fuzz testing
[imager.git] / bmp.c
CommitLineData
261f91c5 1#include <stdarg.h>
92bda632 2#include "imageri.h"
261f91c5 3
705fd961
TC
4/*
5=head1 NAME
261f91c5 6
705fd961
TC
7bmp.c - read and write windows BMP files
8
9=head1 SYNOPSIS
10
11 i_img *im;
12 io_glue *ig;
13
14 if (!i_writebmp_wiol(im, ig)) {
15 ... error ...
16 }
17 im = i_readbmp(ig);
18
19=head1 DESCRIPTION
20
21Reads and writes Windows BMP files.
22
23=over
24
25=cut
26*/
27
28#define FILEHEAD_SIZE 14
29#define INFOHEAD_SIZE 40
30#define BI_RGB 0
31#define BI_RLE8 1
32#define BI_RLE4 2
33#define BI_BITFIELDS 3
34#define BMPRLE_ENDOFLINE 0
35#define BMPRLE_ENDOFBMP 1
36#define BMPRLE_DELTA 2
37
38static int read_packed(io_glue *ig, char *format, ...);
39static int write_packed(io_glue *ig, char *format, ...);
40static int write_bmphead(io_glue *ig, i_img *im, int bit_count,
41 int data_size);
42static int write_1bit_data(io_glue *ig, i_img *im);
43static int write_4bit_data(io_glue *ig, i_img *im);
44static int write_8bit_data(io_glue *ig, i_img *im);
45static int write_24bit_data(io_glue *ig, i_img *im);
46static int read_bmp_pal(io_glue *ig, i_img *im, int count);
662e3c02 47static i_img *read_1bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
d87dc9a4 48 int compression, long offbits, int allow_incomplete);
705fd961 49static i_img *read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
d87dc9a4 50 int compression, long offbits, int allow_incomplete);
705fd961 51static i_img *read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
d87dc9a4 52 int compression, long offbits, int allow_incomplete);
705fd961 53static i_img *read_direct_bmp(io_glue *ig, int xsize, int ysize,
403946c6 54 int bit_count, int clr_used, int compression,
d87dc9a4 55 long offbits, int allow_incomplete);
705fd961
TC
56
57/*
58=item i_writebmp_wiol(im, io_glue)
59
60Writes the image as a BMP file. Uses 1-bit, 4-bit, 8-bit or 24-bit
61formats depending on the image.
62
63Never compresses the image.
64
65=cut
66*/
67int
68i_writebmp_wiol(i_img *im, io_glue *ig) {
69 io_glue_commit_types(ig);
70 i_clear_error();
71
72 /* pick a format */
73 if (im->type == i_direct_type) {
74 return write_24bit_data(ig, im);
75 }
76 else {
77 int pal_size;
78
79 /* must be paletted */
80 pal_size = i_colorcount(im);
81 if (pal_size <= 2) {
82 return write_1bit_data(ig, im);
83 }
84 else if (pal_size <= 16) {
85 return write_4bit_data(ig, im);
86 }
87 else {
88 return write_8bit_data(ig, im);
89 }
90 }
91}
92
93/*
94=item i_readbmp_wiol(ig)
95
96Reads a Windows format bitmap from the given file.
97
98Handles BI_RLE4 and BI_RLE8 compressed images. Attempts to handle
99BI_BITFIELDS images too, but I need a test image.
100
101=cut
102*/
103
104i_img *
d87dc9a4 105i_readbmp_wiol(io_glue *ig, int allow_incomplete) {
662e3c02 106 int b_magic, m_magic, filesize, res1, res2, infohead_size;
705fd961
TC
107 int xsize, ysize, planes, bit_count, compression, size_image, xres, yres;
108 int clr_used, clr_important, offbits;
109 i_img *im;
662e3c02
TC
110
111 mm_log((1, "i_readbmp_wiol(ig %p)\n", ig));
705fd961
TC
112
113 io_glue_commit_types(ig);
114 i_clear_error();
115
116 if (!read_packed(ig, "CCVvvVVVVvvVVVVVV", &b_magic, &m_magic, &filesize,
662e3c02 117 &res1, &res2, &offbits, &infohead_size,
705fd961
TC
118 &xsize, &ysize, &planes,
119 &bit_count, &compression, &size_image, &xres, &yres,
120 &clr_used, &clr_important)) {
d87dc9a4 121 i_push_error(0, "file too short to be a BMP file");
705fd961
TC
122 return 0;
123 }
124 if (b_magic != 'B' || m_magic != 'M' || infohead_size != INFOHEAD_SIZE
125 || planes != 1) {
126 i_push_error(0, "not a BMP file");
127 return 0;
128 }
662e3c02
TC
129
130 mm_log((1, " bmp header: filesize %d offbits %d xsize %d ysize %d planes %d "
131 "bit_count %d compression %d size %d xres %d yres %d clr_used %d "
132 "clr_important %d\n", filesize, offbits, xsize, ysize, planes,
133 bit_count, compression, size_image, xres, yres, clr_used,
134 clr_important));
77157728 135
ae12796a 136 if (!i_int_check_image_file_limits(xsize, abs(ysize), 3, sizeof(i_sample_t))) {
77157728
TC
137 mm_log((1, "i_readbmp_wiol: image size exceeds limits\n"));
138 return NULL;
139 }
705fd961
TC
140
141 switch (bit_count) {
142 case 1:
9c106321 143 im = read_1bit_bmp(ig, xsize, ysize, clr_used, compression, offbits,
d87dc9a4 144 allow_incomplete);
705fd961
TC
145 break;
146
147 case 4:
9c106321 148 im = read_4bit_bmp(ig, xsize, ysize, clr_used, compression, offbits,
d87dc9a4 149 allow_incomplete);
705fd961
TC
150 break;
151
152 case 8:
9c106321 153 im = read_8bit_bmp(ig, xsize, ysize, clr_used, compression, offbits,
d87dc9a4 154 allow_incomplete);
705fd961
TC
155 break;
156
157 case 32:
158 case 24:
159 case 16:
403946c6 160 im = read_direct_bmp(ig, xsize, ysize, bit_count, clr_used, compression,
d87dc9a4 161 offbits, allow_incomplete);
705fd961 162 break;
efdc2568
TC
163
164 default:
165 i_push_errorf(0, "unknown bit count for BMP file (%d)", bit_count);
166 return NULL;
705fd961
TC
167 }
168
662e3c02
TC
169 if (im) {
170 /* store the resolution */
171 if (xres && !yres)
172 yres = xres;
173 else if (yres && !xres)
174 xres = yres;
175 if (xres) {
2e41e30b
TC
176 i_tags_set_float2(&im->tags, "i_xres", 0, xres * 0.0254, 4);
177 i_tags_set_float2(&im->tags, "i_yres", 0, yres * 0.0254, 4);
662e3c02
TC
178 }
179 i_tags_addn(&im->tags, "bmp_compression", 0, compression);
180 i_tags_addn(&im->tags, "bmp_important_colors", 0, clr_important);
181 i_tags_addn(&im->tags, "bmp_used_colors", 0, clr_used);
182 i_tags_addn(&im->tags, "bmp_filesize", 0, filesize);
183 i_tags_addn(&im->tags, "bmp_bit_count", 0, bit_count);
184 i_tags_add(&im->tags, "i_format", 0, "bmp", 3, 0);
705fd961 185 }
705fd961
TC
186
187 return im;
188}
189
190/*
191=back
192
193=head1 IMPLEMENTATION FUNCTIONS
194
195Internal functions used in the implementation.
196
197=over
198
199=item read_packed(ig, format, ...)
200
201Reads from the specified "file" the specified sizes. The format codes
202match those used by perl's pack() function, though only a few are
203implemented. In all cases the vararg arguement is an int *.
204
205Returns non-zero if all of the arguments were read.
206
207=cut
261f91c5
TC
208*/
209static
210int read_packed(io_glue *ig, char *format, ...) {
211 unsigned char buf[4];
212 va_list ap;
213 int *p;
214
215 va_start(ap, format);
216
217 while (*format) {
218 p = va_arg(ap, int *);
219
220 switch (*format) {
221 case 'v':
662e3c02 222 if (ig->readcb(ig, buf, 2) != 2)
261f91c5
TC
223 return 0;
224 *p = buf[0] + (buf[1] << 8);
225 break;
226
227 case 'V':
662e3c02 228 if (ig->readcb(ig, buf, 4) != 4)
261f91c5
TC
229 return 0;
230 *p = buf[0] + (buf[1] << 8) + (buf[2] << 16) + (buf[3] << 24);
231 break;
232
233 case 'C':
662e3c02 234 if (ig->readcb(ig, buf, 1) != 1)
261f91c5
TC
235 return 0;
236 *p = buf[0];
237 break;
238
239 case 'c':
662e3c02 240 if (ig->readcb(ig, buf, 1) != 1)
261f91c5
TC
241 return 0;
242 *p = (char)buf[0];
243 break;
244
705fd961 245 case '3': /* extension - 24-bit number */
662e3c02 246 if (ig->readcb(ig, buf, 3) != 3)
705fd961
TC
247 return 0;
248 *p = buf[0] + (buf[1] << 8) + (buf[2] << 16);
249 break;
250
261f91c5 251 default:
b1e96952 252 i_fatal(1, "Unknown read_packed format code 0x%02x", *format);
261f91c5
TC
253 }
254 ++format;
255 }
256 return 1;
257}
258
705fd961
TC
259/*
260=item write_packed(ig, format, ...)
261
262Writes packed data to the specified io_glue.
263
264Returns non-zero on success.
265
266=cut
267*/
268
261f91c5
TC
269static int
270write_packed(io_glue *ig, char *format, ...) {
271 unsigned char buf[4];
272 va_list ap;
273 int i;
274
275 va_start(ap, format);
276
277 while (*format) {
278 i = va_arg(ap, unsigned int);
279
280 switch (*format) {
281 case 'v':
282 buf[0] = i & 255;
283 buf[1] = i / 256;
284 if (ig->writecb(ig, buf, 2) == -1)
285 return 0;
286 break;
287
288 case 'V':
289 buf[0] = i & 0xFF;
290 buf[1] = (i >> 8) & 0xFF;
291 buf[2] = (i >> 16) & 0xFF;
292 buf[3] = (i >> 24) & 0xFF;
293 if (ig->writecb(ig, buf, 4) == -1)
294 return 0;
295 break;
296
297 case 'C':
298 case 'c':
299 buf[0] = i & 0xFF;
300 if (ig->writecb(ig, buf, 1) == -1)
301 return 0;
302 break;
303
304 default:
b1e96952 305 i_fatal(1, "Unknown write_packed format code 0x%02x", *format);
261f91c5
TC
306 }
307 ++format;
308 }
309 va_end(ap);
310
311 return 1;
312}
313
705fd961
TC
314/*
315=item write_bmphead(ig, im, bit_count, data_size)
316
317Writes a Windows BMP header to the file.
318
319Returns non-zero on success.
320
321=cut
322*/
261f91c5
TC
323
324static
325int write_bmphead(io_glue *ig, i_img *im, int bit_count, int data_size) {
326 double xres, yres;
327 int got_xres, got_yres, aspect_only;
328 int colors_used = 0;
329 int offset = FILEHEAD_SIZE + INFOHEAD_SIZE;
330
331 got_xres = i_tags_get_float(&im->tags, "i_xres", 0, &xres);
332 got_yres = i_tags_get_float(&im->tags, "i_yres", 0, &yres);
333 if (!i_tags_get_int(&im->tags, "i_aspect_only", 0,&aspect_only))
334 aspect_only = 0;
335 if (!got_xres) {
336 if (!got_yres)
337 xres = yres = 72;
338 else
339 xres = yres;
340 }
341 else {
342 if (!got_yres)
343 yres = xres;
344 }
345 if (xres <= 0 || yres <= 0)
346 xres = yres = 72;
347 if (aspect_only) {
348 /* scale so the smaller value is 72 */
349 double ratio;
350 if (xres < yres) {
351 ratio = 72.0 / xres;
352 }
353 else {
354 ratio = 72.0 / yres;
355 }
356 xres *= ratio;
357 yres *= ratio;
358 }
359 /* now to pels/meter */
360 xres *= 100.0/2.54;
361 yres *= 100.0/2.54;
362
363 if (im->type == i_palette_type) {
364 colors_used = i_colorcount(im);
365 offset += 4 * colors_used;
366 }
367
368 if (!write_packed(ig, "CCVvvVVVVvvVVVVVV", 'B', 'M', data_size+offset,
369 0, 0, offset, INFOHEAD_SIZE, im->xsize, im->ysize, 1,
705fd961
TC
370 bit_count, BI_RGB, 0, (int)(xres+0.5), (int)(yres+0.5),
371 colors_used, colors_used)){
261f91c5
TC
372 i_push_error(0, "cannot write bmp header");
373 return 0;
374 }
375 if (im->type == i_palette_type) {
376 int i;
377 i_color c;
378
379 for (i = 0; i < colors_used; ++i) {
380 i_getcolors(im, i, &c, 1);
381 if (im->channels >= 3) {
382 if (!write_packed(ig, "CCCC", c.channel[2], c.channel[1],
383 c.channel[0], 0)) {
384 i_push_error(0, "cannot write palette entry");
385 return 0;
386 }
387 }
388 else {
389 if (!write_packed(ig, "CCCC", c.channel[0], c.channel[0],
390 c.channel[0], 0)) {
391 i_push_error(0, "cannot write palette entry");
392 return 0;
393 }
394 }
395 }
396 }
397
398 return 1;
399}
400
705fd961
TC
401/*
402=item write_1bit_data(ig, im)
403
404Writes the image data as a 1-bit/pixel image.
405
406Returns non-zero on success.
407
408=cut
409*/
261f91c5
TC
410static int
411write_1bit_data(io_glue *ig, i_img *im) {
412 i_palidx *line;
413 unsigned char *packed;
414 int byte;
415 int mask;
416 unsigned char *out;
417 int line_size = (im->xsize+7) / 8;
418 int x, y;
f0960b14 419 int unpacked_size;
261f91c5
TC
420
421 /* round up to nearest multiple of four */
422 line_size = (line_size + 3) / 4 * 4;
423
424 if (!write_bmphead(ig, im, 1, line_size * im->ysize))
425 return 0;
426
f0960b14
TC
427 /* this shouldn't be an issue, but let's be careful */
428 unpacked_size = im->xsize + 8;
429 if (unpacked_size < im->xsize) {
430 i_push_error(0, "integer overflow during memory allocation");
431 return 0;
432 }
433 line = mymalloc(unpacked_size); /* checked 29jun05 tonyc */
261f91c5 434 memset(line + im->xsize, 0, 8);
f0960b14
TC
435
436 /* size allocated here is always much smaller than xsize, hence
437 can't overflow int */
438 packed = mymalloc(line_size); /* checked 29jun05 tonyc */
261f91c5
TC
439 memset(packed, 0, line_size);
440
441 for (y = im->ysize-1; y >= 0; --y) {
442 i_gpal(im, 0, im->xsize, y, line);
443 mask = 0x80;
444 byte = 0;
445 out = packed;
446 for (x = 0; x < im->xsize; ++x) {
447 if (line[x])
448 byte |= mask;
449 if ((mask >>= 1) == 0) {
450 *out++ = byte;
451 byte = 0;
452 mask = 0x80;
453 }
454 }
455 if (mask != 0x80) {
456 *out++ = byte;
457 }
458 if (ig->writecb(ig, packed, line_size) < 0) {
459 myfree(packed);
460 myfree(line);
461 i_push_error(0, "writing 1 bit/pixel packed data");
462 return 0;
463 }
464 }
465 myfree(packed);
466 myfree(line);
467
10461f9a
TC
468 ig->closecb(ig);
469
261f91c5
TC
470 return 1;
471}
472
705fd961
TC
473/*
474=item write_4bit_data(ig, im)
475
476Writes the image data as a 4-bit/pixel image.
477
478Returns non-zero on success.
479
480=cut
481*/
261f91c5
TC
482static int
483write_4bit_data(io_glue *ig, i_img *im) {
484 i_palidx *line;
485 unsigned char *packed;
486 unsigned char *out;
487 int line_size = (im->xsize+1) / 2;
488 int x, y;
f0960b14 489 int unpacked_size;
261f91c5
TC
490
491 /* round up to nearest multiple of four */
492 line_size = (line_size + 3) / 4 * 4;
493
494 if (!write_bmphead(ig, im, 4, line_size * im->ysize))
495 return 0;
496
f0960b14
TC
497 /* this shouldn't be an issue, but let's be careful */
498 unpacked_size = im->xsize + 2;
499 if (unpacked_size < im->xsize) {
500 i_push_error(0, "integer overflow during memory allocation");
501 return 0;
502 }
503 line = mymalloc(unpacked_size); /* checked 29jun05 tonyc */
261f91c5
TC
504 memset(line + im->xsize, 0, 2);
505
f0960b14
TC
506 /* size allocated here is always much smaller than xsize, hence
507 can't overflow int */
508 packed = mymalloc(line_size); /* checked 29jun05 tonyc */
261f91c5
TC
509 memset(packed, 0, line_size);
510
511 for (y = im->ysize-1; y >= 0; --y) {
512 i_gpal(im, 0, im->xsize, y, line);
513 out = packed;
514 for (x = 0; x < im->xsize; x += 2) {
515 *out++ = (line[x] << 4) + line[x+1];
516 }
517 if (ig->writecb(ig, packed, line_size) < 0) {
518 myfree(packed);
519 myfree(line);
520 i_push_error(0, "writing 4 bit/pixel packed data");
521 return 0;
522 }
523 }
524 myfree(packed);
525 myfree(line);
526
10461f9a
TC
527 ig->closecb(ig);
528
261f91c5
TC
529 return 1;
530}
531
705fd961
TC
532/*
533=item write_8bit_data(ig, im)
534
535Writes the image data as a 8-bit/pixel image.
536
537Returns non-zero on success.
538
539=cut
540*/
261f91c5
TC
541static int
542write_8bit_data(io_glue *ig, i_img *im) {
543 i_palidx *line;
544 int line_size = im->xsize;
a659442a 545 int y;
f0960b14 546 int unpacked_size;
261f91c5
TC
547
548 /* round up to nearest multiple of four */
549 line_size = (line_size + 3) / 4 * 4;
550
551 if (!write_bmphead(ig, im, 8, line_size * im->ysize))
552 return 0;
553
f0960b14
TC
554 /* this shouldn't be an issue, but let's be careful */
555 unpacked_size = im->xsize + 4;
556 if (unpacked_size < im->xsize) {
557 i_push_error(0, "integer overflow during memory allocation");
558 return 0;
559 }
560 line = mymalloc(unpacked_size); /* checked 29jun05 tonyc */
261f91c5
TC
561 memset(line + im->xsize, 0, 4);
562
563 for (y = im->ysize-1; y >= 0; --y) {
564 i_gpal(im, 0, im->xsize, y, line);
565 if (ig->writecb(ig, line, line_size) < 0) {
566 myfree(line);
567 i_push_error(0, "writing 8 bit/pixel packed data");
568 return 0;
569 }
570 }
571 myfree(line);
572
10461f9a
TC
573 ig->closecb(ig);
574
261f91c5
TC
575 return 1;
576}
577
578static int bgr_chans[] = { 2, 1, 0, };
579static int grey_chans[] = { 0, 0, 0, };
580
705fd961
TC
581/*
582=item write_24bit_data(ig, im)
583
584Writes the image data as a 24-bit/pixel image.
585
586Returns non-zero on success.
587
588=cut
589*/
261f91c5
TC
590static int
591write_24bit_data(io_glue *ig, i_img *im) {
592 int *chans;
593 unsigned char *samples;
a659442a 594 int y;
261f91c5 595 int line_size = 3 * im->xsize;
f0960b14
TC
596
597 /* just in case we implement a direct format with 2bytes/pixel
598 (unlikely though) */
599 if (line_size / 3 != im->xsize) {
600 i_push_error(0, "integer overflow during memory allocation");
601 return 0;
602 }
261f91c5
TC
603
604 line_size = (line_size + 3) / 4 * 4;
605
606 if (!write_bmphead(ig, im, 24, line_size * im->ysize))
607 return 0;
608 chans = im->channels >= 3 ? bgr_chans : grey_chans;
f0960b14 609 samples = mymalloc(line_size); /* checked 29jun05 tonyc */
10461f9a 610 memset(samples, 0, line_size);
261f91c5
TC
611 for (y = im->ysize-1; y >= 0; --y) {
612 i_gsamp(im, 0, im->xsize, y, samples, chans, 3);
613 if (ig->writecb(ig, samples, line_size) < 0) {
614 i_push_error(0, "writing image data");
615 myfree(samples);
616 return 0;
617 }
618 }
619 myfree(samples);
620
10461f9a
TC
621 ig->closecb(ig);
622
261f91c5
TC
623 return 1;
624}
625
705fd961
TC
626/*
627=item read_bmp_pal(ig, im, count)
261f91c5 628
705fd961 629Reads count palette entries from the file and add them to the image.
261f91c5 630
705fd961 631Returns non-zero on success.
261f91c5 632
705fd961
TC
633=cut
634*/
261f91c5
TC
635static int
636read_bmp_pal(io_glue *ig, i_img *im, int count) {
637 int i;
638 int r, g, b, x;
639 i_color c;
640
641 for (i = 0; i < count; ++i) {
642 if (!read_packed(ig, "CCCC", &b, &g, &r, &x)) {
643 i_push_error(0, "reading BMP palette");
644 return 0;
645 }
646 c.channel[0] = r;
647 c.channel[1] = g;
648 c.channel[2] = b;
662e3c02
TC
649 if (i_addcolors(im, &c, 1) < 0) {
650 i_push_error(0, "out of space in image palette");
261f91c5 651 return 0;
662e3c02 652 }
261f91c5
TC
653 }
654
655 return 1;
656}
657
705fd961 658/*
403946c6 659=item read_1bit_bmp(ig, xsize, ysize, clr_used, compression, offbits)
705fd961
TC
660
661Reads in the palette and image data for a 1-bit/pixel image.
662
663Returns the image or NULL.
664
665=cut
666*/
261f91c5 667static i_img *
662e3c02 668read_1bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
d87dc9a4 669 int compression, long offbits, int allow_incomplete) {
261f91c5 670 i_img *im;
9c106321 671 int x, y, lasty, yinc, start_y;
261f91c5
TC
672 i_palidx *line, *p;
673 unsigned char *packed;
674 int line_size = (xsize + 7)/8;
a659442a 675 int bit;
261f91c5 676 unsigned char *in;
403946c6 677 long base_offset;
261f91c5 678
662e3c02
TC
679 if (compression != BI_RGB) {
680 i_push_errorf(0, "unknown 1-bit BMP compression (%d)", compression);
681 return NULL;
682 }
683
f0960b14
TC
684 if (xsize + 8 < xsize) { /* if there was overflow */
685 /* we check with 8 because we allocate that much for the decoded
686 line buffer */
687 i_push_error(0, "integer overflow during memory allocation");
688 return NULL;
689 }
690
691 /* if xsize+7 is ok then (xsize+7)/8 will be and the minor
692 adjustments below won't make it overflow */
261f91c5
TC
693 line_size = (line_size+3) / 4 * 4;
694
695 if (ysize > 0) {
9c106321 696 start_y = ysize-1;
261f91c5
TC
697 lasty = -1;
698 yinc = -1;
699 }
700 else {
701 /* when ysize is -ve it's a top-down image */
702 ysize = -ysize;
9c106321 703 start_y = 0;
261f91c5
TC
704 lasty = ysize;
705 yinc = 1;
706 }
9c106321 707 y = start_y;
705fd961
TC
708 if (!clr_used)
709 clr_used = 2;
662e3c02
TC
710 if (clr_used < 0 || clr_used > 2) {
711 i_push_errorf(0, "out of range colors used (%d)", clr_used);
712 return NULL;
713 }
403946c6
TC
714
715 base_offset = FILEHEAD_SIZE + INFOHEAD_SIZE + clr_used * 4;
716 if (offbits < base_offset) {
717 i_push_errorf(0, "image data offset too small (%ld)", offbits);
718 return NULL;
719 }
720
662e3c02
TC
721 im = i_img_pal_new(xsize, ysize, 3, 256);
722 if (!im)
723 return NULL;
261f91c5
TC
724 if (!read_bmp_pal(ig, im, clr_used)) {
725 i_img_destroy(im);
726 return NULL;
727 }
403946c6
TC
728
729 if (offbits > base_offset) {
730 /* this will be slow if the offset is large, but that should be
731 rare */
732 char buffer;
733 while (base_offset < offbits) {
734 if (ig->readcb(ig, &buffer, 1) != 1) {
735 i_img_destroy(im);
736 i_push_error(0, "failed skipping to image data offset");
737 return NULL;
738 }
739 ++base_offset;
740 }
741 }
662e3c02
TC
742
743 i_tags_add(&im->tags, "bmp_compression_name", 0, "BI_RGB", -1, 0);
261f91c5 744
f0960b14
TC
745 packed = mymalloc(line_size); /* checked 29jun05 tonyc */
746 line = mymalloc(xsize+8); /* checked 29jun05 tonyc */
261f91c5
TC
747 while (y != lasty) {
748 if (ig->readcb(ig, packed, line_size) != line_size) {
749 myfree(packed);
750 myfree(line);
d87dc9a4 751 if (allow_incomplete) {
9c106321
TC
752 i_tags_setn(&im->tags, "i_incomplete", 1);
753 i_tags_setn(&im->tags, "i_lines_read", abs(start_y - y));
754 return im;
755 }
756 else {
757 i_push_error(0, "failed reading 1-bit bmp data");
758 i_img_destroy(im);
759 return NULL;
760 }
261f91c5
TC
761 }
762 in = packed;
763 bit = 0x80;
764 p = line;
765 for (x = 0; x < xsize; ++x) {
766 *p++ = (*in & bit) ? 1 : 0;
767 bit >>= 1;
768 if (!bit) {
769 ++in;
770 bit = 0x80;
771 }
772 }
773 i_ppal(im, 0, xsize, y, line);
774 y += yinc;
775 }
776
4b0f812c
AMH
777 myfree(packed);
778 myfree(line);
261f91c5
TC
779 return im;
780}
261f91c5 781
705fd961
TC
782/*
783=item read_4bit_bmp(ig, xsize, ysize, clr_used, compression)
784
785Reads in the palette and image data for a 4-bit/pixel image.
786
787Returns the image or NULL.
788
789Hopefully this will be combined with the following function at some
790point.
791
792=cut
793*/
261f91c5 794static i_img *
705fd961 795read_4bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
d87dc9a4 796 int compression, long offbits, int allow_incomplete) {
261f91c5
TC
797 i_img *im;
798 int x, y, lasty, yinc;
799 i_palidx *line, *p;
800 unsigned char *packed;
801 int line_size = (xsize + 1)/2;
802 unsigned char *in;
705fd961 803 int size, i;
403946c6 804 long base_offset;
9c106321 805 int starty;
261f91c5 806
f0960b14
TC
807 /* line_size is going to be smaller than xsize in most cases (and
808 when it's not, xsize is itself small), and hence not overflow */
261f91c5
TC
809 line_size = (line_size+3) / 4 * 4;
810
811 if (ysize > 0) {
9c106321 812 starty = ysize-1;
261f91c5
TC
813 lasty = -1;
814 yinc = -1;
815 }
816 else {
817 /* when ysize is -ve it's a top-down image */
818 ysize = -ysize;
9c106321 819 starty = 0;
261f91c5
TC
820 lasty = ysize;
821 yinc = 1;
822 }
9c106321 823 y = starty;
705fd961
TC
824 if (!clr_used)
825 clr_used = 16;
662e3c02
TC
826
827 if (clr_used > 16 || clr_used < 0) {
828 i_push_errorf(0, "out of range colors used (%d)", clr_used);
829 return NULL;
830 }
831
403946c6
TC
832 base_offset = FILEHEAD_SIZE + INFOHEAD_SIZE + clr_used * 4;
833 if (offbits < base_offset) {
834 i_push_errorf(0, "image data offset too small (%ld)", offbits);
835 return NULL;
836 }
837
662e3c02
TC
838 im = i_img_pal_new(xsize, ysize, 3, 256);
839 if (!im) /* error should have been pushed already */
840 return NULL;
261f91c5
TC
841 if (!read_bmp_pal(ig, im, clr_used)) {
842 i_img_destroy(im);
843 return NULL;
844 }
845
403946c6
TC
846 if (offbits > base_offset) {
847 /* this will be slow if the offset is large, but that should be
848 rare */
849 char buffer;
850 while (base_offset < offbits) {
851 if (ig->readcb(ig, &buffer, 1) != 1) {
852 i_img_destroy(im);
853 i_push_error(0, "failed skipping to image data offset");
854 return NULL;
855 }
856 ++base_offset;
857 }
858 }
859
705fd961 860 if (line_size < 260)
f0960b14 861 packed = mymalloc(260); /* checked 29jun05 tonyc */
705fd961 862 else
f0960b14
TC
863 packed = mymalloc(line_size); /* checked 29jun05 tonyc */
864 /* xsize won't approach MAXINT */
865 line = mymalloc(xsize+1); /* checked 29jun05 tonyc */
261f91c5 866 if (compression == BI_RGB) {
662e3c02 867 i_tags_add(&im->tags, "bmp_compression_name", 0, "BI_RGB", -1, 0);
261f91c5
TC
868 while (y != lasty) {
869 if (ig->readcb(ig, packed, line_size) != line_size) {
870 myfree(packed);
871 myfree(line);
d87dc9a4 872 if (allow_incomplete) {
9c106321
TC
873 i_tags_setn(&im->tags, "i_incomplete", 1);
874 i_tags_setn(&im->tags, "i_lines_read", abs(y - starty));
875 return im;
876 }
877 else {
878 i_push_error(0, "failed reading 4-bit bmp data");
879 i_img_destroy(im);
880 return NULL;
881 }
261f91c5
TC
882 }
883 in = packed;
884 p = line;
885 for (x = 0; x < xsize; x+=2) {
886 *p++ = *in >> 4;
887 *p++ = *in & 0x0F;
888 ++in;
889 }
890 i_ppal(im, 0, xsize, y, line);
891 y += yinc;
892 }
4b0f812c
AMH
893 myfree(packed);
894 myfree(line);
261f91c5
TC
895 }
896 else if (compression == BI_RLE4) {
705fd961 897 int read_size;
705fd961
TC
898 int count;
899
662e3c02 900 i_tags_add(&im->tags, "bmp_compression_name", 0, "BI_RLE4", -1, 0);
705fd961
TC
901 x = 0;
902 while (1) {
903 /* there's always at least 2 bytes in a sequence */
904 if (ig->readcb(ig, packed, 2) != 2) {
905 myfree(packed);
906 myfree(line);
d87dc9a4 907 if (allow_incomplete) {
9c106321
TC
908 i_tags_setn(&im->tags, "i_incomplete", 1);
909 i_tags_setn(&im->tags, "i_lines_read", abs(y - starty));
910 return im;
911 }
912 else {
913 i_push_error(0, "missing data during decompression");
914 i_img_destroy(im);
915 return NULL;
916 }
705fd961
TC
917 }
918 else if (packed[0]) {
bb5712de
TC
919 if (x + packed[0] > xsize) {
920 /* this file is corrupt */
921 myfree(line);
922 i_push_error(0, "invalid data during decompression");
923 i_img_destroy(im);
924 return NULL;
925 }
705fd961
TC
926 line[0] = packed[1] >> 4;
927 line[1] = packed[1] & 0x0F;
928 for (i = 0; i < packed[0]; i += 2) {
929 if (i < packed[0]-1)
930 i_ppal(im, x, x+2, y, line);
931 else
932 i_ppal(im, x, x+(packed[0]-i), y, line);
933 x += 2;
934 }
935 } else {
936 switch (packed[1]) {
937 case BMPRLE_ENDOFLINE:
938 x = 0;
939 y += yinc;
940 break;
941
942 case BMPRLE_ENDOFBMP:
4dfa5522
AMH
943 myfree(packed);
944 myfree(line);
705fd961
TC
945 return im;
946
947 case BMPRLE_DELTA:
948 if (ig->readcb(ig, packed, 2) != 2) {
949 myfree(packed);
950 myfree(line);
d87dc9a4 951 if (allow_incomplete) {
9c106321
TC
952 i_tags_setn(&im->tags, "i_incomplete", 1);
953 i_tags_setn(&im->tags, "i_lines_read", abs(y - starty));
954 return im;
955 }
956 else {
957 i_push_error(0, "missing data during decompression");
958 i_img_destroy(im);
959 return NULL;
960 }
705fd961
TC
961 }
962 x += packed[0];
963 y += yinc * packed[1];
964 break;
965
966 default:
967 count = packed[1];
bb5712de
TC
968 if (x + count > xsize) {
969 /* this file is corrupt */
970 myfree(line);
971 i_push_error(0, "invalid data during decompression");
972 i_img_destroy(im);
973 return NULL;
974 }
705fd961
TC
975 size = (count + 1) / 2;
976 read_size = (size+1) / 2 * 2;
977 if (ig->readcb(ig, packed, read_size) != read_size) {
978 myfree(packed);
979 myfree(line);
d87dc9a4 980 if (allow_incomplete) {
9c106321
TC
981 i_tags_setn(&im->tags, "i_incomplete", 1);
982 i_tags_setn(&im->tags, "i_lines_read", abs(y - starty));
983 return im;
984 }
985 else {
986 i_push_error(0, "missing data during decompression");
987 i_img_destroy(im);
988 return NULL;
989 }
705fd961
TC
990 }
991 for (i = 0; i < size; ++i) {
992 line[0] = packed[i] >> 4;
993 line[1] = packed[i] & 0xF;
994 i_ppal(im, x, x+2, y, line);
995 x += 2;
996 }
997 break;
998 }
999 }
1000 }
1001 }
1002 else { /*if (compression == BI_RLE4) {*/
1003 myfree(packed);
1004 myfree(line);
662e3c02 1005 i_push_errorf(0, "unknown 4-bit BMP compression (%d)", compression);
705fd961
TC
1006 i_img_destroy(im);
1007 return NULL;
261f91c5
TC
1008 }
1009
1010 return im;
1011}
1012
705fd961 1013/*
d87dc9a4 1014=item read_8bit_bmp(ig, xsize, ysize, clr_used, compression, allow_incomplete)
261f91c5 1015
705fd961
TC
1016Reads in the palette and image data for a 8-bit/pixel image.
1017
1018Returns the image or NULL.
1019
1020=cut
1021*/
1022static i_img *
1023read_8bit_bmp(io_glue *ig, int xsize, int ysize, int clr_used,
d87dc9a4 1024 int compression, long offbits, int allow_incomplete) {
261f91c5 1025 i_img *im;
9c106321 1026 int x, y, lasty, yinc, start_y;
a659442a 1027 i_palidx *line;
705fd961 1028 int line_size = xsize;
403946c6 1029 long base_offset;
261f91c5 1030
705fd961 1031 line_size = (line_size+3) / 4 * 4;
f0960b14
TC
1032 if (line_size < xsize) { /* if it overflowed (unlikely, but check) */
1033 i_push_error(0, "integer overflow during memory allocation");
1034 return NULL;
1035 }
705fd961
TC
1036
1037 if (ysize > 0) {
9c106321 1038 start_y = ysize-1;
705fd961
TC
1039 lasty = -1;
1040 yinc = -1;
261f91c5 1041 }
705fd961
TC
1042 else {
1043 /* when ysize is -ve it's a top-down image */
1044 ysize = -ysize;
9c106321 1045 start_y = 0;
705fd961
TC
1046 lasty = ysize;
1047 yinc = 1;
261f91c5 1048 }
9c106321 1049 y = start_y;
705fd961
TC
1050 if (!clr_used)
1051 clr_used = 256;
662e3c02
TC
1052 if (clr_used > 256 || clr_used < 0) {
1053 i_push_errorf(0, "out of range colors used (%d)", clr_used);
1054 return NULL;
1055 }
1056
403946c6
TC
1057 base_offset = FILEHEAD_SIZE + INFOHEAD_SIZE + clr_used * 4;
1058 if (offbits < base_offset) {
1059 i_push_errorf(0, "image data offset too small (%ld)", offbits);
1060 return NULL;
1061 }
1062
662e3c02
TC
1063 im = i_img_pal_new(xsize, ysize, 3, 256);
1064 if (!im)
1065 return NULL;
705fd961
TC
1066 if (!read_bmp_pal(ig, im, clr_used)) {
1067 i_img_destroy(im);
1068 return NULL;
1069 }
1070
403946c6
TC
1071 if (offbits > base_offset) {
1072 /* this will be slow if the offset is large, but that should be
1073 rare */
1074 char buffer;
1075 while (base_offset < offbits) {
1076 if (ig->readcb(ig, &buffer, 1) != 1) {
1077 i_img_destroy(im);
1078 i_push_error(0, "failed skipping to image data offset");
1079 return NULL;
1080 }
1081 ++base_offset;
1082 }
1083 }
1084
f0960b14 1085 line = mymalloc(line_size); /* checked 29jun05 tonyc */
705fd961 1086 if (compression == BI_RGB) {
662e3c02 1087 i_tags_add(&im->tags, "bmp_compression_name", 0, "BI_RGB", -1, 0);
705fd961
TC
1088 while (y != lasty) {
1089 if (ig->readcb(ig, line, line_size) != line_size) {
1090 myfree(line);
d87dc9a4 1091 if (allow_incomplete) {
9c106321
TC
1092 i_tags_setn(&im->tags, "i_incomplete", 1);
1093 i_tags_setn(&im->tags, "i_lines_read", abs(start_y - y));
1094 return im;
1095 }
1096 else {
1097 i_push_error(0, "failed reading 8-bit bmp data");
1098 i_img_destroy(im);
1099 return NULL;
1100 }
705fd961
TC
1101 }
1102 i_ppal(im, 0, xsize, y, line);
1103 y += yinc;
1104 }
12d25826 1105 myfree(line);
705fd961
TC
1106 }
1107 else if (compression == BI_RLE8) {
1108 int read_size;
705fd961
TC
1109 int count;
1110 unsigned char packed[2];
1111
662e3c02 1112 i_tags_add(&im->tags, "bmp_compression_name", 0, "BI_RLE8", -1, 0);
705fd961
TC
1113 x = 0;
1114 while (1) {
1115 /* there's always at least 2 bytes in a sequence */
1116 if (ig->readcb(ig, packed, 2) != 2) {
1117 myfree(line);
d87dc9a4 1118 if (allow_incomplete) {
9c106321
TC
1119 i_tags_setn(&im->tags, "i_incomplete", 1);
1120 i_tags_setn(&im->tags, "i_lines_read", abs(start_y-y));
1121 return im;
1122 }
1123 else {
1124 i_push_error(0, "missing data during decompression");
1125 i_img_destroy(im);
1126 return NULL;
1127 }
705fd961
TC
1128 }
1129 if (packed[0]) {
bb5712de
TC
1130 if (x + packed[0] > xsize) {
1131 /* this file isn't incomplete, it's corrupt */
1132 myfree(line);
1133 i_push_error(0, "invalid data during decompression");
1134 i_img_destroy(im);
1135 return NULL;
1136 }
705fd961
TC
1137 memset(line, packed[1], packed[0]);
1138 i_ppal(im, x, x+packed[0], y, line);
1139 x += packed[0];
1140 } else {
1141 switch (packed[1]) {
1142 case BMPRLE_ENDOFLINE:
1143 x = 0;
1144 y += yinc;
1145 break;
1146
1147 case BMPRLE_ENDOFBMP:
4dfa5522 1148 myfree(line);
705fd961
TC
1149 return im;
1150
1151 case BMPRLE_DELTA:
1152 if (ig->readcb(ig, packed, 2) != 2) {
1153 myfree(line);
d87dc9a4 1154 if (allow_incomplete) {
9c106321
TC
1155 i_tags_setn(&im->tags, "i_incomplete", 1);
1156 i_tags_setn(&im->tags, "i_lines_read", abs(start_y-y));
1157 return im;
1158 }
1159 else {
1160 i_push_error(0, "missing data during decompression");
1161 i_img_destroy(im);
1162 return NULL;
1163 }
705fd961
TC
1164 }
1165 x += packed[0];
1166 y += yinc * packed[1];
1167 break;
1168
1169 default:
1170 count = packed[1];
bb5712de
TC
1171 if (x + count > xsize) {
1172 /* runs shouldn't cross a line boundary */
1173 /* this file isn't incomplete, it's corrupt */
1174 myfree(line);
1175 i_push_error(0, "invalid data during decompression");
1176 i_img_destroy(im);
1177 return NULL;
1178 }
705fd961
TC
1179 read_size = (count+1) / 2 * 2;
1180 if (ig->readcb(ig, line, read_size) != read_size) {
1181 myfree(line);
d87dc9a4 1182 if (allow_incomplete) {
9c106321
TC
1183 i_tags_setn(&im->tags, "i_incomplete", 1);
1184 i_tags_setn(&im->tags, "i_lines_read", abs(start_y-y));
1185 return im;
1186 }
1187 else {
1188 i_push_error(0, "missing data during decompression");
1189 i_img_destroy(im);
1190 return NULL;
1191 }
705fd961
TC
1192 }
1193 i_ppal(im, x, x+count, y, line);
1194 x += count;
1195 break;
1196 }
1197 }
1198 }
1199 }
1200 else {
1201 myfree(line);
662e3c02 1202 i_push_errorf(0, "unknown 8-bit BMP compression (%d)", compression);
705fd961
TC
1203 i_img_destroy(im);
1204 return NULL;
1205 }
1206
1207 return im;
1208}
1209
1210struct bm_masks {
1211 unsigned masks[3];
1212 int shifts[3];
1213};
1214static struct bm_masks std_masks[] =
1215{
1216 { /* 16-bit */
1217 { 0770000, 00007700, 00000077, },
1218 { 10, 4, -2, },
1219 },
1220 { /* 24-bit */
1221 { 0xFF0000, 0x00FF00, 0x0000FF, },
1222 { 16, 8, 0, },
1223 },
1224 { /* 32-bit */
1225 { 0xFF0000, 0x00FF00, 0x0000FF, },
1226 { 16, 8, 0, },
1227 },
1228};
1229
1230/*
d87dc9a4 1231=item read_direct_bmp(ig, xsize, ysize, bit_count, clr_used, compression, allow_incomplete)
705fd961
TC
1232
1233Skips the palette and reads in the image data for a direct colour image.
1234
1235Returns the image or NULL.
1236
1237=cut
1238*/
1239static i_img *
1240read_direct_bmp(io_glue *ig, int xsize, int ysize, int bit_count,
9c106321 1241 int clr_used, int compression, long offbits,
d87dc9a4 1242 int allow_incomplete) {
705fd961 1243 i_img *im;
bea6bcd7 1244 int x, y, starty, lasty, yinc;
705fd961 1245 i_color *line, *p;
705fd961
TC
1246 int pix_size = bit_count / 8;
1247 int line_size = xsize * pix_size;
1248 struct bm_masks masks;
1249 char unpack_code[2] = "";
1250 int i;
1251 int extras;
1252 char junk[4];
662e3c02
TC
1253 const char *compression_name;
1254 int bytes;
403946c6 1255 long base_offset = FILEHEAD_SIZE + INFOHEAD_SIZE;
261f91c5 1256
705fd961
TC
1257 unpack_code[0] = *("v3V"+pix_size-2);
1258 unpack_code[1] = '\0';
261f91c5 1259
705fd961
TC
1260 line_size = (line_size+3) / 4 * 4;
1261 extras = line_size - xsize * pix_size;
261f91c5 1262
705fd961 1263 if (ysize > 0) {
bea6bcd7 1264 starty = ysize-1;
705fd961
TC
1265 lasty = -1;
1266 yinc = -1;
1267 }
1268 else {
1269 /* when ysize is -ve it's a top-down image */
1270 ysize = -ysize;
bea6bcd7 1271 starty = 0;
705fd961
TC
1272 lasty = ysize;
1273 yinc = 1;
1274 }
bea6bcd7 1275 y = starty;
705fd961 1276 if (compression == BI_RGB) {
662e3c02 1277 compression_name = "BI_RGB";
705fd961
TC
1278 masks = std_masks[pix_size-2];
1279
1280 /* there's a potential "palette" after the header */
1281 for (i = 0; i < clr_used; ++clr_used) {
1282 char buf[4];
1283 if (ig->readcb(ig, buf, 4) != 4) {
1284 i_push_error(0, "skipping colors");
1285 return 0;
1286 }
403946c6 1287 base_offset += 4;
705fd961
TC
1288 }
1289 }
1290 else if (compression == BI_BITFIELDS) {
1291 int pos, bit;
662e3c02
TC
1292 compression_name = "BI_BITFIELDS";
1293
705fd961
TC
1294 for (i = 0; i < 3; ++i) {
1295 if (!read_packed(ig, "V", masks.masks+i)) {
1296 i_push_error(0, "reading pixel masks");
1297 return 0;
1298 }
1299 /* work out a shift for the mask */
1300 pos = 0;
1301 bit = masks.masks[i] & -masks.masks[i];
1302 while (bit) {
1303 ++pos;
1304 bit >>= 1;
1305 }
1306 masks.shifts[i] = pos - 8;
1307 }
403946c6 1308 base_offset += 4 * 4;
705fd961 1309 }
662e3c02
TC
1310 else {
1311 i_push_errorf(0, "unknown 24-bit BMP compression (%d)", compression);
1312 return NULL;
1313 }
261f91c5 1314
ae12796a
TC
1315 if (offbits < base_offset) {
1316 i_push_errorf(0, "image data offset too small (%ld)", offbits);
1317 return NULL;
1318 }
1319
403946c6
TC
1320 if (offbits > base_offset) {
1321 /* this will be slow if the offset is large, but that should be
1322 rare */
1323 char buffer;
1324 while (base_offset < offbits) {
1325 if (ig->readcb(ig, &buffer, 1) != 1) {
403946c6
TC
1326 i_push_error(0, "failed skipping to image data offset");
1327 return NULL;
1328 }
1329 ++base_offset;
1330 }
1331 }
1332
705fd961 1333 im = i_img_empty(NULL, xsize, ysize);
662e3c02
TC
1334 if (!im)
1335 return NULL;
705fd961 1336
662e3c02
TC
1337 i_tags_add(&im->tags, "bmp_compression_name", 0, compression_name, -1, 0);
1338
1339 /* I wasn't able to make this overflow in testing, but better to be
1340 safe */
1341 bytes = sizeof(i_color) * xsize;
1342 if (bytes / sizeof(i_color) != xsize) {
1343 i_img_destroy(im);
1344 i_push_error(0, "integer overflow calculating buffer size");
1345 return NULL;
1346 }
f0960b14 1347 line = mymalloc(bytes); /* checked 29jun05 tonyc */
705fd961
TC
1348 while (y != lasty) {
1349 p = line;
1350 for (x = 0; x < xsize; ++x) {
1351 unsigned pixel;
1352 if (!read_packed(ig, unpack_code, &pixel)) {
705fd961 1353 myfree(line);
d87dc9a4 1354 if (allow_incomplete) {
9c106321 1355 i_tags_setn(&im->tags, "i_incomplete", 1);
bea6bcd7 1356 i_tags_setn(&im->tags, "i_lines_read", abs(starty - y));
9c106321
TC
1357 return im;
1358 }
1359 else {
1360 i_push_error(0, "failed reading image data");
1361 i_img_destroy(im);
1362 return NULL;
1363 }
705fd961
TC
1364 }
1365 for (i = 0; i < 3; ++i) {
1366 if (masks.shifts[i] > 0)
1367 p->channel[i] = (pixel & masks.masks[i]) >> masks.shifts[i];
1368 else
1369 p->channel[i] = (pixel & masks.masks[i]) << -masks.shifts[i];
1370 }
1371 ++p;
1372 }
1373 i_plin(im, 0, xsize, y, line);
1374 if (extras)
1375 ig->readcb(ig, junk, extras);
1376 y += yinc;
261f91c5 1377 }
705fd961
TC
1378 myfree(line);
1379
1380 return im;
261f91c5 1381}
705fd961
TC
1382
1383/*
1384=head1 SEE ALSO
1385
1386Imager(3)
1387
1388=head1 AUTHOR
1389
1390Tony Cook <tony@develop-help.com>
1391
1392=head1 RESTRICTIONS
1393
1394Cannot save as compressed BMP.
1395
1396=head1 BUGS
1397
1398Doesn't handle OS/2 bitmaps.
1399
140016-bit/pixel images haven't been tested. (I need an image).
1401
1402BI_BITFIELDS compression hasn't been tested (I need an image).
1403
403946c6
TC
1404The header handling for paletted images needs to be refactored
1405
705fd961
TC
1406=cut
1407*/