Files
libwebp/src/utils/quant_levels_dec_utils.h
Arman Hasanzadeh b4dbec562f Add fbounds-safety annotations in quant_levels_dec_utils.c/.h.
Reasoning:

Image Data Buffers:
The `data` parameter of `WebPDequantizeLevels` (in both .c and .h)
and `InitParams` (src/utils/quant_levels_dec_utils.c:232) is annotated
with `WEBP_SIZED_BY((long)stride * height)`, as it points to the start
of the image buffer.

The `src` and `dst` fields in `SmoothParams`
(src/utils/quant_levels_dec_utils.c:54) are annotated as
`WEBP_INDEXABLE`. They are initialized from `data` in `InitParams`
(L266) and are advanced row by row using pointer arithmetic (e.g.,
`p->src += p->stride` in `VFilter` L111, `p->dst += p->stride` in
`ApplyFilter` L165). `WEBP_INDEXABLE` is used because the pointers
iterate within the buffer and are only accessed with positive indices.

Scratch Buffers (`SmoothParams`):
Scratch buffers are allocated in `InitParams` via `WebPSafeMalloc`.
The local variable `mem` holding this allocation (L245) is explicitly
annotated as `WEBP_BIDI_INDEXABLE` to ensure safety when compiling with
error suppression.

- `start`, `cur`, `top`: These pointers are used for iteration and
  pointer arithmetic within the circular scratch buffer. They are
  annotated as `WEBP_INDEXABLE`.
- `end`: This pointer is annotated as `WEBP_BIDI_INDEXABLE` because it
  is used in subtraction (`p->end - width`) in `InitParams` (L257) to
  calculate `p->top`.
- `average`: This buffer is accessed sequentially up to `width`. It is
  annotated as `WEBP_COUNTED_BY(width)`. Initialization in `InitParams`
  is reordered (L261) to ensure `p->width` is set before `p->average`.
- `correction`: This lookup table requires negative indexing. To avoid
  using `WEBP_BIDI_INDEXABLE` in the struct, it is annotated as
  `WEBP_COUNTED_BY_OR_NULL(CORRECTION_LUT_SIZE)` (L75), pointing to the
  start of the buffer. `CORRECTION_LUT_SIZE` is defined (L33).
  `InitCorrectionLUT` (L188) and `ApplyFilter` (L147) calculate a local
  middle pointer which is explicitly annotated as `WEBP_BIDI_INDEXABLE`
  to allow safe negative indexing.

Local Pointers:
To ensure safety when compiling with error suppression (where locals
default to unsafe), explicit annotations are added to local pointers
derived from safe struct members:
- `VFilter` (L87): `src`, `cur`, `top`, `out` are `WEBP_INDEXABLE`.
- `HFilter` (L121): `in`, `out` are `WEBP_INDEXABLE`.
- `ApplyFilter` (L145): `average`, `dst` are `WEBP_INDEXABLE`.
- `CountLevels` (L214): `data` is `WEBP_INDEXABLE`.

Bug: 432511821
Change-Id: I6bdf86f80c94a5b182c5aef7e4092fe4ea24afb8
2025-09-17 15:31:57 -07:00

40 lines
1.4 KiB
C

// Copyright 2013 Google Inc. All Rights Reserved.
//
// Use of this source code is governed by a BSD-style license
// that can be found in the COPYING file in the root of the source
// tree. An additional intellectual property rights grant can be found
// in the file PATENTS. All contributing project authors may
// be found in the AUTHORS file in the root of the source tree.
// -----------------------------------------------------------------------------
//
// Alpha plane de-quantization utility
//
// Author: Vikas Arora (vikasa@google.com)
#ifndef WEBP_UTILS_QUANT_LEVELS_DEC_UTILS_H_
#define WEBP_UTILS_QUANT_LEVELS_DEC_UTILS_H_
#include "src/utils/bounds_safety.h"
#include "src/webp/types.h"
WEBP_ASSUME_UNSAFE_INDEXABLE_ABI
#ifdef __cplusplus
extern "C" {
#endif
// Apply post-processing to input 'data' of size 'width'x'height' assuming that
// the source was quantized to a reduced number of levels. 'stride' is in bytes.
// Strength is in [0..100] and controls the amount of dithering applied.
// Returns false in case of error (data is NULL, invalid parameters,
// malloc failure, ...).
int WebPDequantizeLevels(uint8_t* WEBP_SIZED_BY((size_t)stride* height)
const data,
int width, int height, int stride, int strength);
#ifdef __cplusplus
} // extern "C"
#endif
#endif // WEBP_UTILS_QUANT_LEVELS_DEC_UTILS_H_