(cinfo, JERR_TGA_BADPARMS);
199 *ptr++ = colormap[0][t];
200 *ptr++ = colormap[1][t];
201 *ptr++ = colormap[2][t];
202 }
203 return 1;
204 }
205
206 METHODDEF(JDIMENSION)
get_16bit_row(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)207 get_16bit_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
208 /* This version is for reading 16-bit pixels */
209 {
210 tga_source_ptr source = (tga_source_ptr)sinfo;
211 register int t;
212 register JSAMPROW ptr;
213 register JDIMENSION col;
214
215 ptr = source->pub.buffer[0];
216 for (col = cinfo->image_width; col > 0; col--) {
217 (*source->read_pixel) (source); /* Load next pixel into tga_pixel */
218 t = UCH(source->tga_pixel[0]);
219 t += UCH(source->tga_pixel[1]) << 8;
220 /* We expand 5 bit data to 8 bit sample width.
221 * The format of the 16-bit (LSB first) input word is
222 * xRRRRRGGGGGBBBBB
223 */
224 ptr[2] = (JSAMPLE)c5to8bits[t & 0x1F];
225 t >>= 5;
226 ptr[1] = (JSAMPLE)c5to8bits[t & 0x1F];
227 t >>= 5;
228 ptr[0] = (JSAMPLE)c5to8bits[t & 0x1F];
229 ptr += 3;
230 }
231 return 1;
232 }
233
234 METHODDEF(JDIMENSION)
get_24bit_row(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)235 get_24bit_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
236 /* This version is for reading 24-bit pixels */
237 {
238 tga_source_ptr source = (tga_source_ptr)sinfo;
239 register JSAMPROW ptr;
240 register JDIMENSION col;
241
242 ptr = source->pub.buffer[0];
243 for (col = cinfo->image_width; col > 0; col--) {
244 (*source->read_pixel) (source); /* Load next pixel into tga_pixel */
245 *ptr++ = (JSAMPLE)UCH(source->tga_pixel[2]); /* change BGR to RGB order */
246 *ptr++ = (JSAMPLE)UCH(source->tga_pixel[1]);
247 *ptr++ = (JSAMPLE)UCH(source->tga_pixel[0]);
248 }
249 return 1;
250 }
251
252 /*
253 * Targa also defines a 32-bit pixel format with order B,G,R,A.
254 * We presently ignore the attribute byte, so the code for reading
255 * these pixels is identical to the 24-bit routine above.
256 * This works because the actual pixel length is only known to read_pixel.
257 */
258
259 #define get_32bit_row get_24bit_row
260
261
262 /*
263 * This method is for re-reading the input data in standard top-down
264 * row order. The entire image has already been read into whole_image
265 * with proper conversion of pixel format, but it's in a funny row order.
266 */
267
268 METHODDEF(JDIMENSION)
get_memory_row(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)269 get_memory_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
270 {
271 tga_source_ptr source = (tga_source_ptr)sinfo;
272 JDIMENSION source_row;
273
274 /* Compute row of source that maps to current_row of normal order */
275 /* For now, assume image is bottom-up and not interlaced. */
276 /* NEEDS WORK to support interlaced images! */
277 source_row = cinfo->image_height - source->current_row - 1;
278
279 /* Fetch that row from virtual array */
280 source->pub.buffer = (*cinfo->mem->access_virt_sarray)
281 ((j_common_ptr)cinfo, source->whole_image,
282 source_row, (JDIMENSION)1, FALSE);
283
284 source->current_row++;
285 return 1;
286 }
287
288
289 /*
290 * This method loads the image into whole_image during the first call on
291 * get_pixel_rows. The get_pixel_rows pointer is then adjusted to call
292 * get_memory_row on subsequent calls.
293 */
294
295 METHODDEF(JDIMENSION)
preload_image(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)296 preload_image(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
297 {
298 tga_source_ptr source = (tga_source_ptr)sinfo;
299 JDIMENSION row;
300 cd_progress_ptr progress = (cd_progress_ptr)cinfo->progress;
301
302 /* Read the data into a virtual array in input-file row order. */
303 for (row = 0; row < cinfo->image_height; row++) {
304 if (progress != NULL) {
305 progress->pub.pass_counter = (long)row;
306 progress->pub.pass_limit = (long)cinfo->image_height;
307 (*progress->pub.progress_monitor) ((j_common_ptr)cinfo);
308 }
309 source->pub.buffer = (*cinfo->mem->access_virt_sarray)
310 ((j_common_ptr)cinfo, source->whole_image, row, (JDIMENSION)1, TRUE);
311 (*source->get_pixel_rows) (cinfo, sinfo);
312 }
313 if (progress != NULL)
314 progress->completed_extra_passes++;
315
316 /* Set up to read from the virtual array in unscrambled order */
317 source->pub.get_pixel_rows = get_memory_row;
318 source->current_row = 0;
319 /* And read the first row */
320 return get_memory_row(cinfo, sinfo);
321 }
322
323
324 /*
325 * Read the file header; return image size and component count.
326 */
327
328 METHODDEF(void)
start_input_tga(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)329 start_input_tga(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
330 {
331 tga_source_ptr source = (tga_source_ptr)sinfo;
332 U_CHAR targaheader[18];
333 int idlen, cmaptype, subtype, flags, interlace_type, components;
334 unsigned int width, height, maplen;
335 boolean is_bottom_up;
336
337 #define GET_2B(offset) \
338 ((unsigned int)UCH(targaheader[offset]) + \
339 (((unsigned int)UCH(targaheader[offset + 1])) << 8))
340
341 if (!ReadOK(source->pub.input_file, targaheader, 18))
342 ERREXIT(cinfo, JERR_INPUT_EOF);
343
344 /* Pretend "15-bit" pixels are 16-bit --- we ignore attribute bit anyway */
345 if (targaheader[16] == 15)
346 targaheader[16] = 16;
347
348 idlen = UCH(targaheader[0]);
349 cmaptype = UCH(targaheader[1]);
350 subtype = UCH(targaheader[2]);
351 maplen = GET_2B(5);
352 width = GET_2B(12);
353 height = GET_2B(14);
354 source->pixel_size = UCH(targaheader[16]) >> 3;
355 flags = UCH(targaheader[17]); /* Image Descriptor byte */
356
357 is_bottom_up = ((flags & 0x20) == 0); /* bit 5 set => top-down */
358 interlace_type = flags >> 6; /* bits 6/7 are interlace code */
359
360 if (cmaptype > 1 || /* cmaptype must be 0 or 1 */
361 source->pixel_size < 1 || source->pixel_size > 4 ||
362 (UCH(targaheader[16]) & 7) != 0 || /* bits/pixel must be multiple of 8 */
363 interlace_type != 0 || /* currently don't allow interlaced image */
364 width == 0 || height == 0) /* image width/height must be non-zero */
365 ERREXIT(cinfo, JERR_TGA_BADPARMS);
366 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
367 if (sinfo->max_pixels &&
368 (unsigned long long)width * height > sinfo->max_pixels)
369 ERREXIT(cinfo, JERR_WIDTH_OVERFLOW);
370 #endif
371
372 if (subtype > 8) {
373 /* It's an RLE-coded file */
374 source->read_pixel = read_rle_pixel;
375 source->block_count = source->dup_pixel_count = 0;
376 subtype -= 8;
377 } else {
378 /* Non-RLE file */
379 source->read_pixel = read_non_rle_pixel;
380 }
381
382 /* Now should have subtype 1, 2, or 3 */
383 components = 3; /* until proven different */
384 cinfo->in_color_space = JCS_RGB;
385
386 switch (subtype) {
387 case 1: /* Colormapped image */
388 if (source->pixel_size == 1 && cmaptype == 1)
389 source->get_pixel_rows = get_8bit_row;
390 else
391 ERREXIT(cinfo, JERR_TGA_BADPARMS);
392 TRACEMS2(cinfo, 1, JTRC_TGA_MAPPED, width, height);
393 break;
394 case 2: /* RGB image */
395 switch (source->pixel_size) {
396 case 2:
397 source->get_pixel_rows = get_16bit_row;
398 break;
399 case 3:
400 source->get_pixel_rows = get_24bit_row;
401 break;
402 case 4:
403 source->get_pixel_rows = get_32bit_row;
404 break;
405 default:
406 ERREXIT(cinfo, JERR_TGA_BADPARMS);
407 break;
408 }
409 TRACEMS2(cinfo, 1, JTRC_TGA, width, height);
410 break;
411 case 3: /* Grayscale image */
412 components = 1;
413 cinfo->in_color_space = JCS_GRAYSCALE;
414 if (source->pixel_size == 1)
415 source->get_pixel_rows = get_8bit_gray_row;
416 else
417 ERREXIT(cinfo, JERR_TGA_BADPARMS);
418 TRACEMS2(cinfo, 1, JTRC_TGA_GRAY, width, height);
419 break;
420 default:
421 ERREXIT(cinfo, JERR_TGA_BADPARMS);
422 break;
423 }
424
425 if (is_bottom_up) {
426 /* Create a virtual array to buffer the upside-down image. */
427 source->whole_image = (*cinfo->mem->request_virt_sarray)
428 ((j_common_ptr)cinfo, JPOOL_IMAGE, FALSE,
429 (JDIMENSION)width * components, (JDIMENSION)height, (JDIMENSION)1);
430 if (cinfo->progress != NULL) {
431 cd_progress_ptr progress = (cd_progress_ptr)cinfo->progress;
432 progress->total_extra_passes++; /* count file input as separate pass */
433 }
434 /* source->pub.buffer will point to the virtual array. */
435 source->pub.buffer_height = 1; /* in case anyone looks at it */
436 source->pub.get_pixel_rows = preload_image;
437 } else {
438 /* Don't need a virtual array, but do need a one-row input buffer. */
439 source->whole_image = NULL;
440 source->pub.buffer = (*cinfo->mem->alloc_sarray)
441 ((j_common_ptr)cinfo, JPOOL_IMAGE,
442 (JDIMENSION)width * components, (JDIMENSION)1);
443 source->pub.buffer_height = 1;
444 source->pub.get_pixel_rows = source->get_pixel_rows;
445 }
446
447 while (idlen--) /* Throw away ID field */
448 (void)read_byte(source);
449
450 if (maplen > 0) {
451 if (maplen > 256 || GET_2B(3) != 0)
452 ERREXIT(cinfo, JERR_TGA_BADCMAP);
453 /* Allocate space to store the colormap */
454 source->colormap = (*cinfo->mem->alloc_sarray)
455 ((j_common_ptr)cinfo, JPOOL_IMAGE, (JDIMENSION)maplen, (JDIMENSION)3);
456 source->cmap_length = (int)maplen;
457 /* and read it from the file */
458 read_colormap(source, (int)maplen, UCH(targaheader[7]));
459 } else {
460 if (cmaptype) /* but you promised a cmap! */
461 ERREXIT(cinfo, JERR_TGA_BADPARMS);
462 source->colormap = NULL;
463 source->cmap_length = 0;
464 }
465
466 cinfo->input_components = components;
467 cinfo->data_precision = 8;
468 cinfo->image_width = width;
469 cinfo->image_height = height;
470 }
471
472
473 /*
474 * Finish up at the end of the file.
475 */
476
477 METHODDEF(void)
finish_input_tga(j_compress_ptr cinfo,cjpeg_source_ptr sinfo)478 finish_input_tga(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
479 {
480 /* no work */
481 }
482
483
484 /*
485 * The module selection routine for Targa format input.
486 */
487
488 GLOBAL(cjpeg_source_ptr)
jinit_read_targa(j_compress_ptr cinfo)489 jinit_read_targa(j_compress_ptr cinfo)
490 {
491 tga_source_ptr source;
492
493 /* Create module interface object */
494 source = (tga_source_ptr)
495 (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
496 sizeof(tga_source_struct));
497 source->cinfo = cinfo; /* make back link for subroutines */
498 /* Fill in method ptrs, except get_pixel_rows which start_input sets */
499 source->pub.start_input = start_input_tga;
500 source->pub.finish_input = finish_input_tga;
501 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
502 source->pub.max_pixels = 0;
503 #endif
504
505 return (cjpeg_source_ptr)source;
506 }
507
508 #endif /* TARGA_SUPPORTED */
509