771 lines
25 KiB
Rust
771 lines
25 KiB
Rust
//! Safe, bounded access to the system `OpenJPEG` codec.
|
|
//!
|
|
//! All foreign calls and callback pointer handling are contained here. The
|
|
//! build requires `OpenJPEG` 2.5.4 or newer, excluding releases affected by
|
|
//! CVE-2025-54874 and earlier fixed decoder defects.
|
|
|
|
#![allow(unsafe_code)]
|
|
|
|
use std::ffi::{CStr, c_void};
|
|
use std::marker::PhantomData;
|
|
use std::mem::MaybeUninit;
|
|
use std::ptr::NonNull;
|
|
|
|
const MAX_PIXELS: usize = 4096 * 4096;
|
|
|
|
#[allow(
|
|
dead_code,
|
|
non_camel_case_types,
|
|
non_snake_case,
|
|
non_upper_case_globals,
|
|
rustdoc::bare_urls,
|
|
rustdoc::broken_intra_doc_links
|
|
)]
|
|
mod ffi;
|
|
|
|
/// Codec/container selection.
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
|
|
pub enum Format {
|
|
J2k,
|
|
Jp2,
|
|
}
|
|
|
|
/// `OpenJPEG` rate-control selection.
|
|
#[derive(Clone, Copy, Debug, PartialEq)]
|
|
pub enum Compression {
|
|
Lossless,
|
|
Lossy { compression_ratio: f32 },
|
|
}
|
|
|
|
/// Decoder controls passed directly to `OpenJPEG`.
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
|
|
pub struct DecodeOptions {
|
|
pub discard_levels: u32,
|
|
pub quality_layers: u32,
|
|
pub strict: bool,
|
|
pub max_pixels: usize,
|
|
}
|
|
|
|
/// One decoded component with original integer precision.
|
|
#[derive(Clone, Debug, Eq, PartialEq)]
|
|
pub struct Component {
|
|
pub width: u32,
|
|
pub height: u32,
|
|
pub precision: u8,
|
|
pub signed: bool,
|
|
pub alpha: bool,
|
|
pub samples: Vec<i32>,
|
|
}
|
|
|
|
/// Decoded `OpenJPEG` image.
|
|
#[derive(Clone, Debug, Eq, PartialEq)]
|
|
pub struct Image {
|
|
pub width: u32,
|
|
pub height: u32,
|
|
pub components: Vec<Component>,
|
|
}
|
|
|
|
/// Input image component for encoding.
|
|
#[derive(Clone, Copy, Debug)]
|
|
pub struct ComponentRef<'a> {
|
|
pub precision: u8,
|
|
pub signed: bool,
|
|
pub alpha: bool,
|
|
pub samples: &'a [i32],
|
|
}
|
|
|
|
/// Stable error categories; `OpenJPEG` diagnostics never cross the safe API.
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
|
|
pub enum Error {
|
|
InvalidInput,
|
|
LimitExceeded,
|
|
Allocation,
|
|
Codec,
|
|
}
|
|
|
|
/// Decodes J2K or JP2 after validating header dimensions and components and
|
|
/// before allowing `OpenJPEG` to allocate decoded sample planes.
|
|
///
|
|
/// # Errors
|
|
///
|
|
/// Returns a stable validation, limit, allocation, or codec error without
|
|
/// exposing native handles or diagnostics.
|
|
pub fn decode(bytes: &[u8], format: Format, options: DecodeOptions) -> Result<Image, Error> {
|
|
ensure_supported_version()?;
|
|
if bytes.is_empty() || options.max_pixels == 0 {
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
validate_encoded_header(bytes, format, options.max_pixels)?;
|
|
let stream = InputStream::new(bytes)?;
|
|
let codec = Codec::decoder(format)?;
|
|
let mut parameters = MaybeUninit::<ffi::opj_dparameters_t>::zeroed();
|
|
unsafe { ffi::opj_set_default_decoder_parameters(parameters.as_mut_ptr()) };
|
|
let mut parameters = unsafe { parameters.assume_init() };
|
|
parameters.cp_reduce = options.discard_levels;
|
|
parameters.cp_layer = options.quality_layers;
|
|
if unsafe { ffi::opj_setup_decoder(codec.raw.as_ptr(), &raw mut parameters) } != 1
|
|
|| unsafe {
|
|
ffi::opj_decoder_set_strict_mode(codec.raw.as_ptr(), i32::from(options.strict))
|
|
} != 1
|
|
{
|
|
return Err(Error::Codec);
|
|
}
|
|
|
|
// Initializing this pointer is security-significant: OpenJPEG <=2.5.3 had
|
|
// an out-of-bounds write on short JP2 input when it was uninitialized.
|
|
let mut raw_image = std::ptr::null_mut();
|
|
if unsafe { ffi::opj_read_header(stream.raw.as_ptr(), codec.raw.as_ptr(), &raw mut raw_image) }
|
|
!= 1
|
|
{
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
let mut image = RawImage::new(raw_image)?;
|
|
validate_header(image.raw.as_ptr(), options.max_pixels)?;
|
|
if unsafe { ffi::opj_decode(codec.raw.as_ptr(), stream.raw.as_ptr(), image.raw.as_ptr()) } != 1
|
|
|| unsafe { ffi::opj_end_decompress(codec.raw.as_ptr(), stream.raw.as_ptr()) } != 1
|
|
{
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
image.copy(options.max_pixels)
|
|
}
|
|
|
|
/// Encodes one through five equal-sized component planes to memory.
|
|
///
|
|
/// # Errors
|
|
///
|
|
/// Returns a stable validation, limit, allocation, or codec error. Dimensions,
|
|
/// sample ranges, and output capacity are checked before native encoding.
|
|
pub fn encode(
|
|
width: u32,
|
|
height: u32,
|
|
components: &[ComponentRef<'_>],
|
|
format: Format,
|
|
compression: Compression,
|
|
max_encoded_bytes: usize,
|
|
) -> Result<Vec<u8>, Error> {
|
|
ensure_supported_version()?;
|
|
let pixels = checked_pixels(width, height, MAX_PIXELS)?;
|
|
if components.is_empty()
|
|
|| components.len() > 5
|
|
|| max_encoded_bytes == 0
|
|
|| components.iter().any(|component| {
|
|
!(1..=31).contains(&component.precision) || component.samples.len() != pixels
|
|
})
|
|
{
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
if let Compression::Lossy { compression_ratio } = compression {
|
|
if !compression_ratio.is_finite() || compression_ratio < 1.0 {
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
}
|
|
|
|
let image = RawImage::from_components(width, height, components)?;
|
|
let codec = Codec::encoder(format)?;
|
|
let stream = OutputStream::new(max_encoded_bytes)?;
|
|
let mut parameters = MaybeUninit::<ffi::opj_cparameters_t>::zeroed();
|
|
unsafe { ffi::opj_set_default_encoder_parameters(parameters.as_mut_ptr()) };
|
|
let mut parameters = unsafe { parameters.assume_init() };
|
|
parameters.tcp_numlayers = 1;
|
|
parameters.cp_disto_alloc = 1;
|
|
parameters.tcp_mct = (components.len() >= 3).into();
|
|
parameters.numresolution = maximum_resolution_levels(width, height);
|
|
parameters.max_cs_size = i32::try_from(max_encoded_bytes).unwrap_or(i32::MAX);
|
|
match compression {
|
|
Compression::Lossless => {
|
|
parameters.tcp_rates[0] = 0.0;
|
|
parameters.irreversible = 0;
|
|
}
|
|
Compression::Lossy { compression_ratio } => {
|
|
parameters.tcp_rates[0] = compression_ratio;
|
|
parameters.irreversible = 1;
|
|
}
|
|
}
|
|
if unsafe {
|
|
ffi::opj_setup_encoder(codec.raw.as_ptr(), &raw mut parameters, image.raw.as_ptr())
|
|
} != 1
|
|
|| unsafe {
|
|
ffi::opj_start_compress(codec.raw.as_ptr(), image.raw.as_ptr(), stream.raw.as_ptr())
|
|
} != 1
|
|
|| unsafe { ffi::opj_encode(codec.raw.as_ptr(), stream.raw.as_ptr()) } != 1
|
|
|| unsafe { ffi::opj_end_compress(codec.raw.as_ptr(), stream.raw.as_ptr()) } != 1
|
|
{
|
|
return Err(if stream.state.limit_exceeded {
|
|
Error::LimitExceeded
|
|
} else {
|
|
Error::Codec
|
|
});
|
|
}
|
|
stream.into_bytes()
|
|
}
|
|
|
|
struct Codec {
|
|
raw: NonNull<ffi::opj_codec_t>,
|
|
}
|
|
|
|
impl Codec {
|
|
fn decoder(format: Format) -> Result<Self, Error> {
|
|
let raw = unsafe { ffi::opj_create_decompress(codec_format(format)) };
|
|
NonNull::new(raw)
|
|
.map(|raw| Self { raw })
|
|
.ok_or(Error::Codec)
|
|
}
|
|
|
|
fn encoder(format: Format) -> Result<Self, Error> {
|
|
let raw = unsafe { ffi::opj_create_compress(codec_format(format)) };
|
|
NonNull::new(raw)
|
|
.map(|raw| Self { raw })
|
|
.ok_or(Error::Codec)
|
|
}
|
|
}
|
|
|
|
impl Drop for Codec {
|
|
fn drop(&mut self) {
|
|
unsafe { ffi::opj_destroy_codec(self.raw.as_ptr()) };
|
|
}
|
|
}
|
|
|
|
struct RawImage {
|
|
raw: NonNull<ffi::opj_image_t>,
|
|
}
|
|
|
|
impl RawImage {
|
|
fn new(raw: *mut ffi::opj_image_t) -> Result<Self, Error> {
|
|
NonNull::new(raw)
|
|
.map(|raw| Self { raw })
|
|
.ok_or(Error::Codec)
|
|
}
|
|
|
|
fn from_components(
|
|
width: u32,
|
|
height: u32,
|
|
components: &[ComponentRef<'_>],
|
|
) -> Result<Self, Error> {
|
|
let mut parameters: Vec<_> = components
|
|
.iter()
|
|
.map(|component| ffi::opj_image_cmptparm_t {
|
|
dx: 1,
|
|
dy: 1,
|
|
w: width,
|
|
h: height,
|
|
x0: 0,
|
|
y0: 0,
|
|
prec: u32::from(component.precision),
|
|
bpp: u32::from(component.precision),
|
|
sgnd: u32::from(component.signed),
|
|
})
|
|
.collect();
|
|
let color_space = if components.len() >= 3 {
|
|
ffi::OPJ_COLOR_SPACE::OPJ_CLRSPC_SRGB
|
|
} else {
|
|
ffi::OPJ_COLOR_SPACE::OPJ_CLRSPC_GRAY
|
|
};
|
|
let raw = unsafe {
|
|
ffi::opj_image_create(
|
|
u32::try_from(parameters.len()).map_err(|_| Error::InvalidInput)?,
|
|
parameters.as_mut_ptr(),
|
|
color_space,
|
|
)
|
|
};
|
|
let mut image = Self::new(raw)?;
|
|
unsafe {
|
|
let raw = image.raw.as_mut();
|
|
raw.x0 = 0;
|
|
raw.y0 = 0;
|
|
raw.x1 = width;
|
|
raw.y1 = height;
|
|
let output = std::slice::from_raw_parts_mut(raw.comps, raw.numcomps as usize);
|
|
for (output, input) in output.iter_mut().zip(components) {
|
|
if output.data.is_null() {
|
|
return Err(Error::Allocation);
|
|
}
|
|
output.alpha = u16::from(input.alpha);
|
|
let destination = std::slice::from_raw_parts_mut(output.data, input.samples.len());
|
|
destination.copy_from_slice(input.samples);
|
|
}
|
|
}
|
|
Ok(image)
|
|
}
|
|
|
|
fn copy(&mut self, max_pixels: usize) -> Result<Image, Error> {
|
|
let raw = unsafe { self.raw.as_ref() };
|
|
let width = raw.x1.checked_sub(raw.x0).ok_or(Error::InvalidInput)?;
|
|
let height = raw.y1.checked_sub(raw.y0).ok_or(Error::InvalidInput)?;
|
|
checked_pixels(width, height, max_pixels)?;
|
|
let components = unsafe { std::slice::from_raw_parts(raw.comps, raw.numcomps as usize) };
|
|
if !(1..=5).contains(&components.len()) {
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
let first = components.first().ok_or(Error::InvalidInput)?;
|
|
let mut copied = Vec::new();
|
|
copied
|
|
.try_reserve_exact(components.len())
|
|
.map_err(|_| Error::Allocation)?;
|
|
for component in components {
|
|
if component.w != first.w
|
|
|| component.h != first.h
|
|
|| component.data.is_null()
|
|
|| !(1..=31).contains(&component.prec)
|
|
{
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
checked_pixels(component.w, component.h, max_pixels)?;
|
|
let length = checked_pixels(component.w, component.h, max_pixels)?;
|
|
let source = unsafe { std::slice::from_raw_parts(component.data, length) };
|
|
let mut samples = Vec::new();
|
|
samples
|
|
.try_reserve_exact(length)
|
|
.map_err(|_| Error::Allocation)?;
|
|
samples.extend_from_slice(source);
|
|
copied.push(Component {
|
|
width: component.w,
|
|
height: component.h,
|
|
precision: u8::try_from(component.prec).map_err(|_| Error::InvalidInput)?,
|
|
signed: component.sgnd != 0,
|
|
alpha: component.alpha != 0,
|
|
samples,
|
|
});
|
|
}
|
|
Ok(Image {
|
|
width: first.w,
|
|
height: first.h,
|
|
components: copied,
|
|
})
|
|
}
|
|
}
|
|
|
|
impl Drop for RawImage {
|
|
fn drop(&mut self) {
|
|
unsafe { ffi::opj_image_destroy(self.raw.as_ptr()) };
|
|
}
|
|
}
|
|
|
|
struct InputState<'a> {
|
|
bytes: &'a [u8],
|
|
position: usize,
|
|
}
|
|
|
|
struct InputStream<'a> {
|
|
raw: NonNull<ffi::opj_stream_t>,
|
|
state: Box<InputState<'a>>,
|
|
_lifetime: PhantomData<&'a [u8]>,
|
|
}
|
|
|
|
impl<'a> InputStream<'a> {
|
|
fn new(bytes: &'a [u8]) -> Result<Self, Error> {
|
|
let raw = unsafe { ffi::opj_stream_default_create(1) };
|
|
let raw = NonNull::new(raw).ok_or(Error::Allocation)?;
|
|
let mut state = Box::new(InputState { bytes, position: 0 });
|
|
unsafe {
|
|
ffi::opj_stream_set_read_function(raw.as_ptr(), Some(input_read));
|
|
ffi::opj_stream_set_skip_function(raw.as_ptr(), Some(input_skip));
|
|
ffi::opj_stream_set_seek_function(raw.as_ptr(), Some(input_seek));
|
|
ffi::opj_stream_set_user_data(
|
|
raw.as_ptr(),
|
|
std::ptr::from_mut(state.as_mut()).cast(),
|
|
None,
|
|
);
|
|
ffi::opj_stream_set_user_data_length(raw.as_ptr(), bytes.len() as u64);
|
|
}
|
|
Ok(Self {
|
|
raw,
|
|
state,
|
|
_lifetime: PhantomData,
|
|
})
|
|
}
|
|
}
|
|
|
|
impl Drop for InputStream<'_> {
|
|
fn drop(&mut self) {
|
|
unsafe { ffi::opj_stream_destroy(self.raw.as_ptr()) };
|
|
// Keep the callback state observably alive until after stream destroy.
|
|
let _ = &self.state;
|
|
}
|
|
}
|
|
|
|
struct OutputState {
|
|
bytes: Vec<u8>,
|
|
position: usize,
|
|
limit: usize,
|
|
limit_exceeded: bool,
|
|
}
|
|
|
|
struct OutputStream {
|
|
raw: NonNull<ffi::opj_stream_t>,
|
|
state: Box<OutputState>,
|
|
}
|
|
|
|
impl OutputStream {
|
|
fn new(limit: usize) -> Result<Self, Error> {
|
|
let raw = unsafe { ffi::opj_stream_default_create(0) };
|
|
let raw = NonNull::new(raw).ok_or(Error::Allocation)?;
|
|
let mut state = Box::new(OutputState {
|
|
bytes: Vec::new(),
|
|
position: 0,
|
|
limit,
|
|
limit_exceeded: false,
|
|
});
|
|
unsafe {
|
|
ffi::opj_stream_set_write_function(raw.as_ptr(), Some(output_write));
|
|
ffi::opj_stream_set_skip_function(raw.as_ptr(), Some(output_skip));
|
|
ffi::opj_stream_set_seek_function(raw.as_ptr(), Some(output_seek));
|
|
ffi::opj_stream_set_user_data(
|
|
raw.as_ptr(),
|
|
std::ptr::from_mut(state.as_mut()).cast(),
|
|
None,
|
|
);
|
|
}
|
|
Ok(Self { raw, state })
|
|
}
|
|
|
|
fn into_bytes(mut self) -> Result<Vec<u8>, Error> {
|
|
unsafe { ffi::opj_stream_destroy(self.raw.as_ptr()) };
|
|
self.raw = NonNull::dangling();
|
|
if self.state.limit_exceeded || self.state.bytes.is_empty() {
|
|
return Err(if self.state.limit_exceeded {
|
|
Error::LimitExceeded
|
|
} else {
|
|
Error::Codec
|
|
});
|
|
}
|
|
Ok(std::mem::take(&mut self.state.bytes))
|
|
}
|
|
}
|
|
|
|
impl Drop for OutputStream {
|
|
fn drop(&mut self) {
|
|
if self.raw != NonNull::dangling() {
|
|
unsafe { ffi::opj_stream_destroy(self.raw.as_ptr()) };
|
|
}
|
|
}
|
|
}
|
|
|
|
unsafe extern "C" fn input_read(
|
|
output: *mut c_void,
|
|
length: usize,
|
|
user_data: *mut c_void,
|
|
) -> usize {
|
|
if output.is_null() || user_data.is_null() || length == 0 {
|
|
return usize::MAX;
|
|
}
|
|
let state = unsafe { &mut *user_data.cast::<InputState<'_>>() };
|
|
let remaining = state.bytes.len().saturating_sub(state.position);
|
|
if remaining == 0 {
|
|
return usize::MAX;
|
|
}
|
|
let count = remaining.min(length);
|
|
unsafe {
|
|
std::ptr::copy_nonoverlapping(
|
|
state.bytes.as_ptr().add(state.position),
|
|
output.cast(),
|
|
count,
|
|
);
|
|
}
|
|
state.position += count;
|
|
count
|
|
}
|
|
|
|
unsafe extern "C" fn input_skip(offset: i64, user_data: *mut c_void) -> i64 {
|
|
if user_data.is_null() || offset < 0 {
|
|
return -1;
|
|
}
|
|
let state = unsafe { &mut *user_data.cast::<InputState<'_>>() };
|
|
let Ok(offset) = usize::try_from(offset) else {
|
|
return -1;
|
|
};
|
|
let Some(position) = state.position.checked_add(offset) else {
|
|
return -1;
|
|
};
|
|
if position > state.bytes.len() {
|
|
return -1;
|
|
}
|
|
state.position = position;
|
|
i64::try_from(offset).unwrap_or(-1)
|
|
}
|
|
|
|
unsafe extern "C" fn input_seek(position: i64, user_data: *mut c_void) -> i32 {
|
|
if user_data.is_null() || position < 0 {
|
|
return 0;
|
|
}
|
|
let state = unsafe { &mut *user_data.cast::<InputState<'_>>() };
|
|
let Ok(position) = usize::try_from(position) else {
|
|
return 0;
|
|
};
|
|
if position > state.bytes.len() {
|
|
return 0;
|
|
}
|
|
state.position = position;
|
|
1
|
|
}
|
|
|
|
unsafe extern "C" fn output_write(
|
|
input: *mut c_void,
|
|
length: usize,
|
|
user_data: *mut c_void,
|
|
) -> usize {
|
|
if input.is_null() || user_data.is_null() {
|
|
return usize::MAX;
|
|
}
|
|
let state = unsafe { &mut *user_data.cast::<OutputState>() };
|
|
let Some(end) = state.position.checked_add(length) else {
|
|
state.limit_exceeded = true;
|
|
return usize::MAX;
|
|
};
|
|
if end > state.limit {
|
|
state.limit_exceeded = true;
|
|
return usize::MAX;
|
|
}
|
|
if end > state.bytes.len() {
|
|
if state.bytes.try_reserve(end - state.bytes.len()).is_err() {
|
|
return usize::MAX;
|
|
}
|
|
state.bytes.resize(end, 0);
|
|
}
|
|
let source = unsafe { std::slice::from_raw_parts(input.cast::<u8>(), length) };
|
|
state.bytes[state.position..end].copy_from_slice(source);
|
|
state.position = end;
|
|
length
|
|
}
|
|
|
|
unsafe extern "C" fn output_skip(offset: i64, user_data: *mut c_void) -> i64 {
|
|
if user_data.is_null() {
|
|
return -1;
|
|
}
|
|
let state = unsafe { &mut *user_data.cast::<OutputState>() };
|
|
let Ok(offset_isize) = isize::try_from(offset) else {
|
|
return -1;
|
|
};
|
|
let Some(position) = state.position.checked_add_signed(offset_isize) else {
|
|
return -1;
|
|
};
|
|
if position > state.limit {
|
|
state.limit_exceeded = true;
|
|
return -1;
|
|
}
|
|
state.position = position;
|
|
offset
|
|
}
|
|
|
|
unsafe extern "C" fn output_seek(position: i64, user_data: *mut c_void) -> i32 {
|
|
if user_data.is_null() || position < 0 {
|
|
return 0;
|
|
}
|
|
let state = unsafe { &mut *user_data.cast::<OutputState>() };
|
|
let Ok(position) = usize::try_from(position) else {
|
|
return 0;
|
|
};
|
|
if position > state.limit {
|
|
state.limit_exceeded = true;
|
|
return 0;
|
|
}
|
|
state.position = position;
|
|
1
|
|
}
|
|
|
|
fn validate_header(raw: *mut ffi::opj_image_t, max_pixels: usize) -> Result<(), Error> {
|
|
let raw = unsafe { raw.as_ref() }.ok_or(Error::InvalidInput)?;
|
|
checked_pixels(
|
|
raw.x1.checked_sub(raw.x0).ok_or(Error::InvalidInput)?,
|
|
raw.y1.checked_sub(raw.y0).ok_or(Error::InvalidInput)?,
|
|
max_pixels,
|
|
)?;
|
|
let count = usize::try_from(raw.numcomps).map_err(|_| Error::InvalidInput)?;
|
|
if !(1..=5).contains(&count) || raw.comps.is_null() {
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
let components = unsafe { std::slice::from_raw_parts(raw.comps, count) };
|
|
for component in components {
|
|
checked_pixels(component.w, component.h, max_pixels)?;
|
|
if !(1..=31).contains(&component.prec) {
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
fn checked_pixels(width: u32, height: u32, maximum: usize) -> Result<usize, Error> {
|
|
if width == 0 || height == 0 {
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
usize::try_from(width)
|
|
.ok()
|
|
.and_then(|width| {
|
|
usize::try_from(height)
|
|
.ok()
|
|
.and_then(|height| width.checked_mul(height))
|
|
})
|
|
.filter(|pixels| *pixels <= maximum)
|
|
.ok_or(Error::LimitExceeded)
|
|
}
|
|
|
|
fn validate_encoded_header(bytes: &[u8], format: Format, max_pixels: usize) -> Result<(), Error> {
|
|
match format {
|
|
Format::J2k => validate_siz_marker(bytes, max_pixels),
|
|
Format::Jp2 => {
|
|
let mut position = 0_usize;
|
|
while bytes.len().saturating_sub(position) >= 8 {
|
|
let box_length = read_u32(bytes, position)?;
|
|
let box_type = bytes
|
|
.get(position + 4..position + 8)
|
|
.ok_or(Error::InvalidInput)?;
|
|
let (header_length, length) = if box_length == 1 {
|
|
let extended = usize::try_from(read_u64(bytes, position + 8)?)
|
|
.map_err(|_| Error::LimitExceeded)?;
|
|
(16_usize, extended)
|
|
} else if box_length == 0 {
|
|
(8_usize, bytes.len() - position)
|
|
} else {
|
|
(
|
|
8_usize,
|
|
usize::try_from(box_length).map_err(|_| Error::LimitExceeded)?,
|
|
)
|
|
};
|
|
if length < header_length {
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
let body = position
|
|
.checked_add(header_length)
|
|
.ok_or(Error::LimitExceeded)?;
|
|
let end = position.checked_add(length).ok_or(Error::LimitExceeded)?;
|
|
if end > bytes.len() {
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
if box_type == b"jp2c" {
|
|
return validate_siz_marker(&bytes[body..end], max_pixels);
|
|
}
|
|
position = end;
|
|
}
|
|
Err(Error::InvalidInput)
|
|
}
|
|
}
|
|
}
|
|
|
|
fn validate_siz_marker(codestream: &[u8], max_pixels: usize) -> Result<(), Error> {
|
|
if codestream.get(..4) != Some(&[0xff, 0x4f, 0xff, 0x51]) {
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
let length = usize::from(read_u16(codestream, 4)?);
|
|
let end = 4_usize.checked_add(length).ok_or(Error::LimitExceeded)?;
|
|
if length < 38 || end > codestream.len() {
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
let x1 = read_u32(codestream, 8)?;
|
|
let y1 = read_u32(codestream, 12)?;
|
|
let x0 = read_u32(codestream, 16)?;
|
|
let y0 = read_u32(codestream, 20)?;
|
|
if read_u32(codestream, 24)? == 0 || read_u32(codestream, 28)? == 0 {
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
let width = x1.checked_sub(x0).ok_or(Error::InvalidInput)?;
|
|
let height = y1.checked_sub(y0).ok_or(Error::InvalidInput)?;
|
|
checked_pixels(width, height, max_pixels)?;
|
|
|
|
let component_count = usize::from(read_u16(codestream, 40)?);
|
|
if !(1..=5).contains(&component_count)
|
|
|| length != 38 + component_count.checked_mul(3).ok_or(Error::LimitExceeded)?
|
|
{
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
for component in 0..component_count {
|
|
let offset = 42 + component * 3;
|
|
let precision = codestream.get(offset).copied().ok_or(Error::InvalidInput)? & 0x7f;
|
|
let dx = u32::from(
|
|
codestream
|
|
.get(offset + 1)
|
|
.copied()
|
|
.ok_or(Error::InvalidInput)?,
|
|
);
|
|
let dy = u32::from(
|
|
codestream
|
|
.get(offset + 2)
|
|
.copied()
|
|
.ok_or(Error::InvalidInput)?,
|
|
);
|
|
if precision >= 31 || dx == 0 || dy == 0 {
|
|
return Err(Error::InvalidInput);
|
|
}
|
|
let component_width = ceiling_div(x1, dx)?
|
|
.checked_sub(ceiling_div(x0, dx)?)
|
|
.ok_or(Error::InvalidInput)?;
|
|
let component_height = ceiling_div(y1, dy)?
|
|
.checked_sub(ceiling_div(y0, dy)?)
|
|
.ok_or(Error::InvalidInput)?;
|
|
checked_pixels(component_width, component_height, max_pixels)?;
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
fn ceiling_div(value: u32, divisor: u32) -> Result<u32, Error> {
|
|
value
|
|
.checked_add(divisor - 1)
|
|
.map(|value| value / divisor)
|
|
.ok_or(Error::LimitExceeded)
|
|
}
|
|
|
|
fn read_u16(bytes: &[u8], position: usize) -> Result<u16, Error> {
|
|
let bytes: [u8; 2] = bytes
|
|
.get(position..position.checked_add(2).ok_or(Error::LimitExceeded)?)
|
|
.ok_or(Error::InvalidInput)?
|
|
.try_into()
|
|
.map_err(|_| Error::InvalidInput)?;
|
|
Ok(u16::from_be_bytes(bytes))
|
|
}
|
|
|
|
fn read_u32(bytes: &[u8], position: usize) -> Result<u32, Error> {
|
|
let bytes: [u8; 4] = bytes
|
|
.get(position..position.checked_add(4).ok_or(Error::LimitExceeded)?)
|
|
.ok_or(Error::InvalidInput)?
|
|
.try_into()
|
|
.map_err(|_| Error::InvalidInput)?;
|
|
Ok(u32::from_be_bytes(bytes))
|
|
}
|
|
|
|
fn read_u64(bytes: &[u8], position: usize) -> Result<u64, Error> {
|
|
let bytes: [u8; 8] = bytes
|
|
.get(position..position.checked_add(8).ok_or(Error::LimitExceeded)?)
|
|
.ok_or(Error::InvalidInput)?
|
|
.try_into()
|
|
.map_err(|_| Error::InvalidInput)?;
|
|
Ok(u64::from_be_bytes(bytes))
|
|
}
|
|
|
|
fn maximum_resolution_levels(width: u32, height: u32) -> i32 {
|
|
let minimum = width.min(height);
|
|
let levels = u32::BITS - minimum.leading_zeros();
|
|
i32::try_from(levels.min(6)).unwrap_or(1).max(1)
|
|
}
|
|
|
|
const fn codec_format(format: Format) -> ffi::OPJ_CODEC_FORMAT {
|
|
match format {
|
|
Format::J2k => ffi::OPJ_CODEC_FORMAT::OPJ_CODEC_J2K,
|
|
Format::Jp2 => ffi::OPJ_CODEC_FORMAT::OPJ_CODEC_JP2,
|
|
}
|
|
}
|
|
|
|
fn ensure_supported_version() -> Result<(), Error> {
|
|
let raw = unsafe { ffi::opj_version() };
|
|
if raw.is_null() {
|
|
return Err(Error::Codec);
|
|
}
|
|
let version = unsafe { CStr::from_ptr(raw) }
|
|
.to_str()
|
|
.map_err(|_| Error::Codec)?;
|
|
let mut components = version.split('.').map(|component| {
|
|
component
|
|
.bytes()
|
|
.take_while(u8::is_ascii_digit)
|
|
.try_fold(0_u32, |value, digit| {
|
|
value.checked_mul(10)?.checked_add(u32::from(digit - b'0'))
|
|
})
|
|
});
|
|
let parsed = (
|
|
components.next().flatten().ok_or(Error::Codec)?,
|
|
components.next().flatten().ok_or(Error::Codec)?,
|
|
components.next().flatten().ok_or(Error::Codec)?,
|
|
);
|
|
if parsed < (2, 5, 4) {
|
|
return Err(Error::Codec);
|
|
}
|
|
Ok(())
|
|
}
|