libextractor

webp_extractor.c (19296B)

---

 /*
      This file is part of libextractor.
      Copyright (C) 2026 Vidyut Samanta and Christian Grothoff
 
      libextractor is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
      by the Free Software Foundation; either version 3, or (at your
      option) any later version.
 
      libextractor is distributed in the hope that it will be useful, but
      WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
      General Public License for more details.
 
      You should have received a copy of the GNU General Public License
      along with libextractor; see the file COPYING.  If not, write to the
      Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
      Boston, MA 02110-1301, USA.
  */
 /**
  * @file plugins/webp_extractor.c
  * @brief plugin to support WebP images
  * @author Christian Grothoff
  *
  * WebP is a RIFF container.  We read the chunk headers and the few
  * bytes of each bitstream header that carry the canvas size; no VP8 or
  * VP8L data is decoded and libwebp is not linked, because this is a
  * fast identification pass.
  *
  * Layout, per the WebP container specification:
  *
  *   "RIFF" <uint32le size> "WEBP"
  *   then chunks of  <FourCC> <uint32le size> <payload> [pad byte]
  *
  * A simple file has exactly one chunk, "VP8 " (lossy) or "VP8L"
  * (lossless).  An extended file starts with "VP8X", whose feature flags
  * say what else to expect: "ICCP", "ALPH", "ANIM"/"ANMF", "EXIF" and
  * "XMP ".
  *
  * The AVI plugin ("riff") also opens RIFF files, so this one insists on
  * the "WEBP" form type; the two never claim the same file.
  */
 #include "platform.h"
 #include "extractor.h"
 #include "forensics.h"
 
 
 /**
  * Maximum number of top level chunks we look at.
  */
 #define WEBP_MAX_CHUNKS 1024
 
 /**
  * Maximum number of animation frames we walk.  The frame count we
  * report is the number we actually saw, so this caps the reported
  * value too, which is what a characterisation pass wants.
  */
 #define WEBP_MAX_FRAMES 512
 
 /**
  * Total number of bytes we are willing to read from one file.
  */
 #define WEBP_READ_BUDGET (128 * 1024)
 
 /* VP8X feature flags, in the single flag byte at the start of the
    "VP8X" payload.  Bit 0 (0x80) and bit 1 (0x40) are reserved. */
 #define WEBP_FLAG_ICC 0x20
 #define WEBP_FLAG_ALPHA 0x10
 #define WEBP_FLAG_EXIF 0x08
 #define WEBP_FLAG_XMP 0x04
 #define WEBP_FLAG_ANIMATION 0x02
 
 
 /**
  * Everything we learn while walking the chunks.
  */
 struct WebpState
 {
   /**
    * Extraction context we were handed.
    */
   struct EXTRACTOR_ExtractContext *ec;
 
   /**
    * Bytes we may still read.
    */
   uint64_t budget;
 
   /**
    * Canvas width in pixels, 0 if unknown.
    */
   uint32_t width;
 
   /**
    * Canvas height in pixels, 0 if unknown.
    */
   uint32_t height;
 
   /**
    * Size of the ICC profile in bytes, 0 if there is none.
    */
   uint64_t icc_size;
 
   /**
    * Sum of the frame durations in milliseconds.
    */
   uint64_t duration;
 
   /**
    * Number of "ANMF" frames seen.
    */
   unsigned int frames;
 
   /**
    * Loop count from "ANIM", 0 meaning "forever".
    */
   unsigned int loop_count;
 
   /**
    * Background colour from "ANIM", as BGRA.
    */
   uint32_t background;
 
   /**
    * Feature flags from "VP8X".
    */
   unsigned char flags;
 
   /**
    * True if a "VP8X" chunk was seen.
    */
   int extended;
 
   /**
    * True if an "ANIM" chunk was seen.
    */
   int animated;
 
   /**
    * True if lossy VP8 data was seen.
    */
   int lossy;
 
   /**
    * True if lossless VP8L data was seen.
    */
   int lossless;
 
   /**
    * True if an "ALPH" chunk or a VP8L alpha flag was seen.
    */
   int alpha;
 
   /**
    * True if an "EXIF" chunk was seen.
    */
   int exif;
 
   /**
    * True if an "XMP " chunk was seen.
    */
   int xmp;
 };
 
 
 /**
  * Read @a len bytes at @a offset, charged against the read budget.
  *
  * @param ws parser state
  * @param offset absolute offset to read from
  * @param buf where to put the data
  * @param len number of bytes to read
  * @return 1 on success, 0 on a short file or an exhausted budget
  */
 static int
 webp_read (struct WebpState *ws,
            uint64_t offset,
            void *buf,
            size_t len)
 {
   if ( (len > ws->budget) ||
        (offset > INT64_MAX) )
     return 0;
   ws->budget -= len;
   return EXTRACTOR_forensic_read_ (ws->ec,
                                    (int64_t) offset,
                                    buf,
                                    len);
 }
 
 
 /**
  * Read a 24-bit little-endian value.
  *
  * @param p three bytes
  * @return the value
  */
 static uint32_t
 webp_le24 (const unsigned char *p)
 {
   return ((uint32_t) p[0])
          | (((uint32_t) p[1]) << 8)
          | (((uint32_t) p[2]) << 16);
 }
 
 
 /**
  * Pull the canvas size out of a lossy "VP8 " key frame header.
  *
  * The payload starts with a three byte frame tag, then the three byte
  * start code 0x9d 0x01 0x2a, then two 16-bit little-endian values whose
  * low 14 bits are the width and the height; the top two bits of each
  * are an upscaling hint that does not change the coded size.
  *
  * @param ws parser state
  * @param payload absolute offset of the chunk payload
  * @param len length of the chunk payload
  */
 static void
 webp_parse_vp8 (struct WebpState *ws,
                 uint64_t payload,
                 uint64_t len)
 {
   unsigned char buf[10];
 
   ws->lossy = 1;
   if (len < 10)
     return;
   if (! webp_read (ws,
                    payload,
                    buf,
                    sizeof (buf)))
     return;
   if (0 != (buf[0] & 0x01))
     return;   /* not a key frame; no size here */
   if ( (0x9d != buf[3]) ||
        (0x01 != buf[4]) ||
        (0x2a != buf[5]) )
     return;   /* start code missing */
   ws->width = EXTRACTOR_forensic_le16_ (&buf[6]) & 0x3FFF;
   ws->height = EXTRACTOR_forensic_le16_ (&buf[8]) & 0x3FFF;
 }
 
 
 /**
  * Pull the canvas size out of a lossless "VP8L" header.
  *
  * The payload starts with the signature byte 0x2f followed by a 32-bit
  * little-endian word packing (width - 1) in bits 0..13, (height - 1) in
  * bits 14..27, an alpha hint in bit 28 and the version in bits 29..31.
  *
  * @param ws parser state
  * @param payload absolute offset of the chunk payload
  * @param len length of the chunk payload
  */
 static void
 webp_parse_vp8l (struct WebpState *ws,
                  uint64_t payload,
                  uint64_t len)
 {
   unsigned char buf[5];
   uint32_t bits;
 
   ws->lossless = 1;
   if (len < 5)
     return;
   if (! webp_read (ws,
                    payload,
                    buf,
                    sizeof (buf)))
     return;
   if (0x2f != buf[0])
     return;   /* signature missing */
   bits = EXTRACTOR_forensic_le32_ (&buf[1]);
   ws->width = (bits & 0x3FFF) + 1;
   ws->height = ((bits >> 14) & 0x3FFF) + 1;
   if (0 != ((bits >> 28) & 0x01))
     ws->alpha = 1;
 }
 
 
 /**
  * Parse the "VP8X" extended header: the feature flags and the canvas
  * size, which are stored as 24-bit values one less than the real size.
  *
  * @param ws parser state
  * @param payload absolute offset of the chunk payload
  * @param len length of the chunk payload
  */
 static void
 webp_parse_vp8x (struct WebpState *ws,
                  uint64_t payload,
                  uint64_t len)
 {
   unsigned char buf[10];
 
   ws->extended = 1;
   if (len < 10)
     return;
   if (! webp_read (ws,
                    payload,
                    buf,
                    sizeof (buf)))
     return;
   ws->flags = buf[0];
   ws->width = webp_le24 (&buf[4]) + 1;
   ws->height = webp_le24 (&buf[7]) + 1;
   if (0 != (ws->flags & WEBP_FLAG_ALPHA))
     ws->alpha = 1;
 }
 
 
 /**
  * Parse an "ANIM" global animation header.
  *
  * @param ws parser state
  * @param payload absolute offset of the chunk payload
  * @param len length of the chunk payload
  */
 static void
 webp_parse_anim (struct WebpState *ws,
                  uint64_t payload,
                  uint64_t len)
 {
   unsigned char buf[6];
 
   ws->animated = 1;
   if (len < 6)
     return;
   if (! webp_read (ws,
                    payload,
                    buf,
                    sizeof (buf)))
     return;
   ws->background = EXTRACTOR_forensic_le32_ (buf);
   ws->loop_count = EXTRACTOR_forensic_le16_ (&buf[4]);
 }
 
 
 /**
  * Parse an "ANMF" frame header, and look inside the frame for the
  * sub-chunk that says how it is coded.  The frame duration is a 24-bit
  * value in milliseconds.
  *
  * @param ws parser state
  * @param payload absolute offset of the chunk payload
  * @param len length of the chunk payload
  */
 static void
 webp_parse_anmf (struct WebpState *ws,
                  uint64_t payload,
                  uint64_t len)
 {
   unsigned char buf[16];
 
   if (ws->frames >= WEBP_MAX_FRAMES)
     return;
   ws->frames++;
   if (len < 16)
     return;
   if (! webp_read (ws,
                    payload,
                    buf,
                    sizeof (buf)))
     return;
   ws->duration += webp_le24 (&buf[12]);
   /* The frame payload holds an optional "ALPH" chunk and then one
      "VP8 " or "VP8L" chunk; peek at the first one only, so that an
      extended file still reports a codec. */
   if ( (0 != ws->lossy) ||
        (0 != ws->lossless) ||
        (len < 24) )
     return;
   if (! webp_read (ws,
                    payload + 16,
                    buf,
                    8))
     return;
   if (0 == memcmp (buf,
                    "ALPH",
                    4))
   {
     ws->alpha = 1;
     return;
   }
   if (0 == memcmp (buf,
                    "VP8 ",
                    4))
     ws->lossy = 1;
   else if (0 == memcmp (buf,
                         "VP8L",
                         4))
     ws->lossless = 1;
 }
 
 
 /**
  * Append @a name to the comma separated list in @a buf, if @a present.
  *
  * @param buf the list being built, always NUL terminated
  * @param size number of bytes in @a buf
  * @param[in,out] off current length of the list
  * @param present whether the feature is there at all
  * @param name what to append
  */
 static void
 webp_append (char *buf,
              size_t size,
              size_t *off,
              int present,
              const char *name)
 {
   size_t need;
 
   if (! present)
     return;
   need = strlen (name) + ((0 != *off) ? 2 : 0);
   if (*off + need + 1 > size)
     return;
   if (0 != *off)
   {
     buf[(*off)++] = ',';
     buf[(*off)++] = ' ';
   }
   memcpy (&buf[*off],
           name,
           strlen (name));
   *off += strlen (name);
   buf[*off] = '\0';
 }
 
 
 /**
  * Main entry method for the 'image/webp' extraction plugin.
  *
  * @param ec extraction context provided to the plugin
  */
 void
 EXTRACTOR_webp_extract_method (struct EXTRACTOR_ExtractContext *ec);
 
 void
 EXTRACTOR_webp_extract_method (struct EXTRACTOR_ExtractContext *ec)
 {
   struct WebpState ws;
   unsigned char head[12];
   uint64_t fsize;
   uint64_t riff_end;
   uint64_t pos;
   uint32_t riff_size;
   char attrs[256];
   size_t aoff = 0;
 
   fsize = ec->get_size (ec->cls);
   if ( (UINT64_MAX == fsize) ||
        (fsize < 12) )
     return;
   memset (&ws,
           0,
           sizeof (ws));
   ws.ec = ec;
   ws.budget = WEBP_READ_BUDGET;
 
   /* Twelve bytes decide it; a file that is not ours costs nothing more
      than this one read. */
   if (! webp_read (&ws,
                    0,
                    head,
                    sizeof (head)))
     return;
   if ( (0 != memcmp (head,
                      "RIFF",
                      4)) ||
        (0 != memcmp (&head[8],
                      "WEBP",
                      4)) )
     return;
   riff_size = EXTRACTOR_forensic_le32_ (&head[4]);
   /* The RIFF size counts everything after the eight byte RIFF header;
      trust the file only as far as its actual length. */
   riff_end = (uint64_t) riff_size + 8;
   if (riff_end > fsize)
     riff_end = fsize;
 
   pos = 12;
   for (unsigned int n = 0;
        (n < WEBP_MAX_CHUNKS) && (pos + 8 <= riff_end);
        n++)
   {
     unsigned char chdr[8];
     uint64_t csize;
     uint64_t payload;
     uint64_t advance;
 
     if (! webp_read (&ws,
                      pos,
                      chdr,
                      sizeof (chdr)))
       break;
     csize = EXTRACTOR_forensic_le32_ (&chdr[4]);
     payload = pos + 8;
     if (csize > riff_end - payload)
       csize = riff_end - payload;   /* truncated file; use what is there */
     if (0 == memcmp (chdr,
                      "VP8X",
                      4))
       webp_parse_vp8x (&ws,
                        payload,
                        csize);
     else if (0 == memcmp (chdr,
                           "VP8 ",
                           4))
       webp_parse_vp8 (&ws,
                       payload,
                       csize);
     else if (0 == memcmp (chdr,
                           "VP8L",
                           4))
       webp_parse_vp8l (&ws,
                        payload,
                        csize);
     else if (0 == memcmp (chdr,
                           "ANIM",
                           4))
       webp_parse_anim (&ws,
                        payload,
                        csize);
     else if (0 == memcmp (chdr,
                           "ANMF",
                           4))
       webp_parse_anmf (&ws,
                        payload,
                        csize);
     else if (0 == memcmp (chdr,
                           "ALPH",
                           4))
       ws.alpha = 1;
     else if (0 == memcmp (chdr,
                           "ICCP",
                           4))
       ws.icc_size = csize;
     else if (0 == memcmp (chdr,
                           "EXIF",
                           4))
       ws.exif = 1;
     else if (0 == memcmp (chdr,
                           "XMP ",
                           4))
       ws.xmp = 1;
     /* Chunks are padded to an even length.  The eight byte header
        guarantees forward progress even for a zero length chunk. */
     advance = 8 + csize + (csize & 1);
     if (advance < 8)
       break;
     pos += advance;
   }
 
   if (0 != ec->proc (ec->cls,
                      "webp",
                      EXTRACTOR_METATYPE_MIMETYPE,
                      EXTRACTOR_METAFORMAT_UTF8,
                      "text/plain",
                      "image/webp",
                      strlen ("image/webp") + 1))
     return;
   if (0 != EXTRACTOR_forensic_emit_ (ec,
                                      "webp",
                                      EXTRACTOR_METATYPE_FORMAT,
                                      "WebP (%s)",
                                      ws.extended
                                      ? "extended"
                                      : (ws.lossless ? "lossless" : "lossy")))
     return;
   if ( (ws.lossy) ||
        (ws.lossless) )
   {
     if (0 != EXTRACTOR_forensic_emit_ (ec,
                                        "webp",
                                        EXTRACTOR_METATYPE_CODEC,
                                        "%s",
                                        ws.lossless
                                        ? "VP8L (lossless)"
                                        : "VP8 (lossy)"))
       return;
   }
   if ( (0 != ws.width) &&
        (0 != ws.height) )
   {
     if (0 != EXTRACTOR_forensic_emit_ (ec,
                                        "webp",
                                        EXTRACTOR_METATYPE_IMAGE_DIMENSIONS,
                                        "%ux%u",
                                        (unsigned int) ws.width,
                                        (unsigned int) ws.height))
       return;
   }
   /* One ATTRIBUTES line naming the optional features, so that a caller
      can filter on "has an alpha channel" or "is animated" without
      having to reason about the flag byte. */
   attrs[0] = '\0';
   webp_append (attrs,
                sizeof (attrs),
                &aoff,
                ws.alpha,
                "alpha");
   webp_append (attrs,
                sizeof (attrs),
                &aoff,
                ws.animated,
                "animation");
   webp_append (attrs,
                sizeof (attrs),
                &aoff,
                0 != ws.icc_size,
                "ICC profile");
   webp_append (attrs,
                sizeof (attrs),
                &aoff,
                ws.exif,
                "EXIF");
   webp_append (attrs,
                sizeof (attrs),
                &aoff,
                ws.xmp,
                "XMP");
   if (0 != aoff)
   {
     if (0 != EXTRACTOR_forensic_emit_ (ec,
                                        "webp",
                                        EXTRACTOR_METATYPE_ATTRIBUTES,
                                        "%s",
                                        attrs))
       return;
   }
   /* WebP has no depth field of its own: both bitstreams are 8 bits per
      channel by definition.  Report the bare number so that a caller can
      compare it with what the other image plugins report; whether there
      is an alpha channel is an attribute, not a depth. */
   if (0 != EXTRACTOR_forensic_emit_ (ec,
                                      "webp",
                                      EXTRACTOR_METATYPE_COLOR_DEPTH,
                                      "8"))
     return;
   if (0 != ws.icc_size)
   {
     /* Not parsed here on purpose: the ICC payload is the exiv2 and
        colour management plugins' business. */
     if (0 != EXTRACTOR_forensic_emit_ (ec,
                                        "webp",
                                        EXTRACTOR_METATYPE_COLOR_PROFILE,
                                        "ICC profile, %llu bytes",
                                        (unsigned long long) ws.icc_size))
       return;
   }
   if (ws.animated)
   {
     if (0 != EXTRACTOR_forensic_emit_ (ec,
                                        "webp",
                                        EXTRACTOR_METATYPE_ENTRY_COUNT,
                                        "%u",
                                        ws.frames))
       return;
     if (0 != EXTRACTOR_forensic_emit_ (ec,
                                        "webp",
                                        EXTRACTOR_METATYPE_DURATION,
                                        "%llu ms",
                                        (unsigned long long) ws.duration))
       return;
     if (0 != EXTRACTOR_forensic_emit_ (ec,
                                        "webp",
                                        EXTRACTOR_METATYPE_COMMENT,
                                        "animation: %u frame%s, %s, "
                                        "background #%08x BGRA",
                                        ws.frames,
                                        (1 == ws.frames) ? "" : "s",
                                        (0 == ws.loop_count)
                                        ? "looping forever"
                                        : "finite loop count",
                                        (unsigned int) ws.background))
       return;
   }
   if (ws.exif)
   {
     if (0 != EXTRACTOR_forensic_emit_ (ec,
                                        "webp",
                                        EXTRACTOR_METATYPE_COMMENT,
                                        "contains an EXIF chunk"))
       return;
   }
   if (ws.xmp)
   {
     if (0 != EXTRACTOR_forensic_emit_ (ec,
                                        "webp",
                                        EXTRACTOR_METATYPE_COMMENT,
                                        "contains an XMP chunk"))
       return;
   }
 }
 
 
 /* end of webp_extractor.c */