| // Copyright 2026 Google LLC |
| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // https://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| // |
| |
| #include "formats/png/extractor.h" |
| |
| #include <sys/types.h> |
| |
| #include <algorithm> |
| #include <cstdint> |
| #include <optional> |
| #include <string> |
| #include <utility> |
| #include <vector> |
| |
| #include "absl/status/status.h" |
| #include "absl/status/status_macros.h" |
| #include "absl/status/statusor.h" |
| #include "absl/strings/str_cat.h" |
| #include "absl/strings/string_view.h" |
| #include "absl/strings/substitute.h" |
| #include "constants/labels.h" |
| #include "formats/asset_box.h" |
| #include "formats/byte_range.h" |
| #include "formats/png/constants.h" |
| #include "formats/png/crc.h" |
| #include "formats/png/reader.h" |
| #include "jumbf/utils.h" |
| #include "riegeli/bytes/reader.h" |
| #include "riegeli/endian/endian_reading.h" |
| |
| namespace credentio { |
| |
| namespace { |
| constexpr uint64_t kMaxPayloadSize = 1024 * 1024 * 10; // 10 MiB |
| |
| absl::StatusOr<std::string> ValidateCrcAndReturnPayload(riegeli::Reader& input, |
| PngChunk chunk, |
| int64_t end_offset) { |
| if (chunk.data_length > kMaxPayloadSize) { |
| return absl::InvalidArgumentError( |
| absl::Substitute("PNG C2PA chunk is too large to extract ($0 > $1)", |
| chunk.data_length, kMaxPayloadSize)); |
| } |
| |
| std::string payload; |
| if (!input.Read(chunk.data_length, payload)) { |
| return input.StatusOrAnnotate( |
| absl::DataLossError("Failed to read payload")); |
| } |
| |
| uint32_t extracted_crc; |
| if (!riegeli::ReadBigEndian<uint32_t>(input, extracted_crc)) { |
| return input.StatusOrAnnotate(absl::DataLossError("Failed to read CRC")); |
| } |
| |
| uint32_t computed_crc = PngChunkCrc(chunk.type, payload); |
| if (extracted_crc != computed_crc) { |
| return absl::InvalidArgumentError( |
| absl::Substitute("chunk CRC 0x$0 does not match computed CRC 0x$1", |
| absl::Hex(extracted_crc), absl::Hex(computed_crc))); |
| } |
| |
| return std::move(payload); |
| } |
| |
| absl::Status ValidateAssetSize(riegeli::Reader& input, int64_t end_offset) { |
| int64_t asset_size = |
| (end_offset < 0 ? input.Size().value_or(input.pos()) : end_offset) - |
| input.pos(); |
| if (asset_size < kPngMinimumAssetSize) { |
| // The asset is too small, we can't possibly have a manifest store. |
| return absl::NotFoundError("No manifest store found"); |
| } |
| return absl::OkStatus(); |
| } |
| |
| absl::Status ValidateWithinAssetWindow(const PngChunk& chunk, |
| int64_t end_offset) { |
| // If we are iterating over the entire asset, return early. |
| if (end_offset < 0) { |
| return absl::OkStatus(); |
| } |
| |
| if (chunk.type == "c2pa.after") { |
| return chunk.offset >= end_offset ? absl::AbortedError("asset-window-end") |
| : absl::OkStatus(); |
| } |
| |
| if (chunk.offset >= end_offset) { |
| // Chunk starts at or past the end of the asset window, early return. |
| return absl::AbortedError("asset-window-end"); |
| } |
| |
| if (chunk.offset + chunk.length > end_offset) { |
| // Chunk starts within the asset window, but extends beyond, return error. |
| return absl::InvalidArgumentError( |
| "PNG chunk extends beyond the end of the file"); |
| } |
| |
| // Chunk starts within the asset window and does not extend beyond it. |
| return absl::OkStatus(); |
| } |
| |
| } // namespace |
| |
| absl::StatusOr<std::string> PngExtractor::ExtractManifestStore( |
| riegeli::Reader& input) const { |
| std::optional<std::string> result = std::nullopt; |
| absl::Status iteration_status = IterateOverPngChunks( |
| input, [&result, &input](const PngChunk& chunk) -> absl::Status { |
| if (chunk.type != kPngChunkTypeC2pa) { |
| return absl::OkStatus(); |
| } |
| |
| if (result.has_value()) { |
| return absl::NotFoundError("Multiple manifest stores found"); |
| } |
| |
| ABSL_ASSIGN_OR_RETURN( |
| result, ValidateCrcAndReturnPayload(input, chunk, |
| input.Size().value_or(0))); |
| return absl::OkStatus(); |
| }); |
| ABSL_RETURN_IF_ERROR(iteration_status); |
| if (result.has_value()) { |
| return *result; |
| } |
| return absl::NotFoundError("No manifest store found"); |
| } |
| |
| absl::StatusOr<std::optional<ByteRange>> |
| PngExtractor::ExtractManifestStoreLocation(riegeli::Reader& input, |
| ExtractOptions options) const { |
| std::optional<ByteRange> result = std::nullopt; |
| |
| if (!ValidateAssetSize(input, options.end_offset).ok()) { |
| if (options.requires_c2pa) { |
| return absl::NotFoundError("No manifest store found"); |
| } |
| return result; |
| } |
| |
| absl::Status iteration_status = IterateOverPngChunks( |
| input, |
| [&result, &options, &input](const PngChunk& chunk) -> absl::Status { |
| ABSL_RETURN_IF_ERROR( |
| ValidateWithinAssetWindow(chunk, options.end_offset)); |
| |
| if (chunk.type != kPngChunkTypeC2pa) { |
| return absl::OkStatus(); |
| } |
| if (result.has_value()) { |
| return absl::NotFoundError("Multiple manifest stores found"); |
| } |
| |
| // Ensure the C2PA chunk is valid before using it. |
| ABSL_RETURN_IF_ERROR( |
| ValidateCrcAndReturnPayload(input, chunk, input.Size().value_or(0)) |
| .status()); |
| |
| result = {.offset = chunk.offset, .length = chunk.length}; |
| |
| return absl::OkStatus(); |
| }); |
| if (iteration_status.code() != absl::StatusCode::kAborted) { |
| // Ignore the aborted error, it means we've reached the end of the asset |
| // window in a valid manner. |
| ABSL_RETURN_IF_ERROR(iteration_status); |
| } |
| |
| if (options.requires_c2pa && !result.has_value()) { |
| return absl::NotFoundError("No manifest store found"); |
| } |
| return result; |
| } |
| |
| absl::StatusOr<std::vector<AssetBox>> PngExtractor::ExtractBoxes( |
| riegeli::Reader& input, ExtractOptions options) const { |
| std::vector<AssetBox> result; |
| |
| if (!ValidateAssetSize(input, options.end_offset).ok()) { |
| if (options.requires_c2pa) { |
| return absl::NotFoundError("No manifest store found"); |
| } |
| return result; |
| } |
| |
| int64_t c2pa_chunks_found = 0; |
| absl::Status iteration_status = IterateOverPngChunks( |
| input, |
| [&result, &options, &c2pa_chunks_found, |
| &input](const PngChunk& chunk) -> absl::Status { |
| ABSL_RETURN_IF_ERROR( |
| ValidateWithinAssetWindow(chunk, options.end_offset)); |
| |
| std::string identifier = chunk.type; |
| if (chunk.type == kPngChunkTypeC2pa) { |
| c2pa_chunks_found++; |
| identifier = "C2PA"; |
| |
| if (c2pa_chunks_found > 1) { |
| return absl::NotFoundError("Multiple manifest stores found"); |
| } |
| // Ensure the C2PA chunk is valid. |
| if (auto payload_or = |
| ValidateCrcAndReturnPayload(input, chunk, options.end_offset); |
| !payload_or.ok()) { |
| return payload_or.status(); |
| } |
| } |
| |
| uint64_t length = chunk.length; |
| if (identifier == "c2pa.after" && options.end_offset >= 0) { |
| length = std::min( |
| length, static_cast<uint64_t>(options.end_offset - chunk.offset)); |
| } |
| result.push_back(AssetBox{ |
| .identifier = std::move(identifier), |
| .byte_range = {.offset = chunk.offset, .length = length}, |
| }); |
| return absl::OkStatus(); |
| }); |
| if (iteration_status.code() != absl::StatusCode::kAborted) { |
| // Ignore the aborted error, it means we've reached the end of the asset |
| // window in a valid manner. |
| ABSL_RETURN_IF_ERROR(iteration_status); |
| } |
| if (options.requires_c2pa && c2pa_chunks_found == 0) { |
| return absl::NotFoundError("No manifest store found"); |
| } |
| return result; |
| } |
| |
| bool PngExtractor::MightBeC2paManifestStore(absl::string_view payload) const { |
| return jumbf::HasDescriptionBoxMatching(payload, kManifestStoreUuid, |
| kMinimumJumbfDescriptionToggles, |
| kManifestStoreLabel) |
| .value_or(false); |
| } |
| |
| } // namespace credentio |
