jof_png.c

Go to the documentation of this file.

 
#include <stddef.h>
#include <stdint.h>
#include <string.h>
 
#include "jof_internal.h"
#include "jof_png_internal.h"
#include "miniz.h"
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "ra8_err.h"
#include "ra8_log.h"
 
/* ---------------------------------------------------------------------------
 * Byte-source helpers.
 * ---------------------------------------------------------------------------
 */
 
/* ---------------------------------------------------------------------------
 * Scanline reconstruction.
 * ---------------------------------------------------------------------------
 */

RA8_INTERNAL
RA8_INTERNAL static uint8_t internal_png_paeth(uint8_t a, uint8_t b, uint8_t c)
{
  const int32_t p  = (int32_t)a + (int32_t)b - (int32_t)c;
  const int32_t pa = (p > (int32_t)a) ? (p - (int32_t)a) : ((int32_t)a - p);
  const int32_t pb = (p > (int32_t)b) ? (p - (int32_t)b) : ((int32_t)b - p);
  const int32_t pc = (p > (int32_t)c) ? (p - (int32_t)c) : ((int32_t)c - p);
  if ((pa <= pb) && (pa <= pc)) {
    return a;
  }
  if (pb <= pc) {
    return b;
  }
  return c;
}

RA8_INTERNAL
RA8_INTERNAL static ra8_err_t internal_png_unfilter(uint8_t        filter,
                                                    uint8_t*       row,
                                                    const uint8_t* prev,
                                                    uint32_t       nbytes,
                                                    uint8_t        bpp)
{
  switch (filter) {
    case k_ra8_png_filter_none:
      return k_ra8_ok;
    case k_ra8_png_filter_sub:
      for (uint32_t i = (uint32_t)bpp; i < nbytes; i++) {
        row[i] = (uint8_t)(row[i] + row[i - bpp]);
      }
      return k_ra8_ok;
    case k_ra8_png_filter_up:
      for (uint32_t i = 0U; i < nbytes; i++) {
        row[i] = (uint8_t)(row[i] + prev[i]);
      }
      return k_ra8_ok;
    case k_ra8_png_filter_avg:
      for (uint32_t i = 0U; i < nbytes; i++) {
        const uint32_t left = (i >= (uint32_t)bpp) ? (uint32_t)row[i - bpp] : 0U;
        row[i]              = (uint8_t)(row[i] + (uint8_t)((left + (uint32_t)prev[i]) / 2U));
      }
      return k_ra8_ok;
    case k_ra8_png_filter_paeth:
      for (uint32_t i = 0U; i < nbytes; i++) {
        const uint8_t a = (i >= (uint32_t)bpp) ? row[i - bpp] : 0U;
        const uint8_t c = (i >= (uint32_t)bpp) ? prev[i - bpp] : 0U;
        row[i]          = (uint8_t)(row[i] + internal_png_paeth(a, prev[i], c));
      }
      return k_ra8_ok;
    default:
      return k_ra8_err_validation_failed;
  }
}

RA8_INTERNAL
RA8_INTERNAL static ra8_err_t internal_png_translate(ra8_png_state_t* st, const uint8_t* row)
{
  const uint32_t w = (uint32_t)st->w;
  if (st->color_type == (uint8_t)k_ra8_png_color_pal) {
    for (uint32_t x = 0U; x < w; x++) {
      const uint8_t idx = row[x];
      if ((uint16_t)idx >= st->plte_count) {
        return k_ra8_err_validation_failed;
      }
      const uint32_t src = (uint32_t)idx * (uint32_t)k_ra8_png_ch_3;
      const uint32_t dst = x * (uint32_t)st->dst_ch;
      st->xlat[dst]      = st->palette[src];
      st->xlat[dst + 1U] = st->palette[src + 1U];
      st->xlat[dst + 2U] = st->palette[src + 2U];
      if (st->dst_ch == (uint8_t)k_ra8_png_ch_4) {
        st->xlat[dst + 3U] =
          ((uint16_t)idx < st->trns_count) ? st->trns[idx] : (uint8_t)k_ra8_png_opaque;
      }
    }
    return k_ra8_ok;
  }
  if (st->color_type == (uint8_t)k_ra8_png_color_ga) {
    for (uint32_t x = 0U; x < w; x++) {
      const uint8_t  g   = row[(size_t)x * (size_t)k_ra8_png_ch_2];
      const uint8_t  a   = row[((size_t)x * (size_t)k_ra8_png_ch_2) + 1U];
      const uint32_t dst = x * (uint32_t)k_ra8_png_ch_4;
      st->xlat[dst]      = g;
      st->xlat[dst + 1U] = g;
      st->xlat[dst + 2U] = g;
      st->xlat[dst + 3U] = a;
    }
    return k_ra8_ok;
  }
  /* gray, RGB, RGBA: source layout == output layout. */
  (void)memcpy(st->xlat, row, (size_t)w * (size_t)st->dst_ch);
  return k_ra8_ok;
}

RA8_INTERNAL
RA8_INTERNAL static ra8_err_t
internal_png_consume_rows(ra8_png_state_t* st, const uint8_t* src, uint32_t avail)
{
  uint32_t pos = 0U;
  while (pos < avail) {
    const uint32_t need = st->rowlen - st->rowfill;
    const uint32_t left = avail - pos;
    const uint32_t take = (left < need) ? left : need;
    (void)memcpy(&st->rowbuf[st->rowfill], &src[pos], (size_t)take);
    st->rowfill += take;
    pos += take;
    if (st->rowfill < st->rowlen) {
      break; /* partial scanline; wait for more inflate output */
    }
    if (st->rows_done >= st->h) {
      return k_ra8_err_validation_failed; /* more scanlines than IHDR said */
    }
    const uint32_t nbytes = st->rowlen - 1U;
    ra8_err_t      err =
      internal_png_unfilter(st->rowbuf[0], &st->rowbuf[1], st->prevrow, nbytes, st->src_ch);
    if (err != k_ra8_ok) {
      return err;
    }
    (void)memcpy(st->prevrow, &st->rowbuf[1], (size_t)nbytes);
    err = internal_png_translate(st, &st->rowbuf[1]);
    if (err != k_ra8_ok) {
      return err;
    }
    err = st->on_rows(st->cb_ctx, st->xlat, st->w, st->rows_done, 1U, st->dst_ch);
    if (err != k_ra8_ok) {
      return err;
    }
    st->rows_done++;
    st->rowfill = 0U;
  }
  return k_ra8_ok;
}
 
/* ---------------------------------------------------------------------------
 * IDAT inflate phase.
 * ---------------------------------------------------------------------------
 */

RA8_INTERNAL
RA8_INTERNAL static ra8_err_t internal_png_bind_geometry(ra8_png_state_t* st, jof_bump_t* bump)
{
  if (st->color_type == (uint8_t)k_ra8_png_color_pal) {
    if (st->has_plte == 0U) {
      return k_ra8_err_validation_failed;
    }
    st->dst_ch = (st->has_trns != 0U) ? (uint8_t)k_ra8_png_ch_4 : (uint8_t)k_ra8_png_ch_3;
  } else if (st->color_type == (uint8_t)k_ra8_png_color_gray) {
    st->dst_ch = (uint8_t)k_ra8_png_ch_1;
  } else if (st->color_type == (uint8_t)k_ra8_png_color_ga) {
    st->dst_ch = (uint8_t)k_ra8_png_ch_4;
  } else {
    st->dst_ch = st->src_ch; /* RGB -> 3, RGBA -> 4 */
  }
  const ra8_err_t err = st->on_geom(st->cb_ctx, st->w, st->h, st->dst_ch);
  if (err != k_ra8_ok) {
    return err;
  }
  st->rowlen = 1U + ((uint32_t)st->w * (uint32_t)st->src_ch);
  /* The bump allocator returns 8-byte-aligned void* carves, which satisfies
   * the inflate context's alignment. */
  st->inflator = (tinfl_decompressor*)priv_jof_bump_take(bump, sizeof(tinfl_decompressor));
  st->ring     = priv_jof_bump_take(bump, (size_t)k_ra8_png_ring_bytes);
  st->inbuf    = priv_jof_bump_take(bump, (size_t)k_ra8_png_inbuf_bytes);
  st->rowbuf   = priv_jof_bump_take(bump, (size_t)st->rowlen);
  st->prevrow  = priv_jof_bump_take(bump, (size_t)(st->rowlen - 1U));
  st->xlat     = priv_jof_bump_take(bump, (size_t)st->w * (size_t)st->dst_ch);
  if ((st->inflator == nullptr) || (st->ring == nullptr) || (st->inbuf == nullptr) ||
      (st->rowbuf == nullptr) || (st->prevrow == nullptr) || (st->xlat == nullptr)) {
    return k_ra8_err_invalid_size;
  }
  (void)memset(st->prevrow, 0, (size_t)(st->rowlen - 1U)); /* PNG sec 9: prior row = zeroes */
  tinfl_init(st->inflator);
  return k_ra8_ok;
}

RA8_INTERNAL
RA8_INTERNAL static ra8_err_t internal_png_refill_input(ra8_png_state_t* st, uint32_t* out_avail)
{
  *out_avail = 0U;
  for (uint32_t guard = 0U; guard < (uint32_t)k_ra8_png_max_chunks; guard++) {
    if (st->idat_rem > 0U) {
      const uint32_t  take = (st->idat_rem < (uint32_t)k_ra8_png_inbuf_bytes)
                               ? st->idat_rem
                               : (uint32_t)k_ra8_png_inbuf_bytes;
      const ra8_err_t err  = priv_jof_png_pull_exact(st, st->inbuf, take);
      if (err != k_ra8_ok) {
        return err;
      }
      st->idat_rem -= take;
      *out_avail = take;
      return k_ra8_ok;
    }
    /* Current IDAT exhausted: skip its CRC, look at the next chunk. */
    ra8_err_t err = priv_jof_png_skip(st, (uint32_t)k_ra8_png_crc_bytes);
    if (err != k_ra8_ok) {
      return err;
    }
    uint32_t len  = 0U;
    uint32_t type = 0U;
    err           = priv_jof_png_chunk_hdr(st, &len, &type);
    if (err != k_ra8_ok) {
      return err;
    }
    if (type == (uint32_t)k_ra8_png_type_idat) {
      st->idat_rem = len;
      continue;
    }
    st->pending_len   = len;
    st->pending_type  = type;
    st->pending_valid = 1U;
    st->source_done   = 1U;
    return k_ra8_ok; /* clean end of the compressed stream */
  }
  return k_ra8_err_protocol_error; /* chunk budget exhausted (hostile) */
}

typedef struct {
  uint32_t in_avail; 
  uint32_t in_pos;   
  uint8_t  stalls;   
  uint8_t  done;     
} ra8_png_iter_t;

RA8_INTERNAL
RA8_INTERNAL static ra8_err_t internal_png_inflate_step(ra8_png_state_t* st, ra8_png_iter_t* it)
{
  // mcdc-deactivated: refill-first loop structure; entering with a drained window after the source ended requires the source-ending iteration to return >= TINFL_STATUS_DONE without finishing, i.e. tinfl parked output mid-flush at the exact call the source ended -- for every constructible stream that call either completes (DONE exits the loop) or fails closed at the status check, so the (drained, source-done) entry cannot be flipped independently.
  if ((it->in_pos == it->in_avail) && (st->source_done == 0U)) {
    const ra8_err_t err = internal_png_refill_input(st, &it->in_avail);
    if (err != k_ra8_ok) {
      return err;
    }
    it->in_pos = 0U;
  }
  size_t             in_sz  = (size_t)(it->in_avail - it->in_pos);
  size_t             out_sz = (size_t)((uint32_t)k_ra8_png_ring_bytes - st->ring_wr);
  const mz_uint      flags  = (mz_uint)TINFL_FLAG_PARSE_ZLIB_HEADER |
                              ((st->source_done == 0U) ? (mz_uint)TINFL_FLAG_HAS_MORE_INPUT : 0U);
  const tinfl_status status = tinfl_decompress(st->inflator,
                                               &st->inbuf[it->in_pos],
                                               &in_sz,
                                               st->ring,
                                               &st->ring[st->ring_wr],
                                               &out_sz,
                                               flags);
  if (status < TINFL_STATUS_DONE) {
    return k_ra8_err_protocol_error; /* corrupt deflate / bad zlib header */
  }
  // mcdc-deactivated: zero-progress stall guard, defense-in-depth against a decompressor that spins without failing; tinfl never returns >= TINFL_STATUS_DONE with neither input consumed nor output produced (a starved mid-stream call without HAS_MORE_INPUT fails closed at the status check above, and the refill-first structure guarantees input is present otherwise), so the stall arm is not constructible from any source stream.
  if ((in_sz == 0U) && (out_sz == 0U)) {
    it->stalls++;
    // mcdc-deactivated: inner arm of the non-constructible stall guard above (same rationale); kept so a hypothetical spinning decompressor aborts after one repeat instead of looping.
    if ((it->stalls > 1U) || (st->source_done != 0U)) {
      return k_ra8_err_protocol_error; /* truncated stream / no progress */
    }
  } else {
    it->stalls = 0U;
  }
  if (out_sz > 0U) {
    const ra8_err_t err = internal_png_consume_rows(st, &st->ring[st->ring_wr], (uint32_t)out_sz);
    if (err != k_ra8_ok) {
      return err;
    }
    st->ring_wr = (st->ring_wr + (uint32_t)out_sz) & ((uint32_t)k_ra8_png_ring_bytes - 1U);
  }
  it->in_pos += (uint32_t)in_sz;
  it->done = (status == TINFL_STATUS_DONE) ? 1U : 0U;
  return k_ra8_ok;
}

RA8_INTERNAL
RA8_INTERNAL static ra8_err_t internal_png_inflate_idat(ra8_png_state_t* st, uint32_t first_len)
{
  st->idat_rem      = first_len;
  ra8_png_iter_t it = {};
  while (it.done == 0U) {
    const ra8_err_t err = internal_png_inflate_step(st, &it);
    if (err != k_ra8_ok) {
      return err;
    }
  }
  /* Strict termination: every declared row arrived, nothing extra. */
  if ((st->rows_done != st->h) || (st->rowfill != 0U)) {
    return k_ra8_err_validation_failed;
  }
  if ((it.in_pos != it.in_avail) || (st->idat_rem != 0U)) {
    return k_ra8_err_validation_failed; /* trailing garbage inside IDAT */
  }
  return k_ra8_ok;
}
 
/* ---------------------------------------------------------------------------
 * Entry point.
 * ---------------------------------------------------------------------------
 */

RA8_INTERNAL
RA8_INTERNAL static ra8_err_t
internal_png_run_idat(ra8_png_state_t* st, jof_bump_t* bump, uint32_t len)
{
  ra8_err_t err = internal_png_bind_geometry(st, bump);
  if (err != k_ra8_ok) {
    return err;
  }
  err = internal_png_inflate_idat(st, len);
  if (err != k_ra8_ok) {
    return err;
  }
  return priv_jof_png_finish(st);
}

RA8_INTERNAL
RA8_INTERNAL static ra8_err_t
internal_png_walk_chunks(ra8_png_state_t* st, jof_bump_t* bump, uint16_t max_w, uint16_t max_h)
{
  ra8_err_t err = priv_jof_png_prologue(st, max_w, max_h);
  if (err != k_ra8_ok) {
    return err;
  }
  for (uint32_t guard = 0U; guard < (uint32_t)k_ra8_png_max_chunks; guard++) {
    uint32_t len  = 0U;
    uint32_t type = 0U;
    err           = priv_jof_png_chunk_hdr(st, &len, &type);
    if (err != k_ra8_ok) {
      return err;
    }
    if (type == (uint32_t)k_ra8_png_type_idat) {
      return internal_png_run_idat(st, bump, len);
    }
    err = priv_jof_png_pre_idat(st, len, type);
    if (err != k_ra8_ok) {
      return err;
    }
  }
  return k_ra8_err_protocol_error; /* chunk budget exhausted (hostile) */
}
 
RA8_PRIV ra8_err_t priv_jof_png_rows(jof_pull_fn pull,
                                     void*       pull_ctx,
                                     jof_bump_t* bump,
                                     uint16_t    max_w,
                                     uint16_t    max_h,
                                     jof_geom_fn on_geom,
                                     jof_rows_fn on_rows,
                                     void*       cb_ctx)
{
  static const char* const s_tag = "jof_png";
  static ra8_png_state_t   s_png;
  RA8_CHECK_NULL_PTR(pull, s_tag, "pull must not be nullptr");
  RA8_CHECK_NULL_PTR(bump, s_tag, "bump must not be nullptr");
  RA8_CHECK_NULL_PTR(on_geom, s_tag, "on_geom must not be nullptr");
  RA8_CHECK_NULL_PTR(on_rows, s_tag, "on_rows must not be nullptr");
  ra8_png_state_t* st = &s_png;
  (void)memset(st, 0, sizeof(*st));
  st->pull     = pull;
  st->pull_ctx = pull_ctx;
  st->on_geom  = on_geom;
  st->on_rows  = on_rows;
  st->cb_ctx   = cb_ctx;
  return internal_png_walk_chunks(st, bump, max_w, max_h);
}