Merge branch 'feat/jpeg_eco5_v5.4' into 'release/v5.4'

feat(jpeg): Add yuv444 yuv420 format support for encoder on esp32p4 eco5 , Add check for jpeg marker parser in order to enhance safety (backport v5.4)

See merge request espressif/esp-idf!42669

components/esp_driver_jpeg/include/driver/jpeg_types.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -8,6 +8,8 @@
 
 #include <stdint.h>
 #include "hal/color_types.h"
+#include "sdkconfig.h"
+#include "soc/soc_caps.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -57,6 +59,10 @@ typedef enum {
     JPEG_ENCODE_IN_FORMAT_RGB565 = COLOR_TYPE_ID(COLOR_SPACE_RGB, COLOR_PIXEL_RGB565),       /*!< input RGB565 format */
     JPEG_ENCODE_IN_FORMAT_GRAY = COLOR_TYPE_ID(COLOR_SPACE_GRAY, COLOR_PIXEL_GRAY8),         /*!< input GRAY format */
     JPEG_ENCODE_IN_FORMAT_YUV422 = COLOR_TYPE_ID(COLOR_SPACE_YUV, COLOR_PIXEL_YUV422),       /*!< input YUV422 format */
+#if !(CONFIG_ESP_REV_MIN_FULL < 300 && CONFIG_IDF_TARGET_ESP32P4) // Invisible for unsupported chips
+    JPEG_ENCODE_IN_FORMAT_YUV444 = COLOR_TYPE_ID(COLOR_SPACE_YUV, COLOR_PIXEL_YUV444),       /*!< input YUV444 format */
+    JPEG_ENCODE_IN_FORMAT_YUV420 = COLOR_TYPE_ID(COLOR_SPACE_YUV, COLOR_PIXEL_YUV420),       /*!< input YUV420 format */
+#endif
 } jpeg_enc_input_format_t;
 
 /**

components/esp_driver_jpeg/jpeg_encode.c

@@ -183,6 +183,16 @@ esp_err_t jpeg_encoder_process(jpeg_encoder_handle_t encoder_engine, const jpeg_
         encoder_engine->color_space = JPEG_ENC_SRC_YUV422;
         best_hb_idx = JPEG_ENC_SRC_YUV422_HB;
         break;
+#if !(CONFIG_ESP_REV_MIN_FULL < 300 && CONFIG_IDF_TARGET_ESP32P4)
+    case JPEG_ENCODE_IN_FORMAT_YUV444:
+        encoder_engine->color_space = JPEG_ENC_SRC_YUV444;
+        best_hb_idx = JPEG_ENC_SRC_YUV444_HB;
+        break;
+    case JPEG_ENCODE_IN_FORMAT_YUV420:
+        encoder_engine->color_space = JPEG_ENC_SRC_YUV420;
+        best_hb_idx = JPEG_ENC_SRC_YUV420_HB;
+        break;
+#endif
     default:
         ESP_LOGE(TAG, "wrong, we don't support encode from such format.");
         ret = ESP_ERR_NOT_SUPPORTED;

components/esp_driver_jpeg/jpeg_param.c

@@ -57,7 +57,9 @@ const uint32_t enc_hb_tbl[JPEG_ENC_BEST_HB_MAX][JPEG_DOWN_SAMPLING_NUM] = {
     {40, 32, 32, 0},
     {0,  64, 0,  0},
     {64, 64, 48, 0},
-    {0,  0,  0,  128}
+    {0,  0,  0,  128},
+    {40,  0,  0,  0},
+    {0,  0,  48,  0},
 };
 
 /**

components/esp_driver_jpeg/jpeg_parse_marker.c

@@ -20,6 +20,11 @@ static const char *TAG = "jpeg.decoder";
 
 static uint8_t jpeg_get_char(jpeg_dec_header_info_t *header_info)
 {
+    // Check if there are bytes left to read before decrementing buffer_left
+    if (header_info->buffer_left == 0) {
+        ESP_LOGE(TAG, "Buffer underflow detected in jpeg_get_char: no more bytes left to read");
+        return 0;
+    }
     uint8_t c = header_info->buffer_offset[0];
     header_info->buffer_offset++;
     header_info->header_size++;
@@ -39,20 +44,26 @@ uint32_t jpeg_get_bytes(jpeg_dec_header_info_t *header_info, uint8_t num_bytes)
 
 esp_err_t jpeg_parse_appn_marker(jpeg_dec_header_info_t *header_info)
 {
-    uint32_t skip_num = jpeg_get_bytes(header_info, 2);
+    uint16_t skip_num = jpeg_get_bytes(header_info, 2);
-    header_info->buffer_offset += (skip_num - 2);
+    ESP_RETURN_ON_FALSE(skip_num >= 2, ESP_ERR_INVALID_ARG, TAG, "Invalid APPn marker length: %d", skip_num);
-    header_info->header_size += (skip_num - 2);
+    uint16_t bytes_to_skip = skip_num - 2;
-    header_info->buffer_left -= (skip_num - 2);
+    ESP_RETURN_ON_FALSE(header_info->buffer_left >= bytes_to_skip, ESP_ERR_INVALID_ARG, TAG, "APPn marker data underflow for buffer_left");
+    header_info->buffer_offset += bytes_to_skip;
+    header_info->header_size += bytes_to_skip;
+    header_info->buffer_left -= bytes_to_skip;
 
     return ESP_OK;
 }
 
 esp_err_t jpeg_parse_com_marker(jpeg_dec_header_info_t *header_info)
 {
-    uint32_t skip_num = jpeg_get_bytes(header_info, 2);
+    uint16_t skip_num = jpeg_get_bytes(header_info, 2);
-    header_info->buffer_offset += (skip_num - 2);
+    ESP_RETURN_ON_FALSE(skip_num >= 2, ESP_ERR_INVALID_ARG, TAG, "Invalid COM marker length: %d", skip_num);
-    header_info->header_size += (skip_num - 2);
+    uint32_t bytes_to_skip = skip_num - 2;
-    header_info->buffer_left -= (skip_num - 2);
+    ESP_RETURN_ON_FALSE(header_info->header_size >= bytes_to_skip, ESP_ERR_INVALID_ARG, TAG, "COM marker data underflow for header_size");
+    header_info->buffer_offset += bytes_to_skip;
+    header_info->header_size += bytes_to_skip;
+    header_info->buffer_left -= bytes_to_skip;
     return ESP_OK;
 }
 
@@ -61,21 +72,25 @@ esp_err_t jpeg_parse_dqt_marker(jpeg_dec_header_info_t *header_info)
     uint32_t n = 0, i = 0, prec = 0;
     uint32_t temp = 0;
 
-    uint32_t length_num = jpeg_get_bytes(header_info, 2);
+    uint16_t length_num = jpeg_get_bytes(header_info, 2);
+    ESP_RETURN_ON_FALSE(length_num >= 2, ESP_ERR_INVALID_ARG, TAG, "Invalid DQT marker length: %d", length_num);
     length_num -= 2;
 
     while (length_num) {
         n = jpeg_get_bytes(header_info, 1);
         prec = n >> 4;
         n &= 0x0F;
+        ESP_RETURN_ON_FALSE(length_num >= 1, ESP_ERR_INVALID_ARG, TAG, "DQT marker length error: %d", length_num);
         length_num -= 1;
 
         // read quantization entries, in zig-zag order
         for (i = 0; i < 64; i++) {
             temp = jpeg_get_bytes(header_info, 1);
+            ESP_RETURN_ON_FALSE(length_num >= 1, ESP_ERR_INVALID_ARG, TAG, "DQT marker length error: %d", length_num);
             length_num -= 1;
             if (prec) {
                 temp = (temp << 8) + jpeg_get_bytes(header_info, 1);
+                ESP_RETURN_ON_FALSE(length_num >= 1, ESP_ERR_INVALID_ARG, TAG, "DQT marker length error: %d", length_num);
                 length_num -= 1;
             }
             header_info->qt_tbl[n][zigzag_arr[i]] = temp;
@@ -142,7 +157,10 @@ esp_err_t jpeg_parse_sof_marker(jpeg_dec_header_info_t *header_info)
 esp_err_t jpeg_parse_dht_marker(jpeg_dec_header_info_t *header_info)
 {
     // Recording num_left in DHT sector, not including length bytes (2 bytes).
-    uint32_t num_left = jpeg_get_bytes(header_info, 2) - 2;
+    uint16_t raw_length = jpeg_get_bytes(header_info, 2);
+    // Check for integer underflow before subtraction
+    ESP_RETURN_ON_FALSE(raw_length >= 2, ESP_ERR_INVALID_ARG, TAG, "Invalid DHT marker length: %d", raw_length);
+    uint16_t num_left = raw_length - 2;
     while (num_left) {
         uint32_t np = 0;
 
@@ -159,6 +177,8 @@ esp_err_t jpeg_parse_dht_marker(jpeg_dec_header_info_t *header_info)
             header_info->huffcode[header_info->huffinfo.type][header_info->huffinfo.id][i] = jpeg_get_bytes(header_info, 1);
         }
 
+        // Check for integer underflow before subtraction
+        ESP_RETURN_ON_FALSE(num_left >= (JPEG_HUFFMAN_BITS_LEN_TABLE_LEN + np + 1), ESP_ERR_INVALID_ARG, TAG, "DHT marker data underflow after parsing huffcode: %d", num_left);
         num_left -= (1 + JPEG_HUFFMAN_BITS_LEN_TABLE_LEN + np);
     }
 
@@ -181,6 +201,7 @@ esp_err_t jpeg_parse_dri_marker(jpeg_dec_header_info_t *header_info)
 esp_err_t jpeg_parse_sos_marker(jpeg_dec_header_info_t *header_info)
 {
     // Got the SOS marker, but need to recover this and feed to 2DDMA.
+    ESP_RETURN_ON_FALSE(header_info->header_size >= 2, ESP_ERR_INVALID_ARG, TAG, "SOS marker header_size underflow");
     header_info->buffer_offset -= 2;
     header_info->header_size -= 2;
     header_info->buffer_left += 2;
@@ -191,6 +212,7 @@ esp_err_t jpeg_parse_inv_marker(jpeg_dec_header_info_t *header_info)
 {
     // Got invalid 0xFFFF, (followed by a valid marker type)
     // Go one byte back, to skip the first 0xFF
+    ESP_RETURN_ON_FALSE(header_info->header_size >= 1, ESP_ERR_INVALID_ARG, TAG, "INV marker header_size underflow");
     header_info->buffer_offset--;
     header_info->header_size--;
     header_info->buffer_left++;

components/esp_driver_jpeg/jpeg_private.h

@@ -131,6 +131,8 @@ typedef enum {
     JPEG_ENC_SRC_YUV422_HB = 1,       // Input YUV422 format
     JPEG_ENC_SRC_RGB565_HB = 2,      // Input RGB565 format
     JPEG_ENC_SRC_GRAY_HB = 3,        // Input GRAY format
+    JPEG_ENC_SRC_YUV444_HB = 4,      // Input YUV444 format
+    JPEG_ENC_SRC_YUV420_HB = 5,      // Input YUV420 format
     JPEG_ENC_BEST_HB_MAX,
 } jpeg_enc_format_hb_t;
 

components/hal/esp32p4/include/hal/jpeg_ll.h

@@ -14,6 +14,7 @@
 #include "soc/jpeg_struct.h"
 #include "hal/jpeg_types.h"
 #include "soc/hp_sys_clkrst_struct.h"
+#include "hal/config.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -635,6 +636,11 @@ static inline uint32_t jpeg_ll_get_intr_status(jpeg_dev_t *hw)
 static inline void jpeg_ll_config_picture_pixel_format(jpeg_dev_t *hw, jpeg_enc_src_type_t pixel_format)
 {
     uint8_t cs = 0;
+#if HAL_CONFIG(CHIP_SUPPORT_MIN_REV) >= 300
+    uint8_t ecs = 0;
+    // Default, we disable extend color space
+    hw->extd_config.extd_color_space_en = 0;
+#endif
     switch (pixel_format) {
     case JPEG_ENC_SRC_RGB888:
         cs = 0;
@@ -648,10 +654,23 @@ static inline void jpeg_ll_config_picture_pixel_format(jpeg_dev_t *hw, jpeg_enc_
     case JPEG_ENC_SRC_GRAY:
         cs = 3;
         break;
+#if HAL_CONFIG(CHIP_SUPPORT_MIN_REV) >= 300
+    case JPEG_ENC_SRC_YUV444:
+        hw->extd_config.extd_color_space_en = 1;
+        ecs = 0;
+        break;
+    case JPEG_ENC_SRC_YUV420:
+        hw->extd_config.extd_color_space_en = 1;
+        ecs = 1;
+        break;
+#endif
     default:
         abort();
     }
     hw->config.color_space = cs;
+#if HAL_CONFIG(CHIP_SUPPORT_MIN_REV) >= 300
+    hw->extd_config.extd_color_space = ecs;
+#endif
 }
 
 #ifdef __cplusplus

components/hal/include/hal/jpeg_types.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -78,6 +78,8 @@ typedef enum {
     JPEG_ENC_SRC_RGB888 = COLOR_TYPE_ID(COLOR_SPACE_RGB, COLOR_PIXEL_RGB888),   /*!< JPEG encoder source RGB888 */
     JPEG_ENC_SRC_YUV422 = COLOR_TYPE_ID(COLOR_SPACE_YUV, COLOR_PIXEL_YUV422),   /*!< JPEG encoder source YUV422 */
     JPEG_ENC_SRC_RGB565 = COLOR_TYPE_ID(COLOR_SPACE_RGB, COLOR_PIXEL_RGB565),   /*!< JPEG encoder source RGB565 */
+    JPEG_ENC_SRC_YUV444 = COLOR_TYPE_ID(COLOR_SPACE_YUV, COLOR_PIXEL_YUV444),   /*!< JPEG encoder source YUV444 */
+    JPEG_ENC_SRC_YUV420 = COLOR_TYPE_ID(COLOR_SPACE_YUV, COLOR_PIXEL_YUV420),   /*!< JPEG encoder source YUV420 */
     JPEG_ENC_SRC_GRAY = COLOR_TYPE_ID(COLOR_SPACE_GRAY, COLOR_PIXEL_GRAY8),     /*!< JPEG encoder source GRAY */
 } jpeg_enc_src_type_t;
 

components/soc/esp32p4/register/hw_ver3/soc/jpeg_struct.h

@@ -164,6 +164,29 @@ typedef union {
     uint32_t val;
 } jpeg_pic_size_reg_t;
 
+/** Type of extd_config register
+ *  Control and configuration registers
+ */
+typedef union {
+    struct {
+        /** extd_color_space_en : R/W; bitpos: [0]; default: 0;
+         *  Configure whether to extend picture's color space
+         *  0:disable
+         *  1:enable
+         */
+        uint32_t extd_color_space_en:1;
+        /** extd_color_space : R/W; bitpos: [1]; default: 0;
+         *  Configure extended picture's color space. Valid when JPEG_EXTD_COLOR_SPACE_EN
+         *  configured to 1
+         *  0:yuv444
+         *  1:yuv420
+         */
+        uint32_t extd_color_space:1;
+        uint32_t reserved_2:30;
+    };
+    uint32_t val;
+} jpeg_extd_config_reg_t;
+
 /** Type of t0qnr register
  *  Control and configuration registers
  */
@@ -1390,7 +1413,7 @@ typedef union {
  */
 typedef union {
     struct {
-        /** jpeg_ver : R/W; bitpos: [27:0]; default: 34673040;
+        /** jpeg_ver : R/W; bitpos: [27:0]; default: 37823072;
          *  Reserved
          */
         uint32_t jpeg_ver:28;
@@ -1404,7 +1427,7 @@ typedef struct jpeg_dev_t {
     volatile jpeg_config_reg_t config;
     volatile jpeg_dqt_info_reg_t dqt_info;
     volatile jpeg_pic_size_reg_t pic_size;
-    uint32_t reserved_00c;
+    volatile jpeg_extd_config_reg_t extd_config;
     volatile jpeg_t0qnr_reg_t t0qnr;
     volatile jpeg_t1qnr_reg_t t1qnr;
     volatile jpeg_t2qnr_reg_t t2qnr;