retronetworking
/
freeswitch
13
0
Fork 0
Code Pull Requests Releases Activity

A few little tidyups and the eliminate of a potential crash if the T.85 

decoder encounters certain kinds of messed up T.85 images.
This commit is contained in:
Steve Underwood 2013-09-01 23:37:21 +08:00
parent 8b8b91beeb
commit cfe6fccec9
4 changed files with 32 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libs/spandsp/src/t30.c
View File

@ -2967,7 +2967,7 @@ static int process_rx_pps(t30_state_t *s, const uint8_t *msg, int len)
span_log(&s->logging, SPAN_LOG_FLOW, "Partial page OK - committing block %d, %d frames\n", s->ecm_block, s->ecm_frames);
for (i = 0; i < s->ecm_frames; i++)
{
if (t4_rx_put(&s->t4.rx, s->ecm_data[i], s->ecm_len[i]))
if (t4_rx_put(&s->t4.rx, s->ecm_data[i], s->ecm_len[i]) != T4_DECODE_MORE_DATA)
{
/* This is the end of the document */
break;
@ -5831,7 +5831,7 @@ SPAN_DECLARE_NONSTD(void) t30_non_ecm_put_bit(void *user_data, int bit)
break;
case T30_STATE_F_DOC_NON_ECM:
/* Document transfer */
if (t4_rx_put_bit(&s->t4.rx, bit) == T4_DECODE_OK)
if (t4_rx_put_bit(&s->t4.rx, bit) != T4_DECODE_MORE_DATA)
{
/* That is the end of the document */
set_state(s, T30_STATE_F_POST_DOC_NON_ECM);
@ -5871,7 +5871,7 @@ SPAN_DECLARE(void) t30_non_ecm_put(void *user_data, const uint8_t buf[], int len
break;
case T30_STATE_F_DOC_NON_ECM:
/* Document transfer */
if (t4_rx_put(&s->t4.rx, buf, len))
if (t4_rx_put(&s->t4.rx, buf, len) != T4_DECODE_MORE_DATA)
{
/* That is the end of the document */
set_state(s, T30_STATE_F_POST_DOC_NON_ECM);

2
libs/spandsp/src/t4_rx.c
View File

@ -90,8 +90,10 @@ typedef struct
} packer_t;
#if defined(SPANDSP_SUPPORT_TIFF_FX)
#if TIFFLIB_VERSION >= 20120615
extern TIFFFieldArray tiff_fx_field_array;
#endif
#endif
SPAN_DECLARE(const char *) t4_compression_to_str(int compression)
{

2
libs/spandsp/src/t4_tx.c
View File

@ -164,7 +164,7 @@ static const TIFFFieldInfo tiff_fx_tiff_field_info[] =
{TIFFTAG_IMAGELAYER, 2, 2, TIFF_LONG, FIELD_CUSTOM, false, false, (char *) "ImageLayer"},
};
#if 1
#if TIFFLIB_VERSION >= 20120615
static TIFFField tiff_fx_tiff_fields[] =
{
{ TIFFTAG_INDEXED, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 1, 0, (char *) "Indexed" },

30
libs/spandsp/src/t85_decode.c
View File

@ -299,12 +299,14 @@ static int check_bih(t85_decode_state_t *s)
#endif
{
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Fixed bytes do not contain expected values.\n");
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
/* P - Number of bit planes */
if (s->buffer[2] < s->min_bit_planes || s->buffer[2] > s->max_bit_planes)
{
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. %d bit planes. Should be %d to %d.\n", s->buffer[2], s->min_bit_planes, s->max_bit_planes);
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
s->bit_planes = s->buffer[2];
@ -315,6 +317,7 @@ static int check_bih(t85_decode_state_t *s)
if (s->xd == 0 || (s->max_xd && s->xd > s->max_xd))
{
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Width is %" PRIu32 "\n", s->xd);
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
/* YD - Vertical image size at layer D */
@ -322,6 +325,7 @@ static int check_bih(t85_decode_state_t *s)
if (s->yd == 0 || (s->max_yd && s->yd > s->max_yd))
{
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Length is %" PRIu32 "\n", s->yd);
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
/* L0 - Rows per stripe, at the lowest resolution */
@ -329,6 +333,7 @@ static int check_bih(t85_decode_state_t *s)
if (s->l0 == 0)
{
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. L0 is %" PRIu32 "\n", s->l0);
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
/* MX - Maximum horizontal offset allowed for AT pixel */
@ -336,6 +341,7 @@ static int check_bih(t85_decode_state_t *s)
if (s->mx > 127)
{
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. MX is %d\n", s->mx);
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
/* Options byte */
@ -343,6 +349,7 @@ static int check_bih(t85_decode_state_t *s)
if ((s->options & 0x97))
{
span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Options are 0x%X\n", s->options);
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
span_log(&s->logging, SPAN_LOG_FLOW, "BIH is OK. Image is %" PRIu32 "x%" PRIu32 " pixels\n", s->xd, s->yd);
@ -388,6 +395,8 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
{
if (s->y >= s->yd)
return T4_DECODE_OK;
if (s->end_of_data > 0)
return T4_DECODE_INVALID_DATA;
/* This is the end of image condition */
s->end_of_data = 1;
}
@ -502,7 +511,6 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
the commonest thing for us to hit here. */
decode_pscd(s, s->buffer, 2);
s->buf_len = 0;
if (s->interrupt)
return T4_DECODE_INTERRUPT;
break;
@ -533,9 +541,11 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
continue;
s->buf_needed = 2;
s->buf_len = 0;
if (s->at_moves >= T85_ATMOVES_MAX)
{
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
s->at_row[s->at_moves] = pack_32(&s->buffer[2]);
s->at_tx[s->at_moves] = s->buffer[6];
if (s->at_tx[s->at_moves] > s->mx
@ -544,6 +554,7 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
||
s->buffer[7] != 0)
{
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
s->at_moves++;
@ -554,14 +565,19 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
continue;
s->buf_needed = 2;
s->buf_len = 0;
if (!(s->options & T85_VLENGTH))
{
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
s->options &= ~T85_VLENGTH;
y = pack_32(&s->buffer[2]);
/* An update to the image length is not allowed to stretch it. */
if (y > s->yd)
{
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
s->yd = y;
break;
case T82_SDNORM:
@ -643,7 +659,10 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
y = pack_32(&s->buffer[4]);
/* An update to the image length is not allowed to stretch it. */
if (y > s->yd)
{
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
/* Things look OK, so accept this new length, and proceed. */
s->yd = y;
/* Now process the T82_SDNORM or T82_SDRST */
@ -657,6 +676,7 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
break;
default:
s->buf_len = 0;
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
}
@ -673,10 +693,12 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
/* We should only have stopped processing PSCD if
we ran out of data, or hit a T82_ESC */
if (cnt < len && data[cnt] != T82_ESC)
{
s->end_of_data = 2;
return T4_DECODE_INVALID_DATA;
}
}
}
return T4_DECODE_MORE_DATA;
}
/*- End of function --------------------------------------------------------*/