kenmirrors/freeswitch
1
0
Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2025-03-05 18:13:27 +00:00
Code Issues Projects Releases Wiki Activity

A few little tidyups and the eliminate of a potential crash if the T.85

Browse Source 
decoder encounters certain kinds of messed up T.85 images.
This commit is contained in:
Steve Underwood 2013-09-01 23:37:21 +08:00
parent 8b8b91beeb
commit cfe6fccec9
4 changed files with 32 additions and 8 deletions

6
libs/spandsp/src/t30.c

@ -2967,7 +2967,7 @@ static int process_rx_pps(t30_state_t *s, const uint8_t *msg, int len)
span_log(&s->logging, SPAN_LOG_FLOW, "Partial page OK - committing block %d, %d frames\n", s->ecm_block, s->ecm_frames); span_log(&s->logging, SPAN_LOG_FLOW, "Partial page OK - committing block %d, %d frames\n", s->ecm_block, s->ecm_frames);
for (i = 0; i < s->ecm_frames; i++) for (i = 0; i < s->ecm_frames; i++)
{ {
if (t4_rx_put(&s->t4.rx, s->ecm_data[i], s->ecm_len[i])) if (t4_rx_put(&s->t4.rx, s->ecm_data[i], s->ecm_len[i]) != T4_DECODE_MORE_DATA)
{ {
/* This is the end of the document */ /* This is the end of the document */
break; break;
@ -5831,7 +5831,7 @@ SPAN_DECLARE_NONSTD(void) t30_non_ecm_put_bit(void *user_data, int bit)
break; break;
case T30_STATE_F_DOC_NON_ECM: case T30_STATE_F_DOC_NON_ECM:
/* Document transfer */ /* Document transfer */
if (t4_rx_put_bit(&s->t4.rx, bit) == T4_DECODE_OK) if (t4_rx_put_bit(&s->t4.rx, bit) != T4_DECODE_MORE_DATA)
{ {
/* That is the end of the document */ /* That is the end of the document */
set_state(s, T30_STATE_F_POST_DOC_NON_ECM); set_state(s, T30_STATE_F_POST_DOC_NON_ECM);
@ -5871,7 +5871,7 @@ SPAN_DECLARE(void) t30_non_ecm_put(void *user_data, const uint8_t buf[], int len
break; break;
case T30_STATE_F_DOC_NON_ECM: case T30_STATE_F_DOC_NON_ECM:
/* Document transfer */ /* Document transfer */
if (t4_rx_put(&s->t4.rx, buf, len)) if (t4_rx_put(&s->t4.rx, buf, len) != T4_DECODE_MORE_DATA)
{ {
/* That is the end of the document */ /* That is the end of the document */
set_state(s, T30_STATE_F_POST_DOC_NON_ECM); set_state(s, T30_STATE_F_POST_DOC_NON_ECM);

2
libs/spandsp/src/t4_rx.c

@ -90,8 +90,10 @@ typedef struct
} packer_t; } packer_t;
#if defined(SPANDSP_SUPPORT_TIFF_FX) #if defined(SPANDSP_SUPPORT_TIFF_FX)
#if TIFFLIB_VERSION >= 20120615
extern TIFFFieldArray tiff_fx_field_array; extern TIFFFieldArray tiff_fx_field_array;
#endif #endif
#endif
SPAN_DECLARE(const char *) t4_compression_to_str(int compression) SPAN_DECLARE(const char *) t4_compression_to_str(int compression)
{ {

2
libs/spandsp/src/t4_tx.c

@ -164,7 +164,7 @@ static const TIFFFieldInfo tiff_fx_tiff_field_info[] =
{TIFFTAG_IMAGELAYER, 2, 2, TIFF_LONG, FIELD_CUSTOM, false, false, (char *) "ImageLayer"}, {TIFFTAG_IMAGELAYER, 2, 2, TIFF_LONG, FIELD_CUSTOM, false, false, (char *) "ImageLayer"},
}; };
#if 1 #if TIFFLIB_VERSION >= 20120615
static TIFFField tiff_fx_tiff_fields[] = static TIFFField tiff_fx_tiff_fields[] =
{ {
{ TIFFTAG_INDEXED, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 1, 0, (char *) "Indexed" }, { TIFFTAG_INDEXED, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 1, 0, (char *) "Indexed" },

30
libs/spandsp/src/t85_decode.c

@ -299,12 +299,14 @@ static int check_bih(t85_decode_state_t *s)
#endif #endif
{ {
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Fixed bytes do not contain expected values.\n"); span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Fixed bytes do not contain expected values.\n");
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
} }
/* P - Number of bit planes */ /* P - Number of bit planes */
if (s->buffer[2] < s->min_bit_planes || s->buffer[2] > s->max_bit_planes) if (s->buffer[2] < s->min_bit_planes || s->buffer[2] > s->max_bit_planes)
{ {
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. %d bit planes. Should be %d to %d.\n", s->buffer[2], s->min_bit_planes, s->max_bit_planes); span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. %d bit planes. Should be %d to %d.\n", s->buffer[2], s->min_bit_planes, s->max_bit_planes);
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
} }
s->bit_planes = s->buffer[2]; s->bit_planes = s->buffer[2];
@ -315,6 +317,7 @@ static int check_bih(t85_decode_state_t *s)
if (s->xd == 0 || (s->max_xd && s->xd > s->max_xd)) if (s->xd == 0 || (s->max_xd && s->xd > s->max_xd))
{ {
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Width is %" PRIu32 "\n", s->xd); span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Width is %" PRIu32 "\n", s->xd);
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
} }
/* YD - Vertical image size at layer D */ /* YD - Vertical image size at layer D */
@ -322,6 +325,7 @@ static int check_bih(t85_decode_state_t *s)
if (s->yd == 0 || (s->max_yd && s->yd > s->max_yd)) if (s->yd == 0 || (s->max_yd && s->yd > s->max_yd))
{ {
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Length is %" PRIu32 "\n", s->yd); span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Length is %" PRIu32 "\n", s->yd);
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
} }
/* L0 - Rows per stripe, at the lowest resolution */ /* L0 - Rows per stripe, at the lowest resolution */
@ -329,6 +333,7 @@ static int check_bih(t85_decode_state_t *s)
if (s->l0 == 0) if (s->l0 == 0)
{ {
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. L0 is %" PRIu32 "\n", s->l0); span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. L0 is %" PRIu32 "\n", s->l0);
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
} }
/* MX - Maximum horizontal offset allowed for AT pixel */ /* MX - Maximum horizontal offset allowed for AT pixel */
@ -336,6 +341,7 @@ static int check_bih(t85_decode_state_t *s)
if (s->mx > 127) if (s->mx > 127)
{ {
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. MX is %d\n", s->mx); span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. MX is %d\n", s->mx);
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
} }
/* Options byte */ /* Options byte */
@ -343,6 +349,7 @@ static int check_bih(t85_decode_state_t *s)
if ((s->options & 0x97)) if ((s->options & 0x97))
{ {
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Options are 0x%X\n", s->options); span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Options are 0x%X\n", s->options);
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
} }
span_log(&s->logging, SPAN_LOG_FLOW, "BIH is OK. Image is %" PRIu32 "x%" PRIu32 " pixels\n", s->xd, s->yd); span_log(&s->logging, SPAN_LOG_FLOW, "BIH is OK. Image is %" PRIu32 "x%" PRIu32 " pixels\n", s->xd, s->yd);
@ -388,6 +395,8 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
{ {
if (s->y >= s->yd) if (s->y >= s->yd)
return T4_DECODE_OK; return T4_DECODE_OK;
if (s->end_of_data > 0)
return T4_DECODE_INVALID_DATA;
/* This is the end of image condition */ /* This is the end of image condition */
s->end_of_data = 1; s->end_of_data = 1;
} }
@ -502,7 +511,6 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
the commonest thing for us to hit here. */ the commonest thing for us to hit here. */
decode_pscd(s, s->buffer, 2); decode_pscd(s, s->buffer, 2);
s->buf_len = 0; s->buf_len = 0;
if (s->interrupt) if (s->interrupt)
return T4_DECODE_INTERRUPT; return T4_DECODE_INTERRUPT;
break; break;
@ -533,9 +541,11 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
continue; continue;
s->buf_needed = 2; s->buf_needed = 2;
s->buf_len = 0; s->buf_len = 0;
if (s->at_moves >= T85_ATMOVES_MAX) if (s->at_moves >= T85_ATMOVES_MAX)
{
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
}
s->at_row[s->at_moves] = pack_32(&s->buffer[2]); s->at_row[s->at_moves] = pack_32(&s->buffer[2]);
s->at_tx[s->at_moves] = s->buffer[6]; s->at_tx[s->at_moves] = s->buffer[6];
if (s->at_tx[s->at_moves] > s->mx if (s->at_tx[s->at_moves] > s->mx
@ -544,6 +554,7 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
|| ||
s->buffer[7] != 0) s->buffer[7] != 0)
{ {
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
} }
s->at_moves++; s->at_moves++;
@ -554,14 +565,19 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
continue; continue;
s->buf_needed = 2; s->buf_needed = 2;
s->buf_len = 0; s->buf_len = 0;
if (!(s->options & T85_VLENGTH)) if (!(s->options & T85_VLENGTH))
{
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
}
s->options &= ~T85_VLENGTH; s->options &= ~T85_VLENGTH;
y = pack_32(&s->buffer[2]); y = pack_32(&s->buffer[2]);
/* An update to the image length is not allowed to stretch it. */ /* An update to the image length is not allowed to stretch it. */
if (y > s->yd) if (y > s->yd)
{
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
}
s->yd = y; s->yd = y;
break; break;
case T82_SDNORM: case T82_SDNORM:
@ -643,7 +659,10 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
y = pack_32(&s->buffer[4]); y = pack_32(&s->buffer[4]);
/* An update to the image length is not allowed to stretch it. */ /* An update to the image length is not allowed to stretch it. */
if (y > s->yd) if (y > s->yd)
{
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
}
/* Things look OK, so accept this new length, and proceed. */ /* Things look OK, so accept this new length, and proceed. */
s->yd = y; s->yd = y;
/* Now process the T82_SDNORM or T82_SDRST */ /* Now process the T82_SDNORM or T82_SDRST */
@ -657,6 +676,7 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
break; break;
default: default:
s->buf_len = 0; s->buf_len = 0;
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
} }
} }
@ -673,10 +693,12 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
/* We should only have stopped processing PSCD if /* We should only have stopped processing PSCD if
we ran out of data, or hit a T82_ESC */ we ran out of data, or hit a T82_ESC */
if (cnt < len && data[cnt] != T82_ESC) if (cnt < len && data[cnt] != T82_ESC)
{
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA; return T4_DECODE_INVALID_DATA;
} }
} }
}
return T4_DECODE_MORE_DATA; return T4_DECODE_MORE_DATA;
} }
/*- End of function --------------------------------------------------------*/ /*- End of function --------------------------------------------------------*/