@swf2es/format 0.0.0-stage → 0.1.1

package/src/api-versions.ts

@@ -0,0 +1,27 @@
+// The API versions of avmplus' core/api-versions.h that hosts run ABCs at,
+// in one place for the compiler and the runtime, which must agree: a
+// version names a series of names, Flash Player's or AIR's, which
+// alternate, and what code of that version sees in it.
+
+/** Flash Player's latest, SWF_31: what a browser's SWFs, and avmshell's by default, run at. */
+export const API_VERSION = 50;
+
+/** AIR's latest, AIR_20_0: what an AIR host's SWFs run at. */
+export const AIR_API_VERSION = 51;
+
+/** VM_INTERNAL, which no ABC runs at: the first version past both series. */
+const API_INTERNAL = 52;
+
+/**
+ * `version` if ABCs can run at it, a version of either series, as
+ * avmshell's -api names them (1, AIR_1_0, up to AIR_API_VERSION); else a
+ * RangeError, so that the compiler, which keeps a byte, and the runtime
+ * never take two different versions for one.
+ */
+export function checkApiVersion(version: number): number {
+  if (!Number.isInteger(version) || version < 1 || version >= API_INTERNAL) {
+    throw new RangeError(`swf2es: no ABC runs at API version ${version}`);
+  }
+
+  return version;
+}

package/src/bitmap.ts

@@ -0,0 +1,259 @@
+// The SWF's bitmap tags. The lossless formats are read here to pixels; the
+// JPEG tags hold an image (a JPEG, PNG or GIF) for the player to decode,
+// with what Flash does to its bytes first already done.
+import { zlibUncompress } from "./compression.js";
+import type { Tag } from "./swf.js";
+import {
+  DefineBits,
+  DefineBitsJPEG2,
+  DefineBitsJPEG3,
+  DefineBitsJPEG4,
+  DefineBitsLossless,
+  DefineBitsLossless2,
+} from "./tags.js";
+
+export type Bitmap =
+  /** Premultiplied ARGB, row by row. */
+  | {
+      id: number;
+      type: "pixels";
+      width: number;
+      height: number;
+      transparent: boolean;
+      pixels: Uint32Array;
+    }
+  | {
+      id: number;
+      type: "image";
+      format: "jpeg" | "png" | "gif";
+      /** The file, as a decoder takes it. */
+      data: Uint8Array;
+      /** DefineBitsJPEG3's alpha, a byte a pixel, for a JPEG; null for none. */
+      alpha: Uint8Array | null;
+      /** DefineBitsJPEG4: Flash shows it opaque though it reports it transparent. */
+      opaque: boolean;
+    }
+  /** What Flash cannot read: a bitmap of 0 by 0. */
+  | { id: number; type: "invalid" };
+
+/** Whether a tag defines a bitmap. */
+export function isBitmapTag(code: number): boolean {
+  return (
+    code === DefineBits ||
+    code === DefineBitsJPEG2 ||
+    code === DefineBitsJPEG3 ||
+    code === DefineBitsJPEG4 ||
+    code === DefineBitsLossless ||
+    code === DefineBitsLossless2
+  );
+}
+
+/**
+ * A bitmap tag's character. `tables` is the JPEGTables tag's data that
+ * DefineBits needs, null if there was none.
+ */
+export function readBitmap(bytes: Uint8Array, tag: Tag, tables: Uint8Array | null): Bitmap {
+  const body = bytes.subarray(tag.offset, tag.offset + tag.length);
+  const id = body.length >= 2 ? body[0] | (body[1] << 8) : 0;
+  // Flash refuses a bitmap tag written with the short header, whatever it holds.
+  if (!tag.long || body.length < 2) {
+    return { id, type: "invalid" };
+  }
+
+  try {
+    switch (tag.code) {
+      case DefineBitsLossless:
+      case DefineBitsLossless2:
+        return lossless(id, body, tag.code === DefineBitsLossless2);
+      case DefineBits:
+        return tables ? image(id, concat(tables, body.subarray(2)), null, false) : invalid(id);
+      case DefineBitsJPEG2:
+        return image(id, body.subarray(2), null, false);
+      default: {
+        const size = u32(body, 2);
+        const start = tag.code === DefineBitsJPEG4 ? 8 : 6;
+        if (start + size > body.length) {
+          return invalid(id);
+        }
+
+        const alpha = zlibUncompress(body.subarray(start + size));
+        return image(id, body.subarray(start, start + size), alpha, tag.code === DefineBitsJPEG4);
+      }
+    }
+  } catch {
+    // Corrupt zlib data.
+    return invalid(id);
+  }
+}
+
+function invalid(id: number): Bitmap {
+  return { id, type: "invalid" };
+}
+
+function u16(b: Uint8Array, at: number): number {
+  return b[at] | (b[at + 1] << 8);
+}
+
+function u32(b: Uint8Array, at: number): number {
+  return (b[at] | (b[at + 1] << 8) | (b[at + 2] << 16) | (b[at + 3] << 24)) >>> 0;
+}
+
+function concat(a: Uint8Array, b: Uint8Array): Uint8Array {
+  const out = new Uint8Array(a.length + b.length);
+  out.set(a);
+  out.set(b, a.length);
+  return out;
+}
+
+function image(id: number, data: Uint8Array, alpha: Uint8Array | null, jpeg4: boolean): Bitmap {
+  if (data[0] === 0x89 && data[1] === 0x50 && data[2] === 0x4e && data[3] === 0x47) {
+    // A PNG or GIF keeps its own alpha; the tag's is ignored.
+    return { id, type: "image", format: "png", data, alpha: null, opaque: false };
+  }
+
+  if (data[0] === 0x47 && data[1] === 0x49 && data[2] === 0x46 && data[3] === 0x38) {
+    return { id, type: "image", format: "gif", data, alpha: null, opaque: false };
+  }
+
+  const jpeg = cleanJpeg(data);
+  if (!jpeg) {
+    return invalid(id);
+  }
+
+  return {
+    id,
+    type: "image",
+    format: "jpeg",
+    data: jpeg,
+    alpha: jpeg4 ? null : alpha,
+    opaque: jpeg4,
+  };
+}
+
+/**
+ * A JPEG as a decoder takes it: one SOI, then its segments, with the EOI
+ * and SOI between tables and image that SWFs carry dropped. Old tools
+ * wrote a stray FF D9 FF D8 at the start, and DefineBits' tables come as
+ * a JPEG of their own; Flash reads both. Null if it is not a JPEG.
+ */
+function cleanJpeg(data: Uint8Array): Uint8Array | null {
+  const out: Uint8Array[] = [Uint8Array.of(0xff, 0xd8)];
+  let at = 0;
+  while (at + 1 < data.length) {
+    if (data[at] !== 0xff) {
+      return null;
+    }
+
+    const marker = data[at + 1];
+    if (marker === 0xd8 || marker === 0xd9) {
+      at += 2;
+      continue;
+    }
+
+    if (marker === 0xff) {
+      // Fill bytes before a marker.
+      at++;
+      continue;
+    }
+
+    if (marker === 0xda) {
+      // The scan, and everything after it, as it is.
+      out.push(data.subarray(at));
+      return concatAll(out);
+    }
+
+    if (at + 3 >= data.length) {
+      return null;
+    }
+
+    const end = at + 2 + ((data[at + 2] << 8) | data[at + 3]);
+    out.push(data.subarray(at, end));
+    at = end;
+  }
+
+  return null;
+}
+
+function concatAll(parts: Uint8Array[]): Uint8Array {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let at = 0;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+
+  return out;
+}
+
+/** DefineBitsLossless and 2: a palette, 15-bit or 32-bit pixels, zlib'd. */
+function lossless(id: number, body: Uint8Array, alpha: boolean): Bitmap {
+  if (body.length < 7) {
+    return invalid(id);
+  }
+
+  const format = body[2];
+  const width = u16(body, 3);
+  const height = u16(body, 5);
+  if (width === 0 || height === 0 || (format !== 3 && format !== 4 && format !== 5)) {
+    return invalid(id);
+  }
+
+  const colors = format === 3 ? body[7] + 1 : 0;
+  const data = zlibUncompress(body.subarray(format === 3 ? 8 : 7));
+  const pixels = new Uint32Array(width * height);
+  if (format === 3) {
+    const entry = alpha ? 4 : 3;
+    const palette = new Uint32Array(256);
+    for (let i = 0; i < colors; i++) {
+      const p = i * entry;
+      // Lossless2's palette is premultiplied ARGB, as its pixels are.
+      palette[i] = alpha
+        ? ((data[p + 3] << 24) | (data[p] << 16) | (data[p + 1] << 8) | data[p + 2]) >>> 0
+        : (0xff000000 | (data[p] << 16) | (data[p + 1] << 8) | data[p + 2]) >>> 0;
+    }
+
+    const stride = (width + 3) & ~3;
+    const start = colors * entry;
+    if (start + stride * (height - 1) + width > data.length) {
+      return invalid(id);
+    }
+
+    for (let y = 0; y < height; y++) {
+      for (let x = 0; x < width; x++) {
+        pixels[y * width + x] = palette[data[start + y * stride + x]];
+      }
+    }
+  } else if (format === 4) {
+    // 15-bit RGB, rows padded to 4 bytes; a channel v is v * 8 + 7, 0 kept at 0.
+    const stride = (width * 2 + 3) & ~3;
+    if (stride * (height - 1) + width * 2 > data.length) {
+      return invalid(id);
+    }
+
+    const widen = (v: number) => (v === 0 ? 0 : v * 8 + 7);
+    for (let y = 0; y < height; y++) {
+      for (let x = 0; x < width; x++) {
+        const p = y * stride + x * 2;
+        const v = (data[p] << 8) | data[p + 1];
+        pixels[y * width + x] =
+          (0xff000000 |
+            (widen((v >> 10) & 31) << 16) |
+            (widen((v >> 5) & 31) << 8) |
+            widen(v & 31)) >>>
+          0;
+      }
+    }
+  } else {
+    if (width * height * 4 > data.length) {
+      return invalid(id);
+    }
+
+    for (let i = 0; i < width * height; i++) {
+      const p = i * 4;
+      const rgb = (data[p + 1] << 16) | (data[p + 2] << 8) | data[p + 3];
+      pixels[i] = alpha ? ((data[p] << 24) | rgb) >>> 0 : (0xff000000 | rgb) >>> 0;
+    }
+  }
+
+  return { id, type: "pixels", width, height, transparent: alpha, pixels };
+}

package/src/button.ts

@@ -0,0 +1,99 @@
+// DefineButton and DefineButton2 (SWF specification, chapter 4): a
+// button's records, each a character shown in some of its four states, and
+// whether it tracks as a menu. Their actions are the SWF's action blocks
+// (actions.ts), which a button gives by their indices.
+import type { ActionList } from "./actions.js";
+import { readFilterBytes } from "./display.js";
+import { type ColorTransform, type Matrix, readColorTransform, readMatrix } from "./shape.js";
+import { SwfReader, type Tag } from "./swf.js";
+import { DefineButton2 } from "./tags.js";
+
+/** A button's state, as BUTTONRECORD's flags have them. */
+export const BUTTON_UP = 0x01;
+export const BUTTON_OVER = 0x02;
+export const BUTTON_DOWN = 0x04;
+export const BUTTON_HIT_TEST = 0x08;
+
+/** A character a button shows in the states `states` names (BUTTON_UP and the rest). */
+export interface ButtonRecord {
+  states: number;
+  character: number;
+  depth: number;
+  matrix: Matrix;
+  /** DefineButton2's; null in a DefineButton. */
+  colorTransform: ColorTransform | null;
+  /** The filter list's bytes, undecoded, as a place keeps them; null without one. */
+  filters: Uint8Array | null;
+  blendMode: number | null;
+}
+
+export interface Button {
+  id: number;
+  records: ButtonRecord[];
+  /** DefineButton2's TrackAsMenu: a press elsewhere can be released on it. */
+  trackAsMenu: boolean;
+  /**
+   * The indices of its AVM1 actions in the SWF's ActionList; null without
+   * them, or when read without the list.
+   */
+  actions: number[] | null;
+}
+
+/** A DefineButton or DefineButton2; given the SWF's action list, with the indices of its actions. */
+export function readButton(bytes: Uint8Array, tag: Tag, actions?: ActionList): Button {
+  const { button } = parseButton(bytes, tag);
+  button.actions = actions?.byTag.get(tag.offset) ?? null;
+  return button;
+}
+
+/** A button's id, and where its actions start: -1 for a DefineButton2 whose action offset is 0. */
+export function buttonActionsOffset(bytes: Uint8Array, tag: Tag): { id: number; offset: number } {
+  const { button, actions } = parseButton(bytes, tag);
+  return { id: button.id, offset: actions };
+}
+
+function parseButton(bytes: Uint8Array, tag: Tag): { button: Button; actions: number } {
+  const r = new SwfReader(bytes, tag.offset, tag.offset + tag.length);
+  const two = tag.code === DefineButton2;
+  const button: Button = { id: r.u16(), records: [], trackAsMenu: false, actions: null };
+  // Only whether it is 0 counts: the actions start after the records' end, as Ruffle reads them.
+  let hasActions = true;
+  if (two) {
+    button.trackAsMenu = (r.u8() & 0x01) !== 0;
+    hasActions = r.u16() !== 0;
+  }
+
+  // The records end at a flags byte of 0.
+  while (r.pos < r.end && !r.overrun) {
+    const flags = r.u8();
+    if (flags === 0) {
+      break;
+    }
+
+    const record: ButtonRecord = {
+      states: flags & 0x0f,
+      character: r.u16(),
+      depth: r.u16(),
+      matrix: readMatrix(r),
+      colorTransform: null,
+      filters: null,
+      blendMode: null,
+    };
+    if (two) {
+      record.colorTransform = readColorTransform(r, true);
+      if (flags & 0x10) {
+        record.filters = readFilterBytes(r);
+      }
+
+      if (flags & 0x20) {
+        record.blendMode = r.u8();
+      }
+    }
+
+    if (!r.overrun) {
+      button.records.push(record);
+    }
+  }
+
+  return { button, actions: hasActions ? Math.min(r.pos, r.end) : -1 };
+}

package/src/compression.ts

@@ -0,0 +1,243 @@
+/**
+ * Compression as SWF files and ByteArray use it, synchronously and with no
+ * platform API, through @swf2es/native/compress: zlib itself for zlib and raw
+ * deflate, the LZMA SDK's encoder for LZMA, and an LZMA decoder after the
+ * SDK's specification.
+ */
+import {
+  CORRUPT,
+  type Decoded,
+  DICTIONARY,
+  DONE,
+  deflate,
+  FULL,
+  inflate,
+  lzmaDecode,
+  lzmaEncode,
+  TRUNCATED,
+} from "@swf2es/native/compress";
+
+/** Data a decompressor cannot read: corrupt, truncated, or not what it says. */
+export class CompressedDataError extends Error {}
+
+/**
+ * Data whose output does not fit: more than the decompressor's memory, or
+ * the page's, can hold. avmplus' ByteArray fails such an uncompress with
+ * MemoryError 1000, where it fails corrupt data with IOError 2058.
+ */
+export class CompressedDataTooLargeError extends CompressedDataError {}
+
+/** A deflate level: 0 stores, 1 is fastest, 9 smallest. */
+export type ZlibLevel = 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9;
+
+/** `data` as a zlib stream, as zlib's deflate writes it at `level`, 9 by default, as avmplus' ByteArray. */
+export function zlibCompress(data: Uint8Array, level: ZlibLevel = 9): Uint8Array {
+  return deflate(data, level, false);
+}
+
+/** `data` as a raw deflate stream, with no zlib header or checksum. */
+export function deflateCompress(data: Uint8Array): Uint8Array {
+  return deflate(data, 9, true);
+}
+
+/** The most an inflate may write: as much as a wasm32 memory holds. */
+const NO_LIMIT = 2 ** 32 - 1;
+
+/** A failed decode's status as a CompressedDataError. */
+function failure(result: Decoded): CompressedDataError {
+  switch (result.status) {
+    case TRUNCATED:
+      return new CompressedDataError("truncated");
+    case CORRUPT:
+      return new CompressedDataError(result.message ?? "corrupt");
+    case DICTIONARY:
+      return new CompressedDataError("needs a preset dictionary");
+    default:
+      return new CompressedDataTooLargeError("out of memory");
+  }
+}
+
+/**
+ * The bytes of a zlib stream (or, `raw`, of a raw deflate stream), up to its
+ * end: anything after is left, as zlib's inflate leaves it. The header is
+ * checked here, so that every way it can be wrong reads as avmplus' does.
+ */
+export function zlibUncompress(data: Uint8Array, raw = false): Uint8Array {
+  if (!raw) {
+    if (data.length < 2) {
+      throw new CompressedDataError("truncated");
+    }
+
+    const cmf = data[0];
+    const flg = data[1];
+    if ((cmf & 0x0f) !== 8 || cmf >> 4 > 7 || ((cmf << 8) | flg) % 31 !== 0) {
+      throw new CompressedDataError("incorrect header check");
+    }
+
+    if (flg & 0x20) {
+      throw new CompressedDataError("needs a preset dictionary");
+    }
+  }
+
+  const result = inflate(data, raw, NO_LIMIT);
+  if (result.status !== DONE) {
+    throw failure(result);
+  }
+
+  return result.bytes;
+}
+
+/** The size of an LZMA header: its 5 property bytes and the 8-byte length of what it holds. */
+export const LZMA_HEADER = 13;
+
+/** `data` as ByteArray's LZMA: the 5 property bytes, its length in 8 bytes, little-endian, and the stream. */
+export function lzmaByteArrayCompress(data: Uint8Array): Uint8Array {
+  return lzmaEncode(data);
+}
+
+/**
+ * ByteArray's LZMA, as avmplus reads it: the length its header gives must
+ * be what the stream holds. A length past 32 bits is not read here; the
+ * caller checks it first, as avmplus fails it before trying.
+ */
+export function lzmaByteArrayUncompress(data: Uint8Array): Uint8Array {
+  const length = (data[5] | (data[6] << 8) | (data[7] << 16) | (data[8] << 24)) >>> 0;
+  if (length > MAX_LZMA_RATIO * (data.length - LZMA_HEADER) + 4096) {
+    throw new CompressedDataError(`${length} bytes in a stream of ${data.length}`);
+  }
+
+  const result = lzmaDecode(data, 0, LZMA_HEADER, length);
+  if (result.status !== DONE) {
+    throw failure(result);
+  }
+
+  if (result.bytes.length !== length) {
+    throw new CompressedDataError("length mismatch");
+  }
+
+  return result.bytes;
+}
+
+/**
+ * More than LZMA can expand a byte to. Its best case, a long run of one
+ * byte, is matches of 273 bytes that each cost 14 decisions, each at least
+ * the 0.022 bits of LZMA's likeliest probability (2017/2048): 7090:1,
+ * which an encoder nears on 32 MB of zeros (6959:1). A header naming more
+ * than this of its stream is refused before decoding; one naming less is
+ * decoded, and a decoder that would read past the stream's end fails.
+ */
+const MAX_LZMA_RATIO = 8192;
+
+/**
+ * The first `length` bytes of a SWF as an uncompressed one, or fewer if it
+ * has fewer, decompressing only as far as they need: the header and the
+ * first tags, without trusting the header's file length, which a SWF of
+ * 30 bytes may give as 4 GB. Whatever cannot be read ends it early.
+ */
+export function decompressSwfPrefix(swf: Uint8Array, length: number): Uint8Array {
+  const signature = String.fromCharCode(swf[0], swf[1], swf[2]);
+  if (swf.length < 8 || signature === "FWS") {
+    return swf.subarray(0, length);
+  }
+
+  const fileLength = new DataView(swf.buffer, swf.byteOffset, swf.byteLength).getUint32(4, true);
+  // No further than the header's length, where decompressSwf stops too.
+  const want = Math.max(0, Math.min(length, fileLength) - 8);
+  const options = { offset: 8, partial: true };
+  let out: Uint8Array = new Uint8Array(8);
+  // A kilobyte of the body first, as a header and the first tags need, and
+  // more only while the input runs out before the output: a large SWF is
+  // not copied whole for its first bytes. What decoded before any failure
+  // is kept, so a SWF cut short still has its start.
+  for (let input = 1024; ; input *= 16) {
+    const end = Math.min(swf.length, (signature === "ZWS" ? 17 : 8) + input);
+    let result: Decoded | null = null;
+    if (signature === "CWS") {
+      result = inflate(swf.subarray(8, end), false, want, options);
+    } else if (signature === "ZWS" && swf.length >= 17) {
+      const size = Math.min(want, Math.max(0, fileLength - 8));
+      result = lzmaDecode(swf.subarray(0, end), 12, 17, size, options);
+    }
+
+    if (result === null) {
+      break;
+    }
+
+    out = result.bytes;
+    if (result.status !== TRUNCATED || end === swf.length) {
+      break;
+    }
+  }
+
+  out.set(swf.subarray(0, 8), 0);
+  out[0] = 0x46; // F
+  return out;
+}
+
+/**
+ * A SWF's bytes as an uncompressed one: the header as FWS, then the body,
+ * inflated for CWS, and for ZWS decoded from LZMA, whose header SWF writes
+ * differently (after the 8 bytes of the SWF header, a 4-byte compressed
+ * length and the 5 property bytes, and no 8-byte size).
+ */
+export function decompressSwf(swf: Uint8Array): Uint8Array {
+  const signature = String.fromCharCode(swf[0], swf[1], swf[2]);
+  if (signature === "FWS") {
+    return swf;
+  }
+
+  const fileLength = new DataView(swf.buffer, swf.byteOffset, swf.byteLength).getUint32(4, true);
+  if (fileLength < 8 && (signature === "CWS" || signature === "ZWS")) {
+    throw new CompressedDataError(`a file length of ${fileLength}, shorter than its header`);
+  }
+
+  let result: Decoded;
+  if (signature === "CWS") {
+    // A byte past the header's length tells a longer body from one that
+    // fits, which then ends with its checksum checked.
+    result = inflate(swf.subarray(8), false, fileLength - 8 + 1, { offset: 8 });
+    if (result.status === TRUNCATED) {
+      // Some SWFs omit the Adler-32 trailer despite holding a complete deflate stream.
+      const raw = inflate(swf.subarray(10), true, fileLength - 8 + 1, { offset: 8 });
+      if ((raw.status === DONE || raw.status === FULL) && 10 + raw.used + 4 > swf.length) {
+        result = raw;
+      }
+    }
+
+    // A longer body, as a packer may leave bytes after the End tag inside
+    // the stream, is read as far as the header's length and no further, as
+    // Flash Player plays it, and as a ZWS's decoding stops.
+    if (result.status === FULL) {
+      result = { ...result, status: DONE, bytes: result.bytes.subarray(0, fileLength) };
+    }
+  } else if (signature === "ZWS") {
+    if (swf.length < 17) {
+      throw new CompressedDataError("truncated");
+    }
+
+    // A length no stream that short can hold is refused before decoding;
+    // within it, the decoder stops where the stream does.
+    if (fileLength - 8 > MAX_LZMA_RATIO * (swf.length - 17) + 4096) {
+      throw new CompressedDataError(`a body of ${fileLength - 8} bytes in ${swf.length} of SWF`);
+    }
+
+    result = lzmaDecode(swf, 12, 17, fileLength - 8, { offset: 8 });
+  } else {
+    throw new TypeError(`Not a SWF file (signature ${JSON.stringify(signature)})`);
+  }
+
+  if (result.status !== DONE) {
+    throw failure(result);
+  }
+
+  const file = result.bytes;
+  if (file.length !== fileLength) {
+    throw new CompressedDataError(
+      `body of ${file.length - 8} bytes where the header says ${fileLength - 8}`,
+    );
+  }
+
+  file.set(swf.subarray(0, 8), 0);
+  file[0] = 0x46; // F
+  return file;
+}