core: Clamp color values in DefineBitsJPEG3 (fix #6893)

The colors in a DefineBitsJPEG3 tag should be premultiplied alpha,
but in some SWFs they are incorrectly not premultiplied. Flash
Player clamps the color values to the alpha in this case to allow
these images to work more as expected.

Fixes #6893.
This commit is contained in:
Mike Welsh 2022-05-06 12:54:28 -07:00
parent 87ce0f56b7
commit 5730c8db94
1 changed files with 9 additions and 4 deletions

View File

@ -377,10 +377,15 @@ fn decode_jpeg(
let mut i = 0; let mut i = 0;
let mut a = 0; let mut a = 0;
while i < decoded_data.len() { while i < decoded_data.len() {
rgba.push(decoded_data[i]); // The JPEG data should be premultiplied alpha, but it isn't in some incorrect SWFs (see #6983).
rgba.push(decoded_data[i + 1]); // This means 0% alpha pixels may have color and incorrectly show as visible.
rgba.push(decoded_data[i + 2]); // Flash Player clamps color to the alpha value to fix this case.
rgba.push(alpha_data[a]); // Only applies to DefineBitsJPEG3; DefineBitsLossless does not seem to clamp.
let alpha = alpha_data[a];
rgba.push(decoded_data[i].min(alpha));
rgba.push(decoded_data[i + 1].min(alpha));
rgba.push(decoded_data[i + 2].min(alpha));
rgba.push(alpha);
i += 3; i += 3;
a += 1; a += 1;
} }