Make all inputs constant

NEWS.md

@@ -1,3 +1,9 @@
+Bug fixes
+
+- Guarantee that input data remains constant. Change tok3_encode_names to not
+  alter input.
+
+
 Release 1.6.7: 24th June 2026
 -----------------------------
 

README.md

@@ -118,9 +118,9 @@ needed to be allocated when compressing a block of data.
 ```
 #include "htscodecs/rANS_static.h"
 
-unsigned char *rans_compress(unsigned char *in, unsigned int in_size,
+unsigned char *rans_compress(const unsigned char *in, unsigned int in_size,
                              unsigned int *out_size, int order);
-unsigned char *rans_uncompress(unsigned char *in, unsigned int in_size,
+unsigned char *rans_uncompress(const unsigned char *in, unsigned int in_size,
                                unsigned int *out_size);
 ```
 
@@ -143,14 +143,14 @@ No (un)compress_to functions exist for this older codec.
 #define RANS_ORDER_PACK   0x80  // Pack 2,4,8 or infinite symbols into a byte.
 
 unsigned int rans_compress_bound_4x16(unsigned int size, int order);
-unsigned char *rans_compress_to_4x16(unsigned char *in,  unsigned int in_size,
+unsigned char *rans_compress_to_4x16(const unsigned char *in,  unsigned int in_size,
                                      unsigned char *out, unsigned int *out_size,
                                      int order);
-unsigned char *rans_compress_4x16(unsigned char *in, unsigned int in_size,
+unsigned char *rans_compress_4x16(const unsigned char *in, unsigned int in_size,
                                   unsigned int *out_size, int order);
-unsigned char *rans_uncompress_to_4x16(unsigned char *in,  unsigned int in_size,
+unsigned char *rans_uncompress_to_4x16(const unsigned char *in,  unsigned int in_size,
                                        unsigned char *out, unsigned int *out_size);
-unsigned char *rans_uncompress_4x16(unsigned char *in, unsigned int in_size,
+unsigned char *rans_uncompress_4x16(const unsigned char *in, unsigned int in_size,
                                     unsigned int *out_size);
 ```
 
@@ -166,17 +166,17 @@ and dispatching to an appropriate SIMD implementation if available.
 ```
 #include "htscodecs/arith_dynamic.h"
 
-unsigned char *arith_compress(unsigned char *in, unsigned int in_size,
+unsigned char *arith_compress(const unsigned char *in, unsigned int in_size,
                               unsigned int *out_size, int order);
 
-unsigned char *arith_uncompress(unsigned char *in, unsigned int in_size,
+unsigned char *arith_uncompress(const unsigned char *in, unsigned int in_size,
                                 unsigned int *out_size);
 
-unsigned char *arith_compress_to(unsigned char *in,  unsigned int in_size,
+unsigned char *arith_compress_to(const unsigned char *in,  unsigned int in_size,
                                  unsigned char *out, unsigned int *out_size,
                                  int order);
 
-unsigned char *arith_uncompress_to(unsigned char *in, unsigned int in_size,
+unsigned char *arith_uncompress_to(const unsigned char *in, unsigned int in_size,
                                    unsigned char *out, unsigned int *out_sz);
 
 unsigned int arith_compress_bound(unsigned int size, int order);
@@ -190,10 +190,10 @@ the exception of X32 as there is currently no unrolling of this code.
 ```
 #include "htscodecs/tokenise_name3.h"
 
-uint8_t *tok3_encode_names(char *blk, int len, int level, int use_arith,
+uint8_t *tok3_encode_names(const char *blk, int len, int level, int use_arith,
                            int *out_len, int *last_start_p);
 
-uint8_t *tok3_decode_names(uint8_t *in, uint32_t sz, uint32_t *out_len);
+uint8_t *tok3_decode_names(const uint8_t *in, uint32_t sz, uint32_t *out_len);
 ```
 
 This differs to the general purpose entropy encoders as it takes a
@@ -227,9 +227,9 @@ typedef struct {
     uint32_t *flags;  // of size num_records
 } fqz_slice;
 
-char *fqz_compress(int vers, fqz_slice *s, char *in, size_t uncomp_size,
+char *fqz_compress(int vers, fqz_slice *s, const char *in, size_t uncomp_size,
                    size_t *comp_size, int strat, fqz_gparams *gp);
-char *fqz_decompress(char *in, size_t comp_size, size_t *uncomp_size,
+char *fqz_decompress(const char *in, size_t comp_size, size_t *uncomp_size,
                      int *lengths, int nlengths);
 ```
 

htscodecs/arith_dynamic.c

@@ -95,7 +95,7 @@ unsigned int arith_compress_bound(unsigned int size, int order) {
 // NB: The output buffer does not hold the original size, so it is up to
 // the caller to store this.
 static
-unsigned char *arith_compress_O0(unsigned char *in, unsigned int in_size,
+unsigned char *arith_compress_O0(const unsigned char *in, unsigned int in_size,
                                  unsigned char *out, unsigned int *out_size) {
     int i, bound = arith_compress_bound(in_size,0)-5; // -5 for order/size
     unsigned char *out_free = NULL;
@@ -137,7 +137,7 @@ unsigned char *arith_compress_O0(unsigned char *in, unsigned int in_size,
 }
 
 static
-unsigned char *arith_uncompress_O0(unsigned char *in, unsigned int in_size,
+unsigned char *arith_uncompress_O0(const unsigned char *in, unsigned int in_size,
                                    unsigned char *out, unsigned int out_sz) {
     RangeCoder rc;
     int i;
@@ -169,7 +169,7 @@ unsigned char *arith_uncompress_O0(unsigned char *in, unsigned int in_size,
 
 //-----------------------------------------------------------------------------
 static
-unsigned char *arith_compress_O1(unsigned char *in, unsigned int in_size,
+unsigned char *arith_compress_O1(const unsigned char *in, unsigned int in_size,
                                  unsigned char *out, unsigned int *out_size) {
     int i, bound = arith_compress_bound(in_size,0)-5; // -5 for order/size
     unsigned char *out_free = NULL;
@@ -224,7 +224,7 @@ unsigned char *arith_compress_O1(unsigned char *in, unsigned int in_size,
 }
 
 static
-unsigned char *arith_uncompress_O1(unsigned char *in, unsigned int in_size,
+unsigned char *arith_uncompress_O1(const unsigned char *in, unsigned int in_size,
                                    unsigned char *out, unsigned int out_sz) {
     RangeCoder rc;
     unsigned char *out_free = NULL;
@@ -271,7 +271,7 @@ unsigned char *arith_uncompress_O1(unsigned char *in, unsigned int in_size,
 #if 0
 
 #if 0
-unsigned char *arith_compress_O2(unsigned char *in, unsigned int in_size,
+unsigned char *arith_compress_O2(const unsigned char *in, unsigned int in_size,
                                  unsigned char *out, unsigned int *out_size) {
     fprintf(stderr, "WARNING: using undocumented O2 arith\n");
 
@@ -326,7 +326,7 @@ unsigned char *arith_compress_O2(unsigned char *in, unsigned int in_size,
     return out;
 }
 #else
-unsigned char *arith_compress_O2(unsigned char *in, unsigned int in_size,
+unsigned char *arith_compress_O2(const unsigned char *in, unsigned int in_size,
                                  unsigned char *out, unsigned int *out_size) {
     fprintf(stderr, "WARNING: using undocumented O2 arith\n");
 
@@ -392,7 +392,7 @@ unsigned char *arith_compress_O2(unsigned char *in, unsigned int in_size,
 }
 #endif
 
-unsigned char *arith_uncompress_O2(unsigned char *in, unsigned int in_size,
+unsigned char *arith_uncompress_O2(const unsigned char *in, unsigned int in_size,
                                    unsigned char *out, unsigned int out_sz) {
     RangeCoder rc;
 
@@ -438,7 +438,7 @@ unsigned char *arith_uncompress_O2(unsigned char *in, unsigned int in_size,
 #define MAX_RUN 4
 
 static
-unsigned char *arith_compress_O0_RLE(unsigned char *in, unsigned int in_size,
+unsigned char *arith_compress_O0_RLE(const unsigned char *in, unsigned int in_size,
                                      unsigned char *out, unsigned int *out_size) {
     int i, bound = arith_compress_bound(in_size,0)-5; // -5 for order/size
     unsigned char *out_free = NULL;
@@ -515,7 +515,7 @@ unsigned char *arith_compress_O0_RLE(unsigned char *in, unsigned int in_size,
 }
 
 static
-unsigned char *arith_uncompress_O0_RLE(unsigned char *in, unsigned int in_size,
+unsigned char *arith_uncompress_O0_RLE(const unsigned char *in, unsigned int in_size,
                                        unsigned char *out, unsigned int out_sz) {
     RangeCoder rc;
     int i;
@@ -572,7 +572,7 @@ unsigned char *arith_uncompress_O0_RLE(unsigned char *in, unsigned int in_size,
 }
 
 static
-unsigned char *arith_compress_O1_RLE(unsigned char *in, unsigned int in_size,
+unsigned char *arith_compress_O1_RLE(const unsigned char *in, unsigned int in_size,
                                      unsigned char *out, unsigned int *out_size) {
     int i, bound = arith_compress_bound(in_size,0)-5; // -5 for order/size
     unsigned char *out_free = NULL;
@@ -657,7 +657,7 @@ unsigned char *arith_compress_O1_RLE(unsigned char *in, unsigned int in_size,
 }
 
 static
-unsigned char *arith_uncompress_O1_RLE(unsigned char *in, unsigned int in_size,
+unsigned char *arith_uncompress_O1_RLE(const unsigned char *in, unsigned int in_size,
                                        unsigned char *out, unsigned int out_sz) {
     RangeCoder rc;
     int i;
@@ -727,7 +727,7 @@ unsigned char *arith_uncompress_O1_RLE(unsigned char *in, unsigned int in_size,
  *
  * Smallest is method, <in_size> <input>, so worst case 2 bytes longer.
  */
-unsigned char *arith_compress_to(unsigned char *in,  unsigned int in_size,
+unsigned char *arith_compress_to(const unsigned char *in,  unsigned int in_size,
                                  unsigned char *out, unsigned int *out_size,
                                  int order) {
     unsigned int c_meta_len;
@@ -1025,14 +1025,14 @@ unsigned char *arith_compress_to(unsigned char *in,  unsigned int in_size,
     return out;
 }
 
-unsigned char *arith_compress(unsigned char *in, unsigned int in_size,
+unsigned char *arith_compress(const unsigned char *in, unsigned int in_size,
                               unsigned int *out_size, int order) {
     return arith_compress_to(in, in_size, NULL, out_size, order);
 }
 
-unsigned char *arith_uncompress_to(unsigned char *in,  unsigned int in_size,
+unsigned char *arith_uncompress_to(const unsigned char *in,  unsigned int in_size,
                                    unsigned char *out, unsigned int *out_size) {
-    unsigned char *in_end = in + in_size;
+    const unsigned char *in_end = in + in_size;
     unsigned char *out_free = NULL;
     unsigned char *tmp_free = NULL;
 
@@ -1277,7 +1277,7 @@ unsigned char *arith_uncompress_to(unsigned char *in,  unsigned int in_size,
     return NULL;
 }
 
-unsigned char *arith_uncompress(unsigned char *in, unsigned int in_size,
+unsigned char *arith_uncompress(const unsigned char *in, unsigned int in_size,
                                 unsigned int *out_size) {
     return arith_uncompress_to(in, in_size, NULL, out_size);
 }

htscodecs/arith_dynamic.h

@@ -38,17 +38,17 @@
 extern "C" {
 #endif
 
-unsigned char *arith_compress(unsigned char *in, unsigned int in_size,
+unsigned char *arith_compress(const unsigned char *in, unsigned int in_size,
                               unsigned int *out_size, int order);
 
-unsigned char *arith_uncompress(unsigned char *in, unsigned int in_size,
+unsigned char *arith_uncompress(const unsigned char *in, unsigned int in_size,
                                 unsigned int *out_size);
 
-unsigned char *arith_compress_to(unsigned char *in,  unsigned int in_size,
+unsigned char *arith_compress_to(const unsigned char *in,  unsigned int in_size,
                                  unsigned char *out, unsigned int *out_size,
                                  int order);
 
-unsigned char *arith_uncompress_to(unsigned char *in, unsigned int in_size,
+unsigned char *arith_uncompress_to(const unsigned char *in, unsigned int in_size,
                                    unsigned char *out, unsigned int *out_sz);
 
 unsigned int arith_compress_bound(unsigned int size, int order);

htscodecs/fqzcomp_qual.c

@@ -1612,7 +1612,7 @@ unsigned char *uncompress_block_fqz2f(fqz_slice *s,
     return NULL;
 }
 
-char *fqz_compress(int vers, fqz_slice *s, char *in, size_t uncomp_size,
+char *fqz_compress(int vers, fqz_slice *s, const char *in, size_t uncomp_size,
                    size_t *comp_size, int strat, fqz_gparams *gp) {
     if (uncomp_size > INT_MAX) {
         *comp_size = 0;

htscodecs/fqzcomp_qual.h

@@ -149,7 +149,7 @@ typedef struct {
  * @return              The compressed quality buffer on success,
  *                      NULL on failure.
  */
-char *fqz_compress(int vers, fqz_slice *s, char *in, size_t in_size,
+char *fqz_compress(int vers, fqz_slice *s, const char *in, size_t in_size,
                    size_t *out_size, int strat, fqz_gparams *gp);
 
 /** Decompress a block of quality values.

htscodecs/pack.c

@@ -53,7 +53,7 @@
  * Returns the packed buffer on success with new length in out_len,
  *         NULL of failure
  */
-uint8_t *hts_pack(uint8_t *data, int64_t len,
+uint8_t *hts_pack(const uint8_t *data, int64_t len,
                   uint8_t *out_meta, int *out_meta_len, uint64_t *out_len) {
     int p[256] = {0}, n;
     uint64_t i, j;
@@ -158,7 +158,7 @@ uint8_t *hts_pack(uint8_t *data, int64_t len,
  * Returns number of bytes of data[] consumed on success,
  *         zero on failure.
  */
-uint8_t hts_unpack_meta(uint8_t *data, uint32_t data_len,
+uint8_t hts_unpack_meta(const uint8_t *data, uint32_t data_len,
                         uint64_t udata_len, uint8_t *map, int *nsym) {
     if (data_len == 0)
         return 0;
@@ -204,7 +204,7 @@ uint8_t hts_unpack_meta(uint8_t *data, uint32_t data_len,
  * Returns uncompressed data (out) on success,
  *         NULL on failure.
  */
-uint8_t *hts_unpack(uint8_t *data, int64_t len, uint8_t *out, uint64_t out_len, int nsym, uint8_t *p) {
+uint8_t *hts_unpack(const uint8_t *data, int64_t len, uint8_t *out, uint64_t out_len, int nsym, uint8_t *p) {
     //uint8_t *out;
     uint8_t c = 0;
     int64_t i, j = 0, olen;

htscodecs/pack.h

@@ -49,7 +49,7 @@ extern "C" {
  * Returns the packed buffer on success with new length in out_len,
  *         NULL of failure
  */
-uint8_t *hts_pack(uint8_t *data, int64_t len,
+uint8_t *hts_pack(const uint8_t *data, int64_t len,
                   uint8_t *out_meta, int *out_meta_len, uint64_t *out_len);
 
 /*
@@ -63,7 +63,7 @@ uint8_t *hts_pack(uint8_t *data, int64_t len,
  * Returns number of bytes of data[] consumed on success,
  *         zero on failure.
  */
-uint8_t hts_unpack_meta(uint8_t *data, uint32_t data_len,
+uint8_t hts_unpack_meta(const uint8_t *data, uint32_t data_len,
                         uint64_t udata_len, uint8_t *map, int *nsym);
 
 /*
@@ -77,7 +77,7 @@ uint8_t hts_unpack_meta(uint8_t *data, uint32_t data_len,
  * Returns uncompressed data (out) on success,
  *         NULL on failure.
  */
-uint8_t *hts_unpack(uint8_t *data, int64_t len, uint8_t *out, uint64_t out_len, int nsym, uint8_t *map);
+uint8_t *hts_unpack(const uint8_t *data, int64_t len, uint8_t *out, uint64_t out_len, int nsym, uint8_t *map);
 
 #ifdef __cplusplus
 }

htscodecs/rANS_byte.h

@@ -122,10 +122,10 @@ static inline void RansEncFlush(RansState* r, uint8_t** pptr)
 
 // Initializes a rANS decoder.
 // Unlike the encoder, the decoder works forwards as you'd expect.
-static inline void RansDecInit(RansState* r, uint8_t** pptr)
+static inline void RansDecInit(RansState* r, const uint8_t** pptr)
 {
     uint32_t x;
-    uint8_t* ptr = *pptr;
+    const uint8_t* ptr = *pptr;
 
     x  = ptr[0] << 0;
     x |= ptr[1] << 8;
@@ -464,10 +464,10 @@ static inline void RansDecRenorm(RansState* r, uint8_t** pptr) {
  * The only minor tweak here is to adjust the reorder a few opcodes
  * to reduce dependency delays.
  */
-static inline void RansDecRenorm2(RansState* r1, RansState* r2, uint8_t** pptr) {
+static inline void RansDecRenorm2(RansState* r1, RansState* r2, const uint8_t** pptr) {
     uint32_t  x1   = *r1;
     uint32_t  x2   = *r2;
-    uint8_t  *ptr = *pptr;
+    const uint8_t  *ptr = *pptr;
 
     __asm__ ("movzbl (%0), %%eax\n\t"
              "mov    %1, %%edx\n\t"
@@ -509,14 +509,14 @@ static inline void RansDecRenorm2(RansState* r1, RansState* r2, uint8_t** pptr)
 
 #else /* __x86_64 */
 
-static inline void RansDecRenorm(RansState* r, uint8_t** pptr)
+static inline void RansDecRenorm(RansState* r, const uint8_t** pptr)
 {
     // renormalize
     uint32_t x = *r;
 
 #ifdef __clang__
     // Generates cmov instructions on clang, but alas not gcc
-    uint8_t* ptr = *pptr;
+    const uint8_t* ptr = *pptr;
     uint32_t y = (x << 8) | *ptr;
     uint32_t cond = x < RANS_BYTE_L;
     x    = cond ? y : x;
@@ -525,7 +525,7 @@ static inline void RansDecRenorm(RansState* r, uint8_t** pptr)
     *pptr = ptr;
 #else
     if (x >= RANS_BYTE_L) return;
-    uint8_t* ptr = *pptr;
+    const uint8_t* ptr = *pptr;
     x = (x << 8) | *ptr++;
     if (x < RANS_BYTE_L) x = (x << 8) | *ptr++;
     *pptr = ptr;
@@ -534,17 +534,17 @@ static inline void RansDecRenorm(RansState* r, uint8_t** pptr)
     *r = x;
 }
 
-static inline void RansDecRenorm2(RansState* r1, RansState* r2, uint8_t** pptr) {
+static inline void RansDecRenorm2(RansState* r1, RansState* r2, const uint8_t** pptr) {
     RansDecRenorm(r1, pptr);
     RansDecRenorm(r2, pptr);
 }
 
 #endif /* __x86_64 */
 
-static inline void RansDecRenormSafe(RansState* r, uint8_t** pptr, uint8_t *ptr_end)
+static inline void RansDecRenormSafe(RansState* r, const uint8_t** pptr, const uint8_t *ptr_end)
 {
     uint32_t x = *r;
-    uint8_t* ptr = *pptr;
+    const uint8_t* ptr = *pptr;
     if (x >= RANS_BYTE_L || ptr >= ptr_end) return;
     x = (x << 8) | *ptr++;
     if (x < RANS_BYTE_L && ptr < ptr_end)