Commit message: pict: Fixed a bug with ICC profile extraction

Could cause a NULL pointer dereference.

Found by F. Çelik.
CVE: CVE-2021-28855
CWE: CWE-476
Vulnerability description: In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (src/deark-dbuf.c).

Project: deark
File: pict.c

static int handler_a1(deark *c, lctx *d, i64 opcode, i64 data_pos, i64 *bytes_used)
{
	i64 kind;
	i64 len;

	kind = de_getu16be(data_pos);
	len = de_getu16be(data_pos+2);
	de_dbg(c, "comment kind: %d, size: %d", (int)kind, (int)len);
	*bytes_used = 4+len;

	if(kind==100 && len>=4) {
		struct de_fourcc sig4cc;

		dbuf_read_fourcc(c->infile, data_pos+4, &sig4cc, 4, 0x0);
		de_dbg(c, "application comment, signature=0x%08x '%s'",
			(unsigned int)sig4cc.id, sig4cc.id_dbgstr);
		de_dbg_hexdump(c, c->infile, data_pos+8, len-4, 256, NULL, 0x1);
	}
	else if(kind==224) {
		do_iccprofile_item(c, d, data_pos+4, len);
	}
	else {
		de_dbg_hexdump(c, c->infile, data_pos+4, len, 256, NULL, 0x1);
	}

	return 1;
}

Project: deark
File: pict.c

static int handler_0c00(deark *c, lctx *d, i64 opcode, i64 data_pos, i64 *bytes_used)
{
	i64 hdrver;
	double hres, vres;
	struct pict_rect srcrect;

	hdrver = de_getu16be(data_pos);
	d->is_extended_v2 = (hdrver==0xfffe);

	de_dbg(c, "extended v2: %s", d->is_extended_v2?"yes":"no");
	if(d->is_extended_v2) {
		hres = pict_read_fixed(c->infile, data_pos+4);
		vres = pict_read_fixed(c->infile, data_pos+8);
		de_dbg(c, "dpi: %.2f"DE_CHAR_TIMES"%.2f", hres, vres);
		pict_read_rect(c->infile, data_pos+12, &srcrect, "srcRect");
	}

	return 1;
}

Project: deark
File: pict.c

static void do_read_items(deark *c, lctx *d, i64 pos)
{
	i64 opcode;
	i64 opcode_pos;
	i64 bytes_used;
	int ret;

	while(1) {
		if(pos%2 && d->version==2) {
			pos++; // 2-byte alignment
		}

		if(pos >= c->infile->len) break;

		opcode_pos = pos;

		if(d->version==2) {
			opcode = de_getu16be(pos);
			pos+=2;
		}
		else {
			opcode = (i64)de_getbyte(pos);
			pos+=1;
		}

		ret = do_handle_item(c, d, opcode_pos, opcode, pos, &bytes_used);
		if(!ret) goto done;
		if(opcode==0x00ff) goto done; // End of image

		pos += bytes_used;
	}
done:
	;
}

Project: deark
File: pict.c

static void decode_bitmap_rgb24(deark *c, lctx *d, struct fmtutil_macbitmap_info *bi,
	dbuf *unc_pixels, de_bitmap *img, i64 pos)
{
	i64 i, j;
	u8 cr, cg, cb;

	for(j=0; j<bi->height; j++) {
		for(i=0; i<bi->pdwidth; i++) {
			cr = dbuf_getbyte(unc_pixels, j*bi->rowspan + (bi->cmpcount-3+0)*bi->pdwidth + i);
			cg = dbuf_getbyte(unc_pixels, j*bi->rowspan + (bi->cmpcount-3+1)*bi->pdwidth + i);
			cb = dbuf_getbyte(unc_pixels, j*bi->rowspan + (bi->cmpcount-3+2)*bi->pdwidth + i);
			de_bitmap_setpixel_rgb(img, i, j, DE_MAKE_RGB(cr,cg,cb));
		}
	}
}

Project: deark
File: pict.c

static int decode_bitmap(deark *c, lctx *d, struct fmtutil_macbitmap_info *bi, i64 pos)
{
	i64 j;
	dbuf *unc_pixels = NULL;
	de_bitmap *img = NULL;
	de_finfo *fi = NULL;
	i64 bytecount;
	i64 bitmapsize;
	int dst_nsamples;
	struct de_dfilter_in_params dcmpri;
	struct de_dfilter_out_params dcmpro;
	struct de_dfilter_results dres;

	de_dfilter_init_objects(c, &dcmpri, &dcmpro, &dres);

	bi->rowspan = bi->rowbytes;
	if(bi->pixelsize==32 && bi->cmpcount==3 && bi->cmpsize==8) {
		bi->rowspan = (bi->rowbytes/4)*3;
	}

	bitmapsize = bi->height * bi->rowspan;
	unc_pixels = dbuf_create_membuf(c, bitmapsize, 1);

	dcmpri.f = c->infile;
	dcmpro.f = unc_pixels;

	for(j=0; j<bi->height; j++) {
		if(bi->packing_type==1 || bi->rowbytes<8) {
			bytecount = bi->rowbytes;
		}
		else if(bi->rowbytes > 250) {
			bytecount = de_getu16be(pos);
			pos+=2;
		}
		else {
			bytecount = (i64)de_getbyte(pos);
			pos+=1;
		}

		if(bi->packing_type==1 || bi->rowbytes<8) {
			dbuf_copy(c->infile, pos, bytecount, unc_pixels);
		}
		else if(bi->packing_type==3 && bi->pixelsize==16) {
			struct de_packbits_params pbparams;

			de_zeromem(&pbparams, sizeof(struct de_packbits_params));
			pbparams.is_packbits16 = 1;
			dcmpri.pos = pos;
			dcmpri.len = bytecount;
			fmtutil_decompress_packbits_ex(c, &dcmpri, &dcmpro, &dres, &pbparams);
		}
		else {
			dcmpri.pos = pos;
			dcmpri.len = bytecount;
			fmtutil_decompress_packbits_ex(c, &dcmpri, &dcmpro, &dres, NULL);
		}

		// Make sure the data decompressed to the right number of bytes.
		if(unc_pixels->len != (j+1)*bi->rowspan) {
			dbuf_truncate(unc_pixels, (j+1)*bi->rowspan);
		}

		pos += bytecount;
	}

	dst_nsamples = 3;
	if(bi->uses_pal) {
		if(de_is_grayscale_palette(bi->pal, bi->num_pal_entries)) {
			dst_nsamples = 1;
		}
	}

	img = de_bitmap_create2(c, bi->npwidth, bi->pdwidth, bi->height, dst_nsamples);

	fi = de_finfo_create(c);

	if(bi->hdpi>=1.0 && bi->vdpi>=1.0) {
		fi->density.code = DE_DENSITY_DPI;
		fi->density.xdens = bi->hdpi;
		fi->density.ydens = bi->vdpi;
	}

	if(bi->uses_pal) {
		decode_bitmap_paletted(c, d, bi, unc_pixels, img, pos);
	}
	else {
		if(bi->pixelsize==16) {
			decode_bitmap_rgb16(c, d, bi, unc_pixels, img, pos);
		}
		else {
			decode_bitmap_rgb24(c, d, bi, unc_pixels, img, pos);
		}
	}

	de_bitmap_write_to_file_finfo(img, fi, 0);

	de_bitmap_destroy(img);
	de_finfo_destroy(c, fi);
	dbuf_close(unc_pixels);
	return 1;
}

Project: deark
File: pict.c

static void decode_bitmap_rgb16(deark *c, lctx *d, struct fmtutil_macbitmap_info *bi,
	dbuf *unc_pixels, de_bitmap *img, i64 pos)
{
	i64 i, j;
	u8 c0, c1; //, cg, cb;
	u32 clr;

	for(j=0; j<bi->height; j++) {
		for(i=0; i<bi->pdwidth; i++) {
			c0 = dbuf_getbyte(unc_pixels, j*bi->rowspan + i*2);
			c1 = dbuf_getbyte(unc_pixels, j*bi->rowspan + i*2+1);
			clr = ((u32)c0 << 8)|c1;
			clr = de_rgb555_to_888(clr);
			de_bitmap_setpixel_rgb(img, i, j, clr);
		}
	}
}

Project: deark
File: pict.c

static const struct opcode_info *find_opcode_info(i64 opcode)
{
	size_t i;

	for(i=0; i<DE_ARRAYCOUNT(opcode_info_arr); i++) {
		if(opcode_info_arr[i].opcode == opcode) {
			return &opcode_info_arr[i];
		}
	}
	return NULL;
}

Project: deark
File: pict.c

static int get_pixdata_size(deark *c, lctx *d, struct fmtutil_macbitmap_info *bi,
	i64 pos1, i64 *pixdata_size)
{
	i64 pos;
	i64 j;
	i64 bytecount;
	int retval = 0;

	pos = pos1;
	de_dbg(c, "PixData at %d", (int)pos);
	de_dbg_indent(c, 1);

	if(bi->height<0 || bi->height>65535) {
		de_err(c, "Invalid bitmap height (%d)", (int)bi->height);
		goto done;
	}

	// Make sure rowbytes is sane. We use it to decide how much memory to allocate.
	// Note: I've seen valid bitmaps with as many as 284 extra bytes per row.
	if(bi->rowbytes > (bi->npwidth * bi->pixelsize)/8 + 1000) {
		de_err(c, "Bad rowBytes value (%d)", (int)bi->rowbytes);
		goto done;
	}

	if(bi->packing_type>=3 || (bi->packing_type==0 && bi->rowbytes>=8)) {
		for(j=0; j<bi->height; j++) {
			if(bi->rowbytes > 250) {
				bytecount = de_getu16be(pos);
				pos+=2;
			}
			else {
				bytecount = (i64)de_getbyte(pos);
				pos+=1;
			}
			pos += bytecount;
		}
	}
	else if(bi->packing_type==1 || (bi->packing_type==0 && bi->rowbytes<8)) {
		pos += bi->rowbytes * bi->height; // uncompressed
	}
	else {
		de_err(c, "Unsupported packing type: %d", (int)bi->packing_type);
		goto done;
	}

	*pixdata_size = pos - pos1;
	de_dbg(c, "PixData size: %d", (int)*pixdata_size);
	retval = 1;

done:
	de_dbg_indent(c, -1);
	return retval;
}

Project: deark
File: pict.c

static void do_detect_version(deark *c, struct detection_info *dti, int mode)
{
	static const u8 v1pattern[2] = { 0x11, 0x01 };
	static const u8 v2pattern[6] = { 0x00, 0x11, 0x02, 0xff, 0x0c, 0x00 };
	u8 buf[6];
	int v1_nohdr = 0;
	int v2_nohdr = 0;
	int v1_hdr = 0;
	int v2_hdr = 0;

	dti->file_version = 0;
	dti->has_fileheader = 0;

	de_read(buf, 522, sizeof(buf));
	if(!de_memcmp(buf, v2pattern, 6)) {
		v2_hdr = 1;
	}
	else if(!de_memcmp(buf, v1pattern, 2)) {
		v1_hdr = 1;
	}
	else {
		de_read(buf, 10, sizeof(buf));
		if(!de_memcmp(buf, v2pattern, 6)) {
			v2_nohdr = 1;
		}
		else if(!de_memcmp(buf, v1pattern, 2)) {
			v1_nohdr = 1;
		}
	}

	if(!v1_hdr && !v2_hdr && !v1_nohdr && !v2_nohdr) {
		return;
	}

	if(v2_hdr) {
		dti->file_version = 2;
		dti->has_fileheader = 1;
		return;
	}
	else if(v2_nohdr) {
		dti->file_version = 2;
		return;
	}

	if(mode==0) {
		// For v1, check that the file ends as expected
		de_read(buf, c->infile->len-2, 2);
		if(buf[1]==0xff) {
			; // v1 files should end with 0xff
		}
		else if(buf[0]==0xff && buf[1]==0x00) {
			; // But a few have an extra NUL byte at the end
		}
	}

	if(v1_hdr) {
		dti->file_version = 1;
		dti->has_fileheader = 1;
		return;
	}
	else if(v1_nohdr) {
		dti->file_version = 1;
		return;
	}
}

Project: deark
File: pict.c

static int handler_2b(deark *c, lctx *d, i64 opcode, i64 data_pos, i64 *bytes_used)
{
	i64 tlen;
	i64 dh, dv;
	de_ucstring *s = NULL;

	dh = (i64)de_getbyte(data_pos);
	dv = (i64)de_getbyte(data_pos+1);
	de_dbg(c, "dh,dv: (%d,%d)", (int)dh, (int)dv);

	tlen = (i64)de_getbyte(data_pos+2);
	de_dbg(c, "text size: %d", (int)tlen);
	*bytes_used = 3+tlen;

	s = ucstring_create(c);
	dbuf_read_to_ucstring(c->infile, data_pos+3, tlen, s, 0, DE_ENCODING_MACROMAN);
	de_dbg(c, "text: \"%s\"", ucstring_getpsz(s));

	return 1;
}

Project: deark
File: pict.c

static void pict_read_point(dbuf *f, i64 pos,
	struct pict_point *point, const char *dbgname)
{
	point->y = dbuf_geti16be(f, pos);
	point->x = dbuf_geti16be(f, pos+2);

	if(dbgname) {
		de_dbg(f->c, "%s: (%d,%d)", dbgname, (int)point->x, (int)point->y);
	}
}

Project: deark
File: pict.c

static int handler_Rectangle(deark *c, lctx *d, i64 opcode, i64 data_pos, i64 *bytes_used)
{
	struct pict_rect rect;

	pict_read_rect(c->infile, data_pos, &rect, "rect");
	return 1;
}

Project: deark
File: pict.c

static void do_iccprofile_item(deark *c, lctx *d, i64 pos, i64 len)
{
	i64 selector;
	i64 data_len;

	if(len<4) return;
	selector = de_getu32be(pos);
	data_len = len-4;
	de_dbg(c, "ICC profile segment, selector=%d, data len=%d", (int)selector,
		(int)data_len);

	if(selector!=1) {
		// If this is not a Continuation segment, close any current file.
		dbuf_close(d->iccprofile_file);
		d->iccprofile_file = NULL;
	}

	if(selector==0) { // Beginning segment
		d->iccprofile_file = dbuf_create_output_file(c, "icc", NULL, DE_CREATEFLAG_IS_AUX);
	}

	if(selector==0 || selector==1) {
		// Beginning and Continuation segments normally have profile data.
		// End segments (selector==2) are not allowed to include data.

		if(!d->iccprofile_file) {
			de_warn(c, "Bad ICC profile segment");
			return;
		}
		dbuf_copy(c->infile, pos+4, data_len, d->iccprofile_file);
	}
}

Project: deark
File: pict.c

static void de_run_pict(deark *c, de_module_params *mparams)
{
	lctx *d = NULL;
	i64 pos = 0;
	i64 picsize;
	struct pict_rect framerect;

	d = de_malloc(c, sizeof(lctx));

	do_detect_version(c, &d->dti, 1);
	if(d->dti.file_version>0) {
		de_declare_fmtf(c, "PICT v%d%s", d->dti.file_version,
			d->dti.has_fileheader?"":", without file header");
	}

	d->version = 1;

	if(d->dti.has_fileheader) {
		pos += 512;
	}

	picsize = de_getu16be(pos);
	de_dbg(c, "picSize: %d", (int)picsize);
	pos+=2;
	pict_read_rect(c->infile, pos, &framerect, "picFrame");
	pos+=8;

	do_read_items(c, d, pos);

	dbuf_close(d->iccprofile_file);
	de_free(c, d);
}

Project: deark
File: pict.c

static int handler_pixpat(deark *c, lctx *d, i64 opcode, i64 pos1, i64 *bytes_used)
{
	unsigned int pattype;
	i64 pos = pos1;
	int needmsg = 1;
	int retval = 0;
	i64 colortable_size = 0;
	i64 pixdata_size = 0;
	struct fmtutil_macbitmap_info *bi = NULL;

	pattype = (unsigned int)de_getu16be_p(&pos);
	de_dbg(c, "PatType: %u", pattype);
	pos += 8; // Pat1Data

	if(pattype==2) { // ditherPat(?)
		pos += 6; // RGB
		retval = 1;
		goto done;
	}

	bi = de_malloc(c, sizeof(struct fmtutil_macbitmap_info));

	fmtutil_macbitmap_read_rowbytes_and_bounds(c, c->infile, bi, pos);
	pos += 10;
	fmtutil_macbitmap_read_pixmap_only_fields(c, c->infile, bi, pos);
	pos += 36;

	bi->uses_pal = 1;
	if(!fmtutil_macbitmap_read_colortable(c, c->infile, bi, pos, &colortable_size)) goto done;
	pos += colortable_size;

	if(!get_pixdata_size(c, d, bi, pos, &pixdata_size)) {
		goto done;
	}
	// Note: We could extract the "PixMap" pattern easily enough here, by calling
	// decode_pixdata(). But if we do that, maybe we should also extract the
	// Pat1Data data above, as well as other opcodes like BkPat.
	pos += pixdata_size;
	retval = 1;

done:
	if(!retval && needmsg) {
		de_err(c, "Failed to parse PixPat data");
	}
	if(retval) {
		*bytes_used = pos - pos1;
	}
	de_free(c, bi);
	return retval;
}

Project: deark
File: pict.c

static int do_handle_item(deark *c, lctx *d, i64 opcode_pos, i64 opcode,
						   i64 data_pos, i64 *data_bytes_used)
{
	const char *opcode_name;
	const struct opcode_info *opi;
	i64 n;
	struct pict_rect tmprect;
	int ret = 0;

	*data_bytes_used = 0;

	opi = find_opcode_info(opcode);
	if(opi && opi->name) opcode_name = opi->name;
	else opcode_name = "?";

	if(d->version==2)
		de_dbg(c, "opcode 0x%04x (%s) at %d", (unsigned int)opcode, opcode_name, (int)opcode_pos);
	else
		de_dbg(c, "opcode 0x%02x (%s) at %d", (unsigned int)opcode, opcode_name, (int)opcode_pos);

	if(opi && opi->fn) {
		de_dbg_indent(c, 1);
		*data_bytes_used = opi->size; // Default to the size in the table.
		ret = opi->fn(c, d, opcode, data_pos, data_bytes_used);
		de_dbg_indent(c, -1);
	}
	else if(opi && opi->size_code==SZCODE_EXACT) {
		*data_bytes_used = opi->size;
		ret = 1;
	}
	else if(opi && opi->size_code==SZCODE_REGION) {
		n = de_getu16be(data_pos);
		de_dbg_indent(c, 1);
		de_dbg(c, "region size: %d", (int)n);
		if(n>=10) {
			pict_read_rect(c->infile, data_pos+2, &tmprect, "rect");
		}
		de_dbg_indent(c, -1);
		*data_bytes_used = n;
		ret = 1;
	}
	else if(opi && opi->size_code==SZCODE_POLYGON) {
		n = de_getu16be(data_pos);
		de_dbg_indent(c, 1);
		de_dbg(c, "polygon size: %d", (int)n);
		de_dbg_indent(c, -1);
		*data_bytes_used = n;
		ret = 1;
	}
	else if(opcode>=0x2c && opcode<=0x2f) {
		// Starts with 2-byte size, size does not include the "size" field.
		n = de_getu16be(data_pos);
		*data_bytes_used = 2+n;
		ret = 1;
	}
	else if(opcode>=0x8100 && opcode<=0xffff) {
		// Starts with 4-byte size, size does not include the "size" field.
		n = de_getu32be(data_pos);
		*data_bytes_used = 4+n;
		ret = 1;
	}
	else {
		de_err(c, "Unsupported opcode: 0x%04x", (unsigned int)opcode);
	}

	return ret;
}

Project: deark
File: pict.c

static int de_identify_pict(deark *c)
{
	struct detection_info dti;

	do_detect_version(c, &dti, 0);
	if(dti.file_version==2) {
		return 85;
	}
	else if(dti.file_version==1) {
		if(dti.has_fileheader) return 25;
		return 15;
	}
	return 0;
}

Project: deark
File: pict.c

static int handler_a0(deark *c, lctx *d, i64 opcode, i64 data_pos, i64 *bytes_used)
{
	i64 kind;
	kind = de_getu16be(data_pos);
	de_dbg(c, "comment kind: %d", (int)kind);
	return 1;
}

Project: deark
File: pict.c

static void do_handle_qtif_idsc(deark *c, lctx *d, i64 pos, i64 len)
{
	i64 idsc_dpos, idsc_dlen;
	i64 idat_dpos, idat_dlen;
	dbuf *outf = NULL;
	struct de_fourcc cmpr4cc;

	if(d->decode_qtif) {
		de_run_module_by_id_on_slice2(c, "qtif", "I", c->infile, pos, len);
		return;
	}

	// Try to construct a .qtif file.
	// This way, we do something potentially useful even if the image has
	// a compression scheme that our qtif module doesn't support.

	idsc_dpos = pos;
	idsc_dlen = de_getu32be(idsc_dpos);
	de_dbg(c, "idsc: pos=%"I64_FMT", len=%"I64_FMT, idsc_dpos, idsc_dlen);
	if(idsc_dpos+idsc_dlen > pos+len) goto done;

	dbuf_read_fourcc(c->infile, idsc_dpos+4, &cmpr4cc, 4, 0x0);
	de_dbg(c, "compression type: \"%s\"", cmpr4cc.id_dbgstr);

	idat_dpos = idsc_dpos + idsc_dlen;
	idat_dlen = de_getu32be(idsc_dpos+44);
	de_dbg(c, "idat: pos=%"I64_FMT", len=%"I64_FMT, idat_dpos, idat_dlen);
	if(idat_dlen==0) {
		idat_dlen = pos+len-idat_dpos; // ??
	}
	if(idat_dpos+idat_dlen > pos+len) goto done;

#define CODE_idat 0x69646174U
#define CODE_idsc 0x69647363U
	outf = dbuf_create_output_file(c, "qtif", NULL, 0);

	dbuf_writeu32be(outf, 8+idsc_dlen);
	dbuf_writeu32be(outf, CODE_idsc);
	dbuf_copy(c->infile, idsc_dpos, idsc_dlen, outf);

	dbuf_writeu32be(outf, 8+idat_dlen);
	dbuf_writeu32be(outf, CODE_idat);
	dbuf_copy(c->infile, idat_dpos, idat_dlen, outf);

done:
	dbuf_close(outf);
}

Project: deark
File: pict.c

void de_module_pict(deark *c, struct deark_module_info *mi)
{
	mi->id = "pict";
	mi->desc = "Macintosh PICT";
	mi->run_fn = de_run_pict;
	mi->identify_fn = de_identify_pict;
}

Project: deark
File: pict.c

static int handler_28(deark *c, lctx *d, i64 opcode, i64 data_pos, i64 *bytes_used)
{
	i64 tlen;
	de_ucstring *s = NULL;
	struct pict_point pt;

	pict_read_point(c->infile, data_pos, &pt, "txLoc");
	tlen = (i64)de_getbyte(data_pos+4);
	s = ucstring_create(c);
	dbuf_read_to_ucstring(c->infile, data_pos+5, tlen, s, 0, DE_ENCODING_MACROMAN);
	de_dbg(c, "text: \"%s\"", ucstring_getpsz(s));
	*bytes_used = 5+tlen;
	ucstring_destroy(s);
	return 1;
}

Project: deark
File: pict.c

static int handler_11(deark *c, lctx *d, i64 opcode, i64 data_pos, i64 *bytes_used)
{
	i64 ver;

	*bytes_used = 1;
	ver = de_getbyte(data_pos);
	de_dbg(c, "version: %d", (int)ver);

	if(ver==2) {
		d->version = 2;
	}
	else if(ver!=1) {
		de_err(c, "Unsupported PICT version: %d", (int)ver);
		return 0;
	}
	return 1;
}

Project: deark
File: pict.c

static void decode_bitmap_paletted(deark *c, lctx *d, struct fmtutil_macbitmap_info *bi,
	dbuf *unc_pixels, de_bitmap *img, i64 pos)
{
	i64 i, j;
	u8 b;
	u32 clr;

	for(j=0; j<bi->height; j++) {
		for(i=0; i<bi->pdwidth; i++) {
			b = de_get_bits_symbol(unc_pixels, bi->pixelsize, j*bi->rowspan, i);
			clr = bi->pal[(unsigned int)b];
			de_bitmap_setpixel_rgb(img, i, j, clr);
		}
	}
}

Project: deark
File: pict.c

static int handler_QuickTime(deark *c, lctx *d, i64 opcode, i64 data_pos, i64 *bytes_used)
{
	i64 payload_pos;
	i64 payload_len;
	i64 endpos;
	i64 idsc_pos;

	payload_len = de_getu32be(data_pos);
	payload_pos = data_pos+4;
	de_dbg(c, "payload: pos=%"I64_FMT", len=%"I64_FMT, payload_pos, payload_len);
	endpos = payload_pos+payload_len;
	if(endpos > c->infile->len) return 0;
	*bytes_used = 4+payload_len;

	// Following the size field seems to be 68 or 50 bytes of data,
	// followed by QuickTime "idsc" data, followed by image data.
	idsc_pos = payload_pos + ((opcode==0x8201) ? 50 : 68);

	do_handle_qtif_idsc(c, d, idsc_pos, endpos-idsc_pos);
	return 1;
}

Project: deark
File: pict.c

static int handler_2c(deark *c, lctx *d, i64 opcode, i64 data_pos, i64 *bytes_used)
{
	i64 n;
	i64 tlen;
	i64 id;
	de_ucstring *s = NULL;

	n = de_getu16be(data_pos);
	*bytes_used = 2+n;
	id = de_getu16be(data_pos+2);
	de_dbg(c, "old font id: %d", (int)id);
	tlen = (i64)de_getbyte(data_pos+4);
	s = ucstring_create(c);
	dbuf_read_to_ucstring(c->infile, data_pos+5, tlen, s, 0, DE_ENCODING_MACROMAN);
	de_dbg(c, "font name: \"%s\"", ucstring_getpsz(s));
	ucstring_destroy(s);
	return 1;
}

Project: deark
File: pict.c

static int handler_RGBColor(deark *c, lctx *d, i64 opcode, i64 data_pos, i64 *bytes_used)
{
	unsigned int clr16[3];
	u8 clr8[3];
	u32 clr;
	char csamp[16];
	i64 pos = data_pos;
	i64 k;

	for(k=0; k<3; k++) {
		clr16[k] = (unsigned int)de_getu16be_p(&pos);
		clr8[k] = (u8)(clr16[k]>>8);
	}
	clr = DE_MAKE_RGB(clr8[0], clr8[1], clr8[2]);
	de_get_colorsample_code(c, clr, csamp, sizeof(csamp));
	de_dbg(c, "color: (0x%04x,0x%04x,0x%04x)%s", clr16[0], clr16[1], clr16[2], csamp);
	return 1;
}

Project: deark
File: pict.c

static int handler_98_9a(deark *c, lctx *d, i64 opcode, i64 pos1, i64 *bytes_used)
{
	struct fmtutil_macbitmap_info *bi = NULL;
	i64 pixdata_size = 0;
	i64 colortable_size = 0;
	int retval = 0;
	i64 pos;

	bi = de_malloc(c, sizeof(struct fmtutil_macbitmap_info));
	pos = pos1;

	if(opcode==0x9a || opcode==0x9b) {
		fmtutil_macbitmap_read_baseaddr(c, c->infile, bi, pos);
		pos += 4;
	}

	fmtutil_macbitmap_read_rowbytes_and_bounds(c, c->infile, bi, pos);
	pos += 10;

	if(bi->pixmap_flag) {
		fmtutil_macbitmap_read_pixmap_only_fields(c, c->infile, bi, pos);
		pos += 36;
	}

	if((opcode==0x90 || opcode==0x91 || opcode==0x98 || opcode==0x99) && bi->pixmap_flag) {
		// Prepare to read the palette
		bi->uses_pal = 1;
		bi->has_colortable = 1;
	}
	else if((opcode==0x90 || opcode==0x91 || opcode==0x98 || opcode==0x99) && !bi->pixmap_flag) {
		// Settings implied by the lack of a PixMap header
		bi->pixelsize = 1;
		bi->cmpcount = 1;
		bi->cmpsize = 1;
		bi->uses_pal = 1;
		bi->num_pal_entries = 2;
		bi->pal[0] = DE_STOCKCOLOR_WHITE;
		bi->pal[1] = DE_STOCKCOLOR_BLACK;
	}
	else if((opcode==0x9a || opcode==0x9b) && !bi->pixmap_flag) {
		de_err(c, "DirectBitsRect image without PixMap flag is not supported");
		goto done;
	}

	if(bi->has_colortable) {
		if(!fmtutil_macbitmap_read_colortable(c, c->infile, bi, pos, &colortable_size)) goto done;
		pos += colortable_size;
	}

	read_src_dst_mode(c, d, bi, pos);
	pos += 18;

	if(opcode==0x91 || opcode==0x99 || opcode==0x9b) {
		i64 rgnsize;

		de_dbg(c, "region at %"I64_FMT, pos);
		de_dbg_indent(c, 1);
		rgnsize = de_getu16be(pos);
		de_dbg(c, "region size: %d", (int)rgnsize);
		de_dbg_indent(c, -1);
		if(rgnsize<2) goto done;
		pos += rgnsize;
		if(!c->padpix) {
			de_info(c, "Note: Ignoring clipping region. Output image might have "
				"extraneous pixels.");
		}
	}

	if(!get_pixdata_size(c, d, bi, pos, &pixdata_size)) {
		goto done;
	}
	decode_pixdata(c, d, bi, pos);
	pos += pixdata_size;

	*bytes_used = pos - pos1;

	retval = 1;

done:
	de_free(c, bi);
	return retval;
}

Project: deark
File: pict.c

static int handler_DxText(deark *c, lctx *d, i64 opcode, i64 data_pos, i64 *bytes_used)
{
	i64 tlen;
	i64 dx;
	de_ucstring *s = NULL;

	dx = (i64)de_getbyte(data_pos);
	de_dbg(c, "%s: %d", opcode==0x2a?"dv":"dh", (int)dx);

	tlen = (i64)de_getbyte(data_pos+1);
	*bytes_used = 2+tlen;

	s = ucstring_create(c);
	dbuf_read_to_ucstring(c->infile, data_pos+2, tlen, s, 0, DE_ENCODING_MACROMAN);
	de_dbg(c, "text: \"%s\"", ucstring_getpsz(s));

	ucstring_destroy(s);
	return 1;
}

Project: deark
File: pict.c

static void read_src_dst_mode(deark *c, lctx *d, struct fmtutil_macbitmap_info *bi, i64 pos)
{
	struct pict_rect tmprect;
	i64 n;

	de_dbg(c, "src/dst/mode part of bitmap header, at %d", (int)pos);
	de_dbg_indent(c, 1);

	pict_read_rect(c->infile, pos, &tmprect, "srcRect");
	pos += 8;
	pict_read_rect(c->infile, pos, &tmprect, "dstRect");
	pos += 8;

	n = de_getu16be(pos);
	de_dbg(c, "transfer mode: %d", (int)n);
	//pos += 2;
	de_dbg_indent(c, -1);
}

Project: deark
File: pict.c

static int decode_pixdata(deark *c, lctx *d, struct fmtutil_macbitmap_info *bi, i64 pos)
{
	int retval = 0;

	de_dbg_indent(c, 1);

	if(bi->npwidth==0 || bi->height==0) {
		de_warn(c, "Ignoring zero-size bitmap (%d"DE_CHAR_TIMES"%d)",
			(int)bi->npwidth, (int)bi->height);
		goto done;
	}
	if(!de_good_image_dimensions(c, bi->npwidth, bi->height)) goto done;

	if(bi->pixelsize!=1 && bi->pixelsize!=2 && bi->pixelsize!=4 && bi->pixelsize!=8 &&
		bi->pixelsize!=16 && bi->pixelsize!=24 && bi->pixelsize!=32)
	{
		de_err(c, "%d bits/pixel images are not supported", (int)bi->pixelsize);
		goto done;
	}
	if((bi->uses_pal && bi->pixeltype!=0) || (!bi->uses_pal && bi->pixeltype!=16)) {
		de_err(c, "Pixel type %d is not supported", (int)bi->pixeltype);
		goto done;
	}
	if(bi->cmpcount!=1 && bi->cmpcount!=3 && bi->cmpcount!=4) {
		de_err(c, "Component count %d is not supported", (int)bi->cmpcount);
		goto done;
	}
	if(bi->cmpsize!=1 && bi->cmpsize!=2 && bi->cmpsize!=4 && bi->cmpsize!=5 &&
		bi->cmpsize!=8)
	{
		de_err(c, "%d-bit components are not supported", (int)bi->cmpsize);
		goto done;
	}
	if(bi->packing_type!=0 && bi->packing_type!=1 && bi->packing_type!=3 && bi->packing_type!=4) {
		de_err(c, "Packing type %d is not supported", (int)bi->packing_type);
		goto done;
	}
	if((bi->uses_pal &&
		(bi->packing_type==0 || bi->packing_type==1) &&
		(bi->pixelsize==1 || bi->pixelsize==2 || bi->pixelsize==4 || bi->pixelsize==8) &&
		bi->cmpcount==1 && bi->cmpsize==bi->pixelsize) ||
		(!bi->uses_pal && bi->packing_type==3 && bi->pixelsize==16 && bi->cmpcount==3 && bi->cmpsize==5) ||
		(!bi->uses_pal && bi->packing_type==4 && bi->pixelsize==32 && bi->cmpcount==3 && bi->cmpsize==8) ||
		(!bi->uses_pal && bi->packing_type==4 && bi->pixelsize==32 && bi->cmpcount==4 && bi->cmpsize==8))
	{
		;
	}
	else {
		de_err(c, "This type of image is not supported");
		goto done;
	}

	if(bi->cmpcount==4) {
		de_warn(c, "This image might have transparency, which is not supported.");
	}

	decode_bitmap(c, d, bi, pos);

done:
	de_dbg_indent(c, -1);
	return retval;
}