media/filters/jpeg_parser.cc

   1 // Copyright 2015 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "media/filters/jpeg_parser.h"
   6
   7 #include "base/big_endian.h"
   8 #include "base/logging.h"
   9
  10 using base::BigEndianReader;
  11
  12 #define READ_U8_OR_RETURN_FALSE(out)                                       \
  13   do {                                                                     \
  14     uint8_t _out;                                                          \
  15     if (!reader.ReadU8(&_out)) {                                           \
  16       DVLOG(1)                                                             \
  17           << "Error in stream: unexpected EOS while trying to read " #out; \
  18       return false;                                                        \
  19     }                                                                      \
  20     *(out) = _out;                                                         \
  21   } while (0)
  22
  23 #define READ_U16_OR_RETURN_FALSE(out)                                      \
  24   do {                                                                     \
  25     uint16_t _out;                                                         \
  26     if (!reader.ReadU16(&_out)) {                                          \
  27       DVLOG(1)                                                             \
  28           << "Error in stream: unexpected EOS while trying to read " #out; \
  29       return false;                                                        \
  30     }                                                                      \
  31     *(out) = _out;                                                         \
  32   } while (0)
  33
  34 namespace media {
  35
  36 namespace {
  37 enum JpegMarker {
  38   SOF0 = 0xC0,     // start of frame (baseline)
  39   DHT = 0xC4,      // define huffman table
  40   SOI = 0xD8,      // start of image
  41   SOS = 0xDA,      // start of scan
  42   DQT = 0xDB,      // define quantization table
  43   DRI = 0xDD,      // define restart internal
  44   MARKER1 = 0xFF,  // jpeg marker prefix
  45 };
  46 }
  47
  48 static bool InRange(int value, int a, int b) {
  49   return a <= value && value <= b;
  50 }
  51
  52 // |frame_header| is already initialized to 0 in ParseJpegPicture.
  53 static bool ParseSOF(const char* buffer,
  54                      size_t length,
  55                      JpegFrameHeader* frame_header) {
  56   // Spec B.2.2 Frame header syntax
  57   DCHECK(buffer);
  58   DCHECK(frame_header);
  59   BigEndianReader reader(buffer, length);
  60
  61   uint8_t precision;
  62   READ_U8_OR_RETURN_FALSE(&precision);
  63   READ_U16_OR_RETURN_FALSE(&frame_header->visible_height);
  64   READ_U16_OR_RETURN_FALSE(&frame_header->visible_width);
  65   READ_U8_OR_RETURN_FALSE(&frame_header->num_components);
  66
  67   if (precision != 8) {
  68     DLOG(ERROR) << "Only support 8-bit precision, not "
  69                 << static_cast<int>(precision) << " bit for baseline";
  70     return false;
  71   }
  72   if (frame_header->num_components >= arraysize(frame_header->components)) {
  73     DLOG(ERROR) << "num_components="
  74                 << static_cast<int>(frame_header->num_components)
  75                 << " is not supported";
  76     return false;
  77   }
  78
  79   for (size_t i = 0; i < frame_header->num_components; i++) {
  80     JpegComponent& component = frame_header->components[i];
  81     READ_U8_OR_RETURN_FALSE(&component.id);
  82     if (component.id > frame_header->num_components) {
  83       DLOG(ERROR) << "component id (" << static_cast<int>(component.id)
  84                   << ") should be <= num_components ("
  85                   << static_cast<int>(frame_header->num_components) << ")";
  86       return false;
  87     }
  88     uint8_t hv;
  89     READ_U8_OR_RETURN_FALSE(&hv);
  90     component.horizontal_sampling_factor = hv / 16;
  91     component.vertical_sampling_factor = hv % 16;
  92     if (!InRange(component.horizontal_sampling_factor, 1, 4)) {
  93       DVLOG(1) << "Invalid horizontal sampling factor "
  94                << static_cast<int>(component.horizontal_sampling_factor);
  95       return false;
  96     }
  97     if (!InRange(component.vertical_sampling_factor, 1, 4)) {
  98       DVLOG(1) << "Invalid vertical sampling factor "
  99                << static_cast<int>(component.horizontal_sampling_factor);
 100       return false;
 101     }
 102     READ_U8_OR_RETURN_FALSE(&component.quantization_table_selector);
 103   }
 104
 105   return true;
 106 }
 107
 108 // |q_table| is already initialized to 0 in ParseJpegPicture.
 109 static bool ParseDQT(const char* buffer,
 110                      size_t length,
 111                      JpegQuantizationTable* q_table) {
 112   // Spec B.2.4.1 Quantization table-specification syntax
 113   DCHECK(buffer);
 114   DCHECK(q_table);
 115   BigEndianReader reader(buffer, length);
 116   while (reader.remaining() > 0) {
 117     uint8_t precision_and_table_id;
 118     READ_U8_OR_RETURN_FALSE(&precision_and_table_id);
 119     uint8_t precision = precision_and_table_id / 16;
 120     uint8_t table_id = precision_and_table_id % 16;
 121     if (!InRange(precision, 0, 1)) {
 122       DVLOG(1) << "Invalid precision " << static_cast<int>(precision);
 123       return false;
 124     }
 125     if (precision == 1) {  // 1 means 16-bit precision
 126       DLOG(ERROR) << "An 8-bit DCT-based process shall not use a 16-bit "
 127                   << "precision quantization table";
 128       return false;
 129     }
 130     if (table_id >= kJpegMaxQuantizationTableNum) {
 131       DLOG(ERROR) << "Quantization table id (" << static_cast<int>(table_id)
 132                   << ") exceeded " << kJpegMaxQuantizationTableNum;
 133       return false;
 134     }
 135
 136     if (!reader.ReadBytes(&q_table[table_id].value,
 137                           sizeof(q_table[table_id].value)))
 138       return false;
 139     q_table[table_id].valid = true;
 140   }
 141   return true;
 142 }
 143
 144 // |dc_table| and |ac_table| are already initialized to 0 in ParseJpegPicture.
 145 static bool ParseDHT(const char* buffer,
 146                      size_t length,
 147                      JpegHuffmanTable* dc_table,
 148                      JpegHuffmanTable* ac_table) {
 149   // Spec B.2.4.2 Huffman table-specification syntax
 150   DCHECK(buffer);
 151   DCHECK(dc_table);
 152   DCHECK(ac_table);
 153   BigEndianReader reader(buffer, length);
 154   while (reader.remaining() > 0) {
 155     uint8_t table_class_and_id;
 156     READ_U8_OR_RETURN_FALSE(&table_class_and_id);
 157     int table_class = table_class_and_id / 16;
 158     int table_id = table_class_and_id % 16;
 159     if (!InRange(table_class, 0, 1)) {
 160       DVLOG(1) << "Invalid table class " << table_class;
 161       return false;
 162     }
 163     if (table_id >= 2) {
 164       DLOG(ERROR) << "Table id(" << table_id
 165                   << ") >= 2 is invalid for baseline profile";
 166       return false;
 167     }
 168
 169     JpegHuffmanTable* table;
 170     if (table_class == 1)
 171       table = &ac_table[table_id];
 172     else
 173       table = &dc_table[table_id];
 174
 175     size_t count = 0;
 176     if (!reader.ReadBytes(&table->code_length, sizeof(table->code_length)))
 177       return false;
 178     for (size_t i = 0; i < arraysize(table->code_length); i++)
 179       count += table->code_length[i];
 180
 181     if (!InRange(count, 0, sizeof(table->code_value))) {
 182       DVLOG(1) << "Invalid code count " << count;
 183       return false;
 184     }
 185     if (!reader.ReadBytes(&table->code_value, count))
 186       return false;
 187     table->valid = true;
 188   }
 189   return true;
 190 }
 191
 192 static bool ParseDRI(const char* buffer,
 193                      size_t length,
 194                      uint16_t* restart_interval) {
 195   // Spec B.2.4.4 Restart interval definition syntax
 196   DCHECK(buffer);
 197   DCHECK(restart_interval);
 198   BigEndianReader reader(buffer, length);
 199   return reader.ReadU16(restart_interval) && reader.remaining() == 0;
 200 }
 201
 202 // |scan| is already initialized to 0 in ParseJpegPicture.
 203 static bool ParseSOS(const char* buffer,
 204                      size_t length,
 205                      const JpegFrameHeader& frame_header,
 206                      JpegScanHeader* scan) {
 207   // Spec B.2.3 Scan header syntax
 208   DCHECK(buffer);
 209   DCHECK(scan);
 210   BigEndianReader reader(buffer, length);
 211   READ_U8_OR_RETURN_FALSE(&scan->num_components);
 212   if (scan->num_components != frame_header.num_components) {
 213     DLOG(ERROR) << "The number of scan components ("
 214                 << static_cast<int>(scan->num_components)
 215                 << ") mismatches the number of image components ("
 216                 << static_cast<int>(frame_header.num_components) << ")";
 217     return false;
 218   }
 219
 220   for (int i = 0; i < scan->num_components; i++) {
 221     JpegScanHeader::Component* component = &scan->components[i];
 222     READ_U8_OR_RETURN_FALSE(&component->component_selector);
 223     uint8_t dc_and_ac_selector;
 224     READ_U8_OR_RETURN_FALSE(&dc_and_ac_selector);
 225     component->dc_selector = dc_and_ac_selector / 16;
 226     component->ac_selector = dc_and_ac_selector % 16;
 227     if (component->component_selector != frame_header.components[i].id) {
 228       DLOG(ERROR) << "component selector mismatches image component id";
 229       return false;
 230     }
 231     if (component->dc_selector >= kJpegMaxHuffmanTableNumBaseline) {
 232       DLOG(ERROR) << "DC selector (" << static_cast<int>(component->dc_selector)
 233                   << ") should be 0 or 1 for baseline mode";
 234       return false;
 235     }
 236     if (component->ac_selector >= kJpegMaxHuffmanTableNumBaseline) {
 237       DLOG(ERROR) << "AC selector (" << static_cast<int>(component->ac_selector)
 238                   << ") should be 0 or 1 for baseline mode";
 239       return false;
 240     }
 241   }
 242
 243   // Unused fields, only for value checking.
 244   uint8_t spectral_selection_start;
 245   uint8_t spectral_selection_end;
 246   uint8_t point_transform;
 247   READ_U8_OR_RETURN_FALSE(&spectral_selection_start);
 248   READ_U8_OR_RETURN_FALSE(&spectral_selection_end);
 249   READ_U8_OR_RETURN_FALSE(&point_transform);
 250   if (spectral_selection_start != 0 || spectral_selection_end != 63) {
 251     DLOG(ERROR) << "Spectral selection should be 0,63 for baseline mode";
 252     return false;
 253   }
 254   if (point_transform != 0) {
 255     DLOG(ERROR) << "Point transform should be 0 for baseline mode";
 256     return false;
 257   }
 258
 259   return true;
 260 }
 261
 262 // |result| is already initialized to 0 in ParseJpegPicture.
 263 static bool ParseSOI(const char* buffer,
 264                      size_t length,
 265                      JpegParseResult* result) {
 266   // Spec B.2.1 High-level syntax
 267   DCHECK(buffer);
 268   DCHECK(result);
 269   BigEndianReader reader(buffer, length);
 270   uint8_t marker1;
 271   uint8_t marker2;
 272   bool has_marker_dqt = false;
 273   bool has_marker_sos = false;
 274
 275   // Once reached SOS, all neccesary data are parsed.
 276   while (!has_marker_sos) {
 277     READ_U8_OR_RETURN_FALSE(&marker1);
 278     if (marker1 != MARKER1)
 279       return false;
 280
 281     do {
 282       READ_U8_OR_RETURN_FALSE(&marker2);
 283     } while (marker2 == MARKER1);  // skip fill bytes
 284
 285     uint16_t size;
 286     READ_U16_OR_RETURN_FALSE(&size);
 287     if (reader.remaining() < size) {
 288       DLOG(ERROR) << "Ill-formed JPEG. Remaining size (" << reader.remaining()
 289                   << ") is smaller than header specified (" << size << ")";
 290       return false;
 291     }
 292
 293     // The size includes the size field itself.
 294     if (size < sizeof(size)) {
 295       DLOG(ERROR) << "Ill-formed JPEG. Segment size (" << size
 296                   << ") is smaller than size field (" << sizeof(size) << ")";
 297       return false;
 298     }
 299     size -= sizeof(size);
 300
 301     switch (marker2) {
 302       case SOF0:
 303         if (!ParseSOF(reader.ptr(), size, &result->frame_header)) {
 304           DLOG(ERROR) << "ParseSOF failed";
 305           return false;
 306         }
 307         break;
 308       case DQT:
 309         if (!ParseDQT(reader.ptr(), size, result->q_table)) {
 310           DLOG(ERROR) << "ParseDQT failed";
 311           return false;
 312         }
 313         has_marker_dqt = true;
 314         break;
 315       case DHT:
 316         if (!ParseDHT(reader.ptr(), size, result->dc_table, result->ac_table)) {
 317           DLOG(ERROR) << "ParseDHT failed";
 318           return false;
 319         }
 320         break;
 321       case DRI:
 322         if (!ParseDRI(reader.ptr(), size, &result->restart_interval)) {
 323           DLOG(ERROR) << "ParseDRI failed";
 324           return false;
 325         }
 326         break;
 327       case SOS:
 328         if (!ParseSOS(reader.ptr(), size, result->frame_header,
 329                       &result->scan)) {
 330           DLOG(ERROR) << "ParseSOS failed";
 331           return false;
 332         }
 333         has_marker_sos = true;
 334         break;
 335       default:
 336         DVLOG(4) << "unknown marker " << static_cast<int>(marker2);
 337         break;
 338     }
 339     reader.Skip(size);
 340   }
 341
 342   if (!has_marker_dqt) {
 343     DLOG(ERROR) << "No DQT marker found";
 344     return false;
 345   }
 346
 347   // Scan data follows scan header immediately.
 348   result->data = reader.ptr();
 349   result->data_size = reader.remaining();
 350
 351   return true;
 352 }
 353
 354 bool ParseJpegPicture(const uint8_t* buffer,
 355                       size_t length,
 356                       JpegParseResult* result) {
 357   DCHECK(buffer);
 358   DCHECK(result);
 359   BigEndianReader reader(reinterpret_cast<const char*>(buffer), length);
 360   memset(result, 0, sizeof(JpegParseResult));
 361
 362   uint8_t marker1, marker2;
 363   READ_U8_OR_RETURN_FALSE(&marker1);
 364   READ_U8_OR_RETURN_FALSE(&marker2);
 365   if (marker1 != MARKER1 || marker2 != SOI) {
 366     DLOG(ERROR) << "Not a JPEG";
 367     return false;
 368   }
 369
 370   return ParseSOI(reader.ptr(), reader.remaining(), result);
 371 }
 372
 373 }  // namespace media