Coverage Report

Created: 2023-12-08 06:53

/src/freeimage-svn/FreeImage/trunk/Source/LibTIFF4/tif_ojpeg.c
Line
Count
Source (jump to first uncovered line)
1
/* WARNING: The type of JPEG encapsulation defined by the TIFF Version 6.0
2
   specification is now totally obsolete and deprecated for new applications and
3
   images. This file was was created solely in order to read unconverted images
4
   still present on some users' computer systems. It will never be extended
5
   to write such files. Writing new-style JPEG compressed TIFFs is implemented
6
   in tif_jpeg.c.
7
8
   The code is carefully crafted to robustly read all gathered JPEG-in-TIFF
9
   testfiles, and anticipate as much as possible all other... But still, it may
10
   fail on some. If you encounter problems, please report them on the TIFF
11
   mailing list and/or to Joris Van Damme <info@awaresystems.be>.
12
13
   Please read the file called "TIFF Technical Note #2" if you need to be
14
   convinced this compression scheme is bad and breaks TIFF. That document
15
   is linked to from the LibTiff site <http://www.remotesensing.org/libtiff/>
16
   and from AWare Systems' TIFF section
17
   <http://www.awaresystems.be/imaging/tiff.html>. It is also absorbed
18
   in Adobe's specification supplements, marked "draft" up to this day, but
19
   supported by the TIFF community.
20
21
   This file interfaces with Release 6B of the JPEG Library written by the
22
   Independent JPEG Group. Previous versions of this file required a hack inside
23
   the LibJpeg library. This version no longer requires that. Remember to
24
   remove the hack if you update from the old version.
25
26
   Copyright (c) Joris Van Damme <info@awaresystems.be>
27
   Copyright (c) AWare Systems <http://www.awaresystems.be/>
28
29
   The licence agreement for this file is the same as the rest of the LibTiff
30
   library.
31
32
   IN NO EVENT SHALL JORIS VAN DAMME OR AWARE SYSTEMS BE LIABLE FOR
33
   ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
34
   OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
35
   WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
36
   LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
37
   OF THIS SOFTWARE.
38
39
   Joris Van Damme and/or AWare Systems may be available for custom
40
   development. If you like what you see, and need anything similar or related,
41
   contact <info@awaresystems.be>.
42
*/
43
44
/* What is what, and what is not?
45
46
   This decoder starts with an input stream, that is essentially the
47
   JpegInterchangeFormat stream, if any, followed by the strile data, if any.
48
   This stream is read in OJPEGReadByte and related functions.
49
50
   It analyzes the start of this stream, until it encounters non-marker data,
51
   i.e. compressed image data. Some of the header markers it sees have no actual
52
   content, like the SOI marker, and APP/COM markers that really shouldn't even
53
   be there. Some other markers do have content, and the valuable bits and
54
   pieces of information in these markers are saved, checking all to verify that
55
   the stream is more or less within expected bounds. This happens inside the
56
   OJPEGReadHeaderInfoSecStreamXxx functions.
57
58
   Some OJPEG imagery contains no valid JPEG header markers. This situation is
59
   picked up on if we've seen no SOF marker when we're at the start of the
60
   compressed image data. In this case, the tables are read from JpegXxxTables
61
   tags, and the other bits and pieces of information is initialized to its most
62
   basic value. This is implemented in the OJPEGReadHeaderInfoSecTablesXxx
63
   functions.
64
65
   When this is complete, a good and valid JPEG header can be assembled, and
66
   this is passed through to LibJpeg. When that's done, the remainder of the
67
   input stream, i.e. the compressed image data, can be passed through
68
   unchanged. This is done in OJPEGWriteStream functions.
69
70
   LibTiff rightly expects to know the subsampling values before decompression.
71
   Just like in new-style JPEG-in-TIFF, though, or even more so, actually, the
72
   YCbCrsubsampling tag is notoriously unreliable. To correct these tag values
73
   with the ones inside the JPEG stream, the first part of the input stream is
74
   pre-scanned in OJPEGSubsamplingCorrect, making no note of any other data,
75
   reporting no warnings or errors, up to the point where either these values
76
   are read, or it's clear they aren't there. This means that some of the data
77
   is read twice, but we feel speed in correcting these values is important
78
   enough to warrant this sacrifice. Although there is currently no define or
79
   other configuration mechanism to disable this behavior, the actual header
80
   scanning is build to robustly respond with error report if it should
81
   encounter an uncorrected mismatch of subsampling values. See
82
   OJPEGReadHeaderInfoSecStreamSof.
83
84
   The restart interval and restart markers are the most tricky part... The
85
   restart interval can be specified in a tag. It can also be set inside the
86
   input JPEG stream. It can be used inside the input JPEG stream. If reading
87
   from strile data, we've consistently discovered the need to insert restart
88
   markers in between the different striles, as is also probably the most likely
89
   interpretation of the original TIFF 6.0 specification. With all this setting
90
   of interval, and actual use of markers that is not predictable at the time of
91
   valid JPEG header assembly, the restart thing may turn out the Achilles heel
92
   of this implementation. Fortunately, most OJPEG writer vendors succeed in
93
   reading back what they write, which may be the reason why we've been able to
94
   discover ways that seem to work.
95
96
   Some special provision is made for planarconfig separate OJPEG files. These
97
   seem to consistently contain header info, a SOS marker, a plane, SOS marker,
98
   plane, SOS, and plane. This may or may not be a valid JPEG configuration, we
99
   don't know and don't care. We want LibTiff to be able to access the planes
100
   individually, without huge buffering inside LibJpeg, anyway. So we compose
101
   headers to feed to LibJpeg, in this case, that allow us to pass a single
102
   plane such that LibJpeg sees a valid single-channel JPEG stream. Locating
103
   subsequent SOS markers, and thus subsequent planes, is done inside
104
   OJPEGReadSecondarySos.
105
106
   The benefit of the scheme is... that it works, basically. We know of no other
107
   that does. It works without checking software tag, or otherwise going about
108
   things in an OJPEG flavor specific manner. Instead, it is a single scheme,
109
   that covers the cases with and without JpegInterchangeFormat, with and
110
   without striles, with part of the header in JpegInterchangeFormat and
111
   remainder in first strile, etc. It is forgiving and robust, may likely work
112
   with OJPEG flavors we've not seen yet, and makes most out of the data.
113
114
   Another nice side-effect is that a complete JPEG single valid stream is build
115
   if planarconfig is not separate (vast majority). We may one day use that to
116
   build converters to JPEG, and/or to new-style JPEG compression inside TIFF.
117
118
   A disadvantage is the lack of random access to the individual striles. This
119
   is the reason for much of the complicated restart-and-position stuff inside
120
   OJPEGPreDecode. Applications would do well accessing all striles in order, as
121
   this will result in a single sequential scan of the input stream, and no
122
   restarting of LibJpeg decoding session.
123
*/
124
125
#define WIN32_LEAN_AND_MEAN
126
#define VC_EXTRALEAN
127
128
#include "tiffiop.h"
129
#ifdef OJPEG_SUPPORT
130
131
/* Configuration defines here are:
132
 * JPEG_ENCAP_EXTERNAL: The normal way to call libjpeg, uses longjump. In some
133
 * environments, like eg LibTiffDelphi, this is not possible. For this reason,
134
 * the actual calls to libjpeg, with longjump stuff, are encapsulated in
135
 * dedicated functions. When JPEG_ENCAP_EXTERNAL is defined, these encapsulating
136
 * functions are declared external to this unit, and can be defined elsewhere to
137
 * use stuff other then longjump. The default mode, without JPEG_ENCAP_EXTERNAL,
138
 * implements the call encapsulators here, internally, with normal longjump.
139
 * SETJMP, LONGJMP, JMP_BUF: On some machines/environments a longjump equivalent
140
 * is conveniently available, but still it may be worthwhile to use _setjmp or
141
 * sigsetjmp in place of plain setjmp. These macros will make it easier. It is
142
 * useless to fiddle with these if you define JPEG_ENCAP_EXTERNAL. OJPEG_BUFFER:
143
 * Define the size of the desired buffer here. Should be small enough so as to
144
 * guarantee instant processing, optimal streaming and optimal use of processor
145
 * cache, but also big enough so as to not result in significant call overhead.
146
 * It should be at least a few bytes to accommodate some structures (this is
147
 * verified in asserts), but it would not be sensible to make it this small
148
 * anyway, and it should be at most 64K since it is indexed with uint16_t. We
149
 * recommend 2K. EGYPTIANWALK: You could also define EGYPTIANWALK here, but it
150
 * is not used anywhere and has absolutely no effect. That is why most people
151
 * insist the EGYPTIANWALK is a bit silly.
152
 */
153
154
/* define LIBJPEG_ENCAP_EXTERNAL */
155
0
#define SETJMP(jbuf) setjmp(jbuf)
156
0
#define LONGJMP(jbuf, code) longjmp(jbuf, code)
157
#define JMP_BUF jmp_buf
158
0
#define OJPEG_BUFFER 2048
159
/* define EGYPTIANWALK */
160
161
0
#define JPEG_MARKER_SOF0 0xC0
162
0
#define JPEG_MARKER_SOF1 0xC1
163
0
#define JPEG_MARKER_SOF3 0xC3
164
0
#define JPEG_MARKER_DHT 0xC4
165
0
#define JPEG_MARKER_RST0 0XD0
166
0
#define JPEG_MARKER_SOI 0xD8
167
0
#define JPEG_MARKER_EOI 0xD9
168
0
#define JPEG_MARKER_SOS 0xDA
169
0
#define JPEG_MARKER_DQT 0xDB
170
0
#define JPEG_MARKER_DRI 0xDD
171
0
#define JPEG_MARKER_APP0 0xE0
172
0
#define JPEG_MARKER_COM 0xFE
173
174
#define FIELD_OJPEG_JPEGINTERCHANGEFORMAT (FIELD_CODEC + 0)
175
#define FIELD_OJPEG_JPEGINTERCHANGEFORMATLENGTH (FIELD_CODEC + 1)
176
#define FIELD_OJPEG_JPEGQTABLES (FIELD_CODEC + 2)
177
#define FIELD_OJPEG_JPEGDCTABLES (FIELD_CODEC + 3)
178
#define FIELD_OJPEG_JPEGACTABLES (FIELD_CODEC + 4)
179
#define FIELD_OJPEG_JPEGPROC (FIELD_CODEC + 5)
180
#define FIELD_OJPEG_JPEGRESTARTINTERVAL (FIELD_CODEC + 6)
181
182
static const TIFFField ojpegFields[] = {
183
    {TIFFTAG_JPEGIFOFFSET, 1, 1, TIFF_LONG8, 0, TIFF_SETGET_UINT64,
184
     TIFF_SETGET_UNDEFINED, FIELD_OJPEG_JPEGINTERCHANGEFORMAT, TRUE, FALSE,
185
     "JpegInterchangeFormat", NULL},
186
    {TIFFTAG_JPEGIFBYTECOUNT, 1, 1, TIFF_LONG8, 0, TIFF_SETGET_UINT64,
187
     TIFF_SETGET_UNDEFINED, FIELD_OJPEG_JPEGINTERCHANGEFORMATLENGTH, TRUE,
188
     FALSE, "JpegInterchangeFormatLength", NULL},
189
    {TIFFTAG_JPEGQTABLES, TIFF_VARIABLE2, TIFF_VARIABLE2, TIFF_LONG8, 0,
190
     TIFF_SETGET_C32_UINT64, TIFF_SETGET_UNDEFINED, FIELD_OJPEG_JPEGQTABLES,
191
     FALSE, TRUE, "JpegQTables", NULL},
192
    {TIFFTAG_JPEGDCTABLES, TIFF_VARIABLE2, TIFF_VARIABLE2, TIFF_LONG8, 0,
193
     TIFF_SETGET_C32_UINT64, TIFF_SETGET_UNDEFINED, FIELD_OJPEG_JPEGDCTABLES,
194
     FALSE, TRUE, "JpegDcTables", NULL},
195
    {TIFFTAG_JPEGACTABLES, TIFF_VARIABLE2, TIFF_VARIABLE2, TIFF_LONG8, 0,
196
     TIFF_SETGET_C32_UINT64, TIFF_SETGET_UNDEFINED, FIELD_OJPEG_JPEGACTABLES,
197
     FALSE, TRUE, "JpegAcTables", NULL},
198
    {TIFFTAG_JPEGPROC, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16,
199
     TIFF_SETGET_UNDEFINED, FIELD_OJPEG_JPEGPROC, FALSE, FALSE, "JpegProc",
200
     NULL},
201
    {TIFFTAG_JPEGRESTARTINTERVAL, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16,
202
     TIFF_SETGET_UNDEFINED, FIELD_OJPEG_JPEGRESTARTINTERVAL, FALSE, FALSE,
203
     "JpegRestartInterval", NULL},
204
};
205
206
#ifndef LIBJPEG_ENCAP_EXTERNAL
207
#include <setjmp.h>
208
#endif
209
210
/* We undefine FAR to avoid conflict with JPEG definition */
211
212
#ifdef FAR
213
#undef FAR
214
#endif
215
216
/*
217
  Libjpeg's jmorecfg.h defines INT16 and INT32, but only if XMD_H is
218
  not defined.  Unfortunately, the MinGW and Borland compilers include
219
  a typedef for INT32, which causes a conflict.  MSVC does not include
220
  a conflicting typedef given the headers which are included.
221
*/
222
#if defined(__BORLANDC__) || defined(__MINGW32__)
223
#define XMD_H 1
224
#endif
225
226
/* Define "boolean" as unsigned char, not int, per Windows custom. */
227
#if defined(__WIN32__) && !defined(__MINGW32__)
228
#ifndef __RPCNDR_H__ /* don't conflict if rpcndr.h already read */
229
typedef unsigned char boolean;
230
#endif
231
#define HAVE_BOOLEAN /* prevent jmorecfg.h from redefining it */
232
#endif
233
234
#include "jerror.h"
235
#include "jpeglib.h"
236
237
typedef struct jpeg_error_mgr jpeg_error_mgr;
238
typedef struct jpeg_common_struct jpeg_common_struct;
239
typedef struct jpeg_decompress_struct jpeg_decompress_struct;
240
typedef struct jpeg_source_mgr jpeg_source_mgr;
241
242
typedef enum
243
{
244
    osibsNotSetYet,
245
    osibsJpegInterchangeFormat,
246
    osibsStrile,
247
    osibsEof
248
} OJPEGStateInBufferSource;
249
250
typedef enum
251
{
252
    ososSoi,
253
    ososQTable0,
254
    ososQTable1,
255
    ososQTable2,
256
    ososQTable3,
257
    ososDcTable0,
258
    ososDcTable1,
259
    ososDcTable2,
260
    ososDcTable3,
261
    ososAcTable0,
262
    ososAcTable1,
263
    ososAcTable2,
264
    ososAcTable3,
265
    ososDri,
266
    ososSof,
267
    ososSos,
268
    ososCompressed,
269
    ososRst,
270
    ososEoi
271
} OJPEGStateOutState;
272
273
typedef struct
274
{
275
    TIFF *tif;
276
    int decoder_ok;
277
    int error_in_raw_data_decoding;
278
#ifndef LIBJPEG_ENCAP_EXTERNAL
279
    JMP_BUF exit_jmpbuf;
280
#endif
281
    TIFFVGetMethod vgetparent;
282
    TIFFVSetMethod vsetparent;
283
    TIFFPrintMethod printdir;
284
    uint64_t file_size;
285
    uint32_t image_width;
286
    uint32_t image_length;
287
    uint32_t strile_width;
288
    uint32_t strile_length;
289
    uint32_t strile_length_total;
290
    uint8_t samples_per_pixel;
291
    uint8_t plane_sample_offset;
292
    uint8_t samples_per_pixel_per_plane;
293
    uint64_t jpeg_interchange_format;
294
    uint64_t jpeg_interchange_format_length;
295
    uint8_t jpeg_proc;
296
    uint8_t subsamplingcorrect;
297
    uint8_t subsamplingcorrect_done;
298
    uint8_t subsampling_tag;
299
    uint8_t subsampling_hor;
300
    uint8_t subsampling_ver;
301
    uint8_t subsampling_force_desubsampling_inside_decompression;
302
    uint8_t qtable_offset_count;
303
    uint8_t dctable_offset_count;
304
    uint8_t actable_offset_count;
305
    uint64_t qtable_offset[3];
306
    uint64_t dctable_offset[3];
307
    uint64_t actable_offset[3];
308
    uint8_t *qtable[4];
309
    uint8_t *dctable[4];
310
    uint8_t *actable[4];
311
    uint16_t restart_interval;
312
    uint8_t restart_index;
313
    uint8_t sof_log;
314
    uint8_t sof_marker_id;
315
    uint32_t sof_x;
316
    uint32_t sof_y;
317
    uint8_t sof_c[3];
318
    uint8_t sof_hv[3];
319
    uint8_t sof_tq[3];
320
    uint8_t sos_cs[3];
321
    uint8_t sos_tda[3];
322
    struct
323
    {
324
        uint8_t log;
325
        OJPEGStateInBufferSource in_buffer_source;
326
        uint32_t in_buffer_next_strile;
327
        uint64_t in_buffer_file_pos;
328
        uint64_t in_buffer_file_togo;
329
    } sos_end[3];
330
    uint8_t readheader_done;
331
    uint8_t writeheader_done;
332
    uint16_t write_cursample;
333
    uint32_t write_curstrile;
334
    uint8_t libjpeg_session_active;
335
    uint8_t libjpeg_jpeg_query_style;
336
    jpeg_error_mgr libjpeg_jpeg_error_mgr;
337
    jpeg_decompress_struct libjpeg_jpeg_decompress_struct;
338
    jpeg_source_mgr libjpeg_jpeg_source_mgr;
339
    uint8_t subsampling_convert_log;
340
    uint32_t subsampling_convert_ylinelen;
341
    uint32_t subsampling_convert_ylines;
342
    uint32_t subsampling_convert_clinelen;
343
    uint32_t subsampling_convert_clines;
344
    uint32_t subsampling_convert_ybuflen;
345
    uint32_t subsampling_convert_cbuflen;
346
    uint32_t subsampling_convert_ycbcrbuflen;
347
    uint8_t *subsampling_convert_ycbcrbuf;
348
    uint8_t *subsampling_convert_ybuf;
349
    uint8_t *subsampling_convert_cbbuf;
350
    uint8_t *subsampling_convert_crbuf;
351
    uint32_t subsampling_convert_ycbcrimagelen;
352
    uint8_t **subsampling_convert_ycbcrimage;
353
    uint32_t subsampling_convert_clinelenout;
354
    uint32_t subsampling_convert_state;
355
    uint32_t bytes_per_line;   /* if the codec outputs subsampled data, a 'line'
356
                                  in bytes_per_line */
357
    uint32_t lines_per_strile; /* and lines_per_strile means subsampling_ver
358
                                  desubsampled rows     */
359
    OJPEGStateInBufferSource in_buffer_source;
360
    uint32_t in_buffer_next_strile;
361
    uint32_t in_buffer_strile_count;
362
    uint64_t in_buffer_file_pos;
363
    uint8_t in_buffer_file_pos_log;
364
    uint64_t in_buffer_file_togo;
365
    uint16_t in_buffer_togo;
366
    uint8_t *in_buffer_cur;
367
    uint8_t in_buffer[OJPEG_BUFFER];
368
    OJPEGStateOutState out_state;
369
    uint8_t out_buffer[OJPEG_BUFFER];
370
    uint8_t *skip_buffer;
371
} OJPEGState;
372
373
static int OJPEGVGetField(TIFF *tif, uint32_t tag, va_list ap);
374
static int OJPEGVSetField(TIFF *tif, uint32_t tag, va_list ap);
375
static void OJPEGPrintDir(TIFF *tif, FILE *fd, long flags);
376
377
static int OJPEGFixupTags(TIFF *tif);
378
static int OJPEGSetupDecode(TIFF *tif);
379
static int OJPEGPreDecode(TIFF *tif, uint16_t s);
380
static int OJPEGPreDecodeSkipRaw(TIFF *tif);
381
static int OJPEGPreDecodeSkipScanlines(TIFF *tif);
382
static int OJPEGDecode(TIFF *tif, uint8_t *buf, tmsize_t cc, uint16_t s);
383
static int OJPEGDecodeRaw(TIFF *tif, uint8_t *buf, tmsize_t cc);
384
static int OJPEGDecodeScanlines(TIFF *tif, uint8_t *buf, tmsize_t cc);
385
static void OJPEGPostDecode(TIFF *tif, uint8_t *buf, tmsize_t cc);
386
static int OJPEGSetupEncode(TIFF *tif);
387
static int OJPEGPreEncode(TIFF *tif, uint16_t s);
388
static int OJPEGEncode(TIFF *tif, uint8_t *buf, tmsize_t cc, uint16_t s);
389
static int OJPEGPostEncode(TIFF *tif);
390
static void OJPEGCleanup(TIFF *tif);
391
392
static void OJPEGSubsamplingCorrect(TIFF *tif);
393
static int OJPEGReadHeaderInfo(TIFF *tif);
394
static int OJPEGReadSecondarySos(TIFF *tif, uint16_t s);
395
static int OJPEGWriteHeaderInfo(TIFF *tif);
396
static void OJPEGLibjpegSessionAbort(TIFF *tif);
397
398
static int OJPEGReadHeaderInfoSec(TIFF *tif);
399
static int OJPEGReadHeaderInfoSecStreamDri(TIFF *tif);
400
static int OJPEGReadHeaderInfoSecStreamDqt(TIFF *tif);
401
static int OJPEGReadHeaderInfoSecStreamDht(TIFF *tif);
402
static int OJPEGReadHeaderInfoSecStreamSof(TIFF *tif, uint8_t marker_id);
403
static int OJPEGReadHeaderInfoSecStreamSos(TIFF *tif);
404
static int OJPEGReadHeaderInfoSecTablesQTable(TIFF *tif);
405
static int OJPEGReadHeaderInfoSecTablesDcTable(TIFF *tif);
406
static int OJPEGReadHeaderInfoSecTablesAcTable(TIFF *tif);
407
408
static int OJPEGReadBufferFill(OJPEGState *sp);
409
static int OJPEGReadByte(OJPEGState *sp, uint8_t *byte);
410
static int OJPEGReadBytePeek(OJPEGState *sp, uint8_t *byte);
411
static void OJPEGReadByteAdvance(OJPEGState *sp);
412
static int OJPEGReadWord(OJPEGState *sp, uint16_t *word);
413
static int OJPEGReadBlock(OJPEGState *sp, uint16_t len, void *mem);
414
static void OJPEGReadSkip(OJPEGState *sp, uint16_t len);
415
416
static int OJPEGWriteStream(TIFF *tif, void **mem, uint32_t *len);
417
static void OJPEGWriteStreamSoi(TIFF *tif, void **mem, uint32_t *len);
418
static void OJPEGWriteStreamQTable(TIFF *tif, uint8_t table_index, void **mem,
419
                                   uint32_t *len);
420
static void OJPEGWriteStreamDcTable(TIFF *tif, uint8_t table_index, void **mem,
421
                                    uint32_t *len);
422
static void OJPEGWriteStreamAcTable(TIFF *tif, uint8_t table_index, void **mem,
423
                                    uint32_t *len);
424
static void OJPEGWriteStreamDri(TIFF *tif, void **mem, uint32_t *len);
425
static void OJPEGWriteStreamSof(TIFF *tif, void **mem, uint32_t *len);
426
static void OJPEGWriteStreamSos(TIFF *tif, void **mem, uint32_t *len);
427
static int OJPEGWriteStreamCompressed(TIFF *tif, void **mem, uint32_t *len);
428
static void OJPEGWriteStreamRst(TIFF *tif, void **mem, uint32_t *len);
429
static void OJPEGWriteStreamEoi(TIFF *tif, void **mem, uint32_t *len);
430
431
#ifdef LIBJPEG_ENCAP_EXTERNAL
432
extern int jpeg_create_decompress_encap(OJPEGState *sp,
433
                                        jpeg_decompress_struct *cinfo);
434
extern int jpeg_read_header_encap(OJPEGState *sp, jpeg_decompress_struct *cinfo,
435
                                  uint8_t require_image);
436
extern int jpeg_start_decompress_encap(OJPEGState *sp,
437
                                       jpeg_decompress_struct *cinfo);
438
extern int jpeg_read_scanlines_encap(OJPEGState *sp,
439
                                     jpeg_decompress_struct *cinfo,
440
                                     void *scanlines, uint32_t max_lines);
441
extern int jpeg_read_raw_data_encap(OJPEGState *sp,
442
                                    jpeg_decompress_struct *cinfo, void *data,
443
                                    uint32_t max_lines);
444
extern void jpeg_encap_unwind(TIFF *tif);
445
#else
446
static int jpeg_create_decompress_encap(OJPEGState *sp,
447
                                        jpeg_decompress_struct *j);
448
static int jpeg_read_header_encap(OJPEGState *sp, jpeg_decompress_struct *cinfo,
449
                                  uint8_t require_image);
450
static int jpeg_start_decompress_encap(OJPEGState *sp,
451
                                       jpeg_decompress_struct *cinfo);
452
static int jpeg_read_scanlines_encap(OJPEGState *sp,
453
                                     jpeg_decompress_struct *cinfo,
454
                                     void *scanlines, uint32_t max_lines);
455
static int jpeg_read_raw_data_encap(OJPEGState *sp,
456
                                    jpeg_decompress_struct *cinfo, void *data,
457
                                    uint32_t max_lines);
458
static void jpeg_encap_unwind(TIFF *tif);
459
#endif
460
461
static void OJPEGLibjpegJpegErrorMgrOutputMessage(jpeg_common_struct *cinfo);
462
static void OJPEGLibjpegJpegErrorMgrErrorExit(jpeg_common_struct *cinfo);
463
static void OJPEGLibjpegJpegSourceMgrInitSource(jpeg_decompress_struct *cinfo);
464
static boolean
465
OJPEGLibjpegJpegSourceMgrFillInputBuffer(jpeg_decompress_struct *cinfo);
466
static void
467
OJPEGLibjpegJpegSourceMgrSkipInputData(jpeg_decompress_struct *cinfo,
468
                                       long num_bytes);
469
static boolean
470
OJPEGLibjpegJpegSourceMgrResyncToRestart(jpeg_decompress_struct *cinfo,
471
                                         int desired);
472
static void OJPEGLibjpegJpegSourceMgrTermSource(jpeg_decompress_struct *cinfo);
473
474
int TIFFInitOJPEG(TIFF *tif, int scheme)
475
0
{
476
0
    static const char module[] = "TIFFInitOJPEG";
477
0
    OJPEGState *sp;
478
479
0
    (void)scheme;
480
0
    assert(scheme == COMPRESSION_OJPEG);
481
482
    /*
483
     * Merge codec-specific tag information.
484
     */
485
0
    if (!_TIFFMergeFields(tif, ojpegFields, TIFFArrayCount(ojpegFields)))
486
0
    {
487
0
        TIFFErrorExtR(tif, module,
488
0
                      "Merging Old JPEG codec-specific tags failed");
489
0
        return 0;
490
0
    }
491
492
    /* state block */
493
0
    sp = _TIFFmallocExt(tif, sizeof(OJPEGState));
494
0
    if (sp == NULL)
495
0
    {
496
0
        TIFFErrorExtR(tif, module, "No space for OJPEG state block");
497
0
        return (0);
498
0
    }
499
0
    _TIFFmemset(sp, 0, sizeof(OJPEGState));
500
0
    sp->tif = tif;
501
0
    sp->jpeg_proc = 1;
502
0
    sp->subsampling_hor = 2;
503
0
    sp->subsampling_ver = 2;
504
0
    TIFFSetField(tif, TIFFTAG_YCBCRSUBSAMPLING, 2, 2);
505
    /* tif codec methods */
506
0
    tif->tif_fixuptags = OJPEGFixupTags;
507
0
    tif->tif_setupdecode = OJPEGSetupDecode;
508
0
    tif->tif_predecode = OJPEGPreDecode;
509
0
    tif->tif_postdecode = OJPEGPostDecode;
510
0
    tif->tif_decoderow = OJPEGDecode;
511
0
    tif->tif_decodestrip = OJPEGDecode;
512
0
    tif->tif_decodetile = OJPEGDecode;
513
0
    tif->tif_setupencode = OJPEGSetupEncode;
514
0
    tif->tif_preencode = OJPEGPreEncode;
515
0
    tif->tif_postencode = OJPEGPostEncode;
516
0
    tif->tif_encoderow = OJPEGEncode;
517
0
    tif->tif_encodestrip = OJPEGEncode;
518
0
    tif->tif_encodetile = OJPEGEncode;
519
0
    tif->tif_cleanup = OJPEGCleanup;
520
0
    tif->tif_data = (uint8_t *)sp;
521
    /* tif tag methods */
522
0
    sp->vgetparent = tif->tif_tagmethods.vgetfield;
523
0
    tif->tif_tagmethods.vgetfield = OJPEGVGetField;
524
0
    sp->vsetparent = tif->tif_tagmethods.vsetfield;
525
0
    tif->tif_tagmethods.vsetfield = OJPEGVSetField;
526
0
    sp->printdir = tif->tif_tagmethods.printdir;
527
0
    tif->tif_tagmethods.printdir = OJPEGPrintDir;
528
    /* Some OJPEG files don't have strip or tile offsets or bytecounts tags.
529
       Some others do, but have totally meaningless or corrupt values
530
       in these tags. In these cases, the JpegInterchangeFormat stream is
531
       reliable. In any case, this decoder reads the compressed data itself,
532
       from the most reliable locations, and we need to notify encapsulating
533
       LibTiff not to read raw strips or tiles for us. */
534
0
    tif->tif_flags |= TIFF_NOREADRAW;
535
0
    return (1);
536
0
}
537
538
static int OJPEGVGetField(TIFF *tif, uint32_t tag, va_list ap)
539
0
{
540
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
541
0
    switch (tag)
542
0
    {
543
0
        case TIFFTAG_JPEGIFOFFSET:
544
0
            *va_arg(ap, uint64_t *) = (uint64_t)sp->jpeg_interchange_format;
545
0
            break;
546
0
        case TIFFTAG_JPEGIFBYTECOUNT:
547
0
            *va_arg(ap, uint64_t *) =
548
0
                (uint64_t)sp->jpeg_interchange_format_length;
549
0
            break;
550
0
        case TIFFTAG_YCBCRSUBSAMPLING:
551
0
            if (sp->subsamplingcorrect_done == 0)
552
0
                OJPEGSubsamplingCorrect(tif);
553
0
            *va_arg(ap, uint16_t *) = (uint16_t)sp->subsampling_hor;
554
0
            *va_arg(ap, uint16_t *) = (uint16_t)sp->subsampling_ver;
555
0
            break;
556
0
        case TIFFTAG_JPEGQTABLES:
557
0
            *va_arg(ap, uint32_t *) = (uint32_t)sp->qtable_offset_count;
558
0
            *va_arg(ap, const void **) = (const void *)sp->qtable_offset;
559
0
            break;
560
0
        case TIFFTAG_JPEGDCTABLES:
561
0
            *va_arg(ap, uint32_t *) = (uint32_t)sp->dctable_offset_count;
562
0
            *va_arg(ap, const void **) = (const void *)sp->dctable_offset;
563
0
            break;
564
0
        case TIFFTAG_JPEGACTABLES:
565
0
            *va_arg(ap, uint32_t *) = (uint32_t)sp->actable_offset_count;
566
0
            *va_arg(ap, const void **) = (const void *)sp->actable_offset;
567
0
            break;
568
0
        case TIFFTAG_JPEGPROC:
569
0
            *va_arg(ap, uint16_t *) = (uint16_t)sp->jpeg_proc;
570
0
            break;
571
0
        case TIFFTAG_JPEGRESTARTINTERVAL:
572
0
            *va_arg(ap, uint16_t *) = sp->restart_interval;
573
0
            break;
574
0
        default:
575
0
            return (*sp->vgetparent)(tif, tag, ap);
576
0
    }
577
0
    return (1);
578
0
}
579
580
static int OJPEGVSetField(TIFF *tif, uint32_t tag, va_list ap)
581
0
{
582
0
    static const char module[] = "OJPEGVSetField";
583
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
584
0
    uint32_t ma;
585
0
    uint64_t *mb;
586
0
    uint32_t n;
587
0
    const TIFFField *fip;
588
589
0
    switch (tag)
590
0
    {
591
0
        case TIFFTAG_JPEGIFOFFSET:
592
0
            sp->jpeg_interchange_format = (uint64_t)va_arg(ap, uint64_t);
593
0
            break;
594
0
        case TIFFTAG_JPEGIFBYTECOUNT:
595
0
            sp->jpeg_interchange_format_length = (uint64_t)va_arg(ap, uint64_t);
596
0
            break;
597
0
        case TIFFTAG_YCBCRSUBSAMPLING:
598
0
            sp->subsampling_tag = 1;
599
0
            sp->subsampling_hor = (uint8_t)va_arg(ap, uint16_vap);
600
0
            sp->subsampling_ver = (uint8_t)va_arg(ap, uint16_vap);
601
0
            tif->tif_dir.td_ycbcrsubsampling[0] = sp->subsampling_hor;
602
0
            tif->tif_dir.td_ycbcrsubsampling[1] = sp->subsampling_ver;
603
0
            break;
604
0
        case TIFFTAG_JPEGQTABLES:
605
0
            ma = (uint32_t)va_arg(ap, uint32_t);
606
0
            if (ma != 0)
607
0
            {
608
0
                if (ma > 3)
609
0
                {
610
0
                    TIFFErrorExtR(tif, module,
611
0
                                  "JpegQTables tag has incorrect count");
612
0
                    return (0);
613
0
                }
614
0
                sp->qtable_offset_count = (uint8_t)ma;
615
0
                mb = (uint64_t *)va_arg(ap, uint64_t *);
616
0
                for (n = 0; n < ma; n++)
617
0
                    sp->qtable_offset[n] = mb[n];
618
0
            }
619
0
            break;
620
0
        case TIFFTAG_JPEGDCTABLES:
621
0
            ma = (uint32_t)va_arg(ap, uint32_t);
622
0
            if (ma != 0)
623
0
            {
624
0
                if (ma > 3)
625
0
                {
626
0
                    TIFFErrorExtR(tif, module,
627
0
                                  "JpegDcTables tag has incorrect count");
628
0
                    return (0);
629
0
                }
630
0
                sp->dctable_offset_count = (uint8_t)ma;
631
0
                mb = (uint64_t *)va_arg(ap, uint64_t *);
632
0
                for (n = 0; n < ma; n++)
633
0
                    sp->dctable_offset[n] = mb[n];
634
0
            }
635
0
            break;
636
0
        case TIFFTAG_JPEGACTABLES:
637
0
            ma = (uint32_t)va_arg(ap, uint32_t);
638
0
            if (ma != 0)
639
0
            {
640
0
                if (ma > 3)
641
0
                {
642
0
                    TIFFErrorExtR(tif, module,
643
0
                                  "JpegAcTables tag has incorrect count");
644
0
                    return (0);
645
0
                }
646
0
                sp->actable_offset_count = (uint8_t)ma;
647
0
                mb = (uint64_t *)va_arg(ap, uint64_t *);
648
0
                for (n = 0; n < ma; n++)
649
0
                    sp->actable_offset[n] = mb[n];
650
0
            }
651
0
            break;
652
0
        case TIFFTAG_JPEGPROC:
653
0
            sp->jpeg_proc = (uint8_t)va_arg(ap, uint16_vap);
654
0
            break;
655
0
        case TIFFTAG_JPEGRESTARTINTERVAL:
656
0
            sp->restart_interval = (uint16_t)va_arg(ap, uint16_vap);
657
0
            break;
658
0
        default:
659
0
            return (*sp->vsetparent)(tif, tag, ap);
660
0
    }
661
0
    fip = TIFFFieldWithTag(tif, tag);
662
0
    if (fip == NULL) /* shouldn't happen */
663
0
        return (0);
664
0
    TIFFSetFieldBit(tif, fip->field_bit);
665
0
    tif->tif_flags |= TIFF_DIRTYDIRECT;
666
0
    return (1);
667
0
}
668
669
static void OJPEGPrintDir(TIFF *tif, FILE *fd, long flags)
670
0
{
671
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
672
0
    uint8_t m;
673
0
    (void)flags;
674
0
    assert(sp != NULL);
675
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGINTERCHANGEFORMAT))
676
0
        fprintf(fd, "  JpegInterchangeFormat: %" PRIu64 "\n",
677
0
                (uint64_t)sp->jpeg_interchange_format);
678
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGINTERCHANGEFORMATLENGTH))
679
0
        fprintf(fd, "  JpegInterchangeFormatLength: %" PRIu64 "\n",
680
0
                (uint64_t)sp->jpeg_interchange_format_length);
681
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGQTABLES))
682
0
    {
683
0
        fprintf(fd, "  JpegQTables:");
684
0
        for (m = 0; m < sp->qtable_offset_count; m++)
685
0
            fprintf(fd, " %" PRIu64, (uint64_t)sp->qtable_offset[m]);
686
0
        fprintf(fd, "\n");
687
0
    }
688
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGDCTABLES))
689
0
    {
690
0
        fprintf(fd, "  JpegDcTables:");
691
0
        for (m = 0; m < sp->dctable_offset_count; m++)
692
0
            fprintf(fd, " %" PRIu64, (uint64_t)sp->dctable_offset[m]);
693
0
        fprintf(fd, "\n");
694
0
    }
695
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGACTABLES))
696
0
    {
697
0
        fprintf(fd, "  JpegAcTables:");
698
0
        for (m = 0; m < sp->actable_offset_count; m++)
699
0
            fprintf(fd, " %" PRIu64, (uint64_t)sp->actable_offset[m]);
700
0
        fprintf(fd, "\n");
701
0
    }
702
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGPROC))
703
0
        fprintf(fd, "  JpegProc: %" PRIu8 "\n", sp->jpeg_proc);
704
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGRESTARTINTERVAL))
705
0
        fprintf(fd, "  JpegRestartInterval: %" PRIu16 "\n",
706
0
                sp->restart_interval);
707
0
    if (sp->printdir)
708
0
        (*sp->printdir)(tif, fd, flags);
709
0
}
710
711
static int OJPEGFixupTags(TIFF *tif)
712
0
{
713
0
    (void)tif;
714
0
    return (1);
715
0
}
716
717
static int OJPEGSetupDecode(TIFF *tif)
718
0
{
719
0
    static const char module[] = "OJPEGSetupDecode";
720
0
    TIFFWarningExtR(tif, module,
721
0
                    "Deprecated and troublesome old-style JPEG compression "
722
0
                    "mode, please convert to new-style JPEG compression and "
723
0
                    "notify vendor of writing software");
724
0
    return (1);
725
0
}
726
727
static int OJPEGPreDecode(TIFF *tif, uint16_t s)
728
0
{
729
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
730
0
    uint32_t m;
731
0
    if (sp->subsamplingcorrect_done == 0)
732
0
        OJPEGSubsamplingCorrect(tif);
733
0
    if (sp->readheader_done == 0)
734
0
    {
735
0
        if (OJPEGReadHeaderInfo(tif) == 0)
736
0
            return (0);
737
0
    }
738
0
    if (sp->sos_end[s].log == 0)
739
0
    {
740
0
        if (OJPEGReadSecondarySos(tif, s) == 0)
741
0
            return (0);
742
0
    }
743
0
    if (isTiled(tif))
744
0
        m = tif->tif_curtile;
745
0
    else
746
0
        m = tif->tif_curstrip;
747
0
    if ((sp->writeheader_done != 0) &&
748
0
        ((sp->write_cursample != s) || (sp->write_curstrile > m)))
749
0
    {
750
0
        if (sp->libjpeg_session_active != 0)
751
0
            OJPEGLibjpegSessionAbort(tif);
752
0
        sp->writeheader_done = 0;
753
0
    }
754
0
    if (sp->writeheader_done == 0)
755
0
    {
756
0
        sp->plane_sample_offset = (uint8_t)s;
757
0
        sp->write_cursample = s;
758
0
        sp->write_curstrile = s * tif->tif_dir.td_stripsperimage;
759
0
        if ((sp->in_buffer_file_pos_log == 0) ||
760
0
            (sp->in_buffer_file_pos - sp->in_buffer_togo !=
761
0
             sp->sos_end[s].in_buffer_file_pos))
762
0
        {
763
0
            sp->in_buffer_source = sp->sos_end[s].in_buffer_source;
764
0
            sp->in_buffer_next_strile = sp->sos_end[s].in_buffer_next_strile;
765
0
            sp->in_buffer_file_pos = sp->sos_end[s].in_buffer_file_pos;
766
0
            sp->in_buffer_file_pos_log = 0;
767
0
            sp->in_buffer_file_togo = sp->sos_end[s].in_buffer_file_togo;
768
0
            sp->in_buffer_togo = 0;
769
0
            sp->in_buffer_cur = 0;
770
0
        }
771
0
        if (OJPEGWriteHeaderInfo(tif) == 0)
772
0
            return (0);
773
0
    }
774
0
    while (sp->write_curstrile < m)
775
0
    {
776
0
        if (sp->libjpeg_jpeg_query_style == 0)
777
0
        {
778
0
            if (OJPEGPreDecodeSkipRaw(tif) == 0)
779
0
                return (0);
780
0
        }
781
0
        else
782
0
        {
783
0
            if (OJPEGPreDecodeSkipScanlines(tif) == 0)
784
0
                return (0);
785
0
        }
786
0
        sp->write_curstrile++;
787
0
    }
788
0
    sp->decoder_ok = 1;
789
0
    return (1);
790
0
}
791
792
static int OJPEGPreDecodeSkipRaw(TIFF *tif)
793
0
{
794
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
795
0
    uint32_t m;
796
0
    m = sp->lines_per_strile;
797
0
    if (sp->subsampling_convert_state != 0)
798
0
    {
799
0
        if (sp->subsampling_convert_clines - sp->subsampling_convert_state >= m)
800
0
        {
801
0
            sp->subsampling_convert_state += m;
802
0
            if (sp->subsampling_convert_state == sp->subsampling_convert_clines)
803
0
                sp->subsampling_convert_state = 0;
804
0
            return (1);
805
0
        }
806
0
        m -= sp->subsampling_convert_clines - sp->subsampling_convert_state;
807
0
        sp->subsampling_convert_state = 0;
808
0
        sp->error_in_raw_data_decoding = 0;
809
0
    }
810
0
    while (m >= sp->subsampling_convert_clines)
811
0
    {
812
0
        if (jpeg_read_raw_data_encap(sp, &(sp->libjpeg_jpeg_decompress_struct),
813
0
                                     sp->subsampling_convert_ycbcrimage,
814
0
                                     sp->subsampling_ver * 8) == 0)
815
0
            return (0);
816
0
        m -= sp->subsampling_convert_clines;
817
0
    }
818
0
    if (m > 0)
819
0
    {
820
0
        if (jpeg_read_raw_data_encap(sp, &(sp->libjpeg_jpeg_decompress_struct),
821
0
                                     sp->subsampling_convert_ycbcrimage,
822
0
                                     sp->subsampling_ver * 8) == 0)
823
0
            return (0);
824
0
        sp->subsampling_convert_state = m;
825
0
    }
826
0
    return (1);
827
0
}
828
829
static int OJPEGPreDecodeSkipScanlines(TIFF *tif)
830
0
{
831
0
    static const char module[] = "OJPEGPreDecodeSkipScanlines";
832
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
833
0
    uint32_t m;
834
0
    if (sp->skip_buffer == NULL)
835
0
    {
836
0
        sp->skip_buffer = _TIFFmallocExt(tif, sp->bytes_per_line);
837
0
        if (sp->skip_buffer == NULL)
838
0
        {
839
0
            TIFFErrorExtR(tif, module, "Out of memory");
840
0
            return (0);
841
0
        }
842
0
    }
843
0
    for (m = 0; m < sp->lines_per_strile; m++)
844
0
    {
845
0
        if (jpeg_read_scanlines_encap(sp, &(sp->libjpeg_jpeg_decompress_struct),
846
0
                                      &sp->skip_buffer, 1) == 0)
847
0
            return (0);
848
0
    }
849
0
    return (1);
850
0
}
851
852
static int OJPEGDecode(TIFF *tif, uint8_t *buf, tmsize_t cc, uint16_t s)
853
0
{
854
0
    static const char module[] = "OJPEGDecode";
855
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
856
0
    (void)s;
857
0
    if (!sp->decoder_ok)
858
0
    {
859
0
        TIFFErrorExtR(tif, module,
860
0
                      "Cannot decode: decoder not correctly initialized");
861
0
        return 0;
862
0
    }
863
0
    if (sp->libjpeg_session_active == 0)
864
0
    {
865
        /* This should normally not happen, except that it does when */
866
        /* using TIFFReadScanline() which calls OJPEGPostDecode() for */
867
        /* each scanline, which assumes that a whole strile was read */
868
        /* and may thus incorrectly consider it has read the whole image,
869
         * causing */
870
        /* OJPEGLibjpegSessionAbort() to be called prematurely. */
871
        /* Triggered by https://gitlab.com/libtiff/libtiff/-/issues/337 */
872
0
        TIFFErrorExtR(tif, module,
873
0
                      "Cannot decode: libjpeg_session_active == 0");
874
0
        return 0;
875
0
    }
876
0
    if (sp->error_in_raw_data_decoding)
877
0
    {
878
0
        return 0;
879
0
    }
880
0
    if (sp->libjpeg_jpeg_query_style == 0)
881
0
    {
882
0
        if (OJPEGDecodeRaw(tif, buf, cc) == 0)
883
0
            return (0);
884
0
    }
885
0
    else
886
0
    {
887
0
        if (OJPEGDecodeScanlines(tif, buf, cc) == 0)
888
0
            return (0);
889
0
    }
890
0
    return (1);
891
0
}
892
893
static int OJPEGDecodeRaw(TIFF *tif, uint8_t *buf, tmsize_t cc)
894
0
{
895
0
    static const char module[] = "OJPEGDecodeRaw";
896
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
897
0
    uint8_t *m;
898
0
    tmsize_t n;
899
0
    uint8_t *oy;
900
0
    uint8_t *ocb;
901
0
    uint8_t *ocr;
902
0
    uint8_t *p;
903
0
    uint32_t q;
904
0
    uint8_t *r;
905
0
    uint8_t sx, sy;
906
0
    if (cc % sp->bytes_per_line != 0)
907
0
    {
908
0
        TIFFErrorExtR(tif, module, "Fractional scanline not read");
909
0
        return (0);
910
0
    }
911
0
    assert(cc > 0);
912
0
    m = buf;
913
0
    n = cc;
914
0
    do
915
0
    {
916
0
        if (sp->subsampling_convert_state == 0)
917
0
        {
918
0
            if (jpeg_read_raw_data_encap(sp,
919
0
                                         &(sp->libjpeg_jpeg_decompress_struct),
920
0
                                         sp->subsampling_convert_ycbcrimage,
921
0
                                         sp->subsampling_ver * 8) == 0)
922
0
            {
923
0
                sp->error_in_raw_data_decoding = 1;
924
0
                return (0);
925
0
            }
926
0
        }
927
0
        oy = sp->subsampling_convert_ybuf +
928
0
             sp->subsampling_convert_state * sp->subsampling_ver *
929
0
                 sp->subsampling_convert_ylinelen;
930
0
        ocb = sp->subsampling_convert_cbbuf +
931
0
              sp->subsampling_convert_state * sp->subsampling_convert_clinelen;
932
0
        ocr = sp->subsampling_convert_crbuf +
933
0
              sp->subsampling_convert_state * sp->subsampling_convert_clinelen;
934
0
        p = m;
935
0
        for (q = 0; q < sp->subsampling_convert_clinelenout; q++)
936
0
        {
937
0
            r = oy;
938
0
            for (sy = 0; sy < sp->subsampling_ver; sy++)
939
0
            {
940
0
                for (sx = 0; sx < sp->subsampling_hor; sx++)
941
0
                    *p++ = *r++;
942
0
                r += sp->subsampling_convert_ylinelen - sp->subsampling_hor;
943
0
            }
944
0
            oy += sp->subsampling_hor;
945
0
            *p++ = *ocb++;
946
0
            *p++ = *ocr++;
947
0
        }
948
0
        sp->subsampling_convert_state++;
949
0
        if (sp->subsampling_convert_state == sp->subsampling_convert_clines)
950
0
            sp->subsampling_convert_state = 0;
951
0
        m += sp->bytes_per_line;
952
0
        n -= sp->bytes_per_line;
953
0
    } while (n > 0);
954
0
    return (1);
955
0
}
956
957
static int OJPEGDecodeScanlines(TIFF *tif, uint8_t *buf, tmsize_t cc)
958
0
{
959
0
    static const char module[] = "OJPEGDecodeScanlines";
960
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
961
0
    uint8_t *m;
962
0
    tmsize_t n;
963
0
    if (cc % sp->bytes_per_line != 0)
964
0
    {
965
0
        TIFFErrorExtR(tif, module, "Fractional scanline not read");
966
0
        return (0);
967
0
    }
968
0
    assert(cc > 0);
969
0
    m = buf;
970
0
    n = cc;
971
0
    do
972
0
    {
973
0
        if (jpeg_read_scanlines_encap(sp, &(sp->libjpeg_jpeg_decompress_struct),
974
0
                                      &m, 1) == 0)
975
0
            return (0);
976
0
        m += sp->bytes_per_line;
977
0
        n -= sp->bytes_per_line;
978
0
    } while (n > 0);
979
0
    return (1);
980
0
}
981
982
static void OJPEGPostDecode(TIFF *tif, uint8_t *buf, tmsize_t cc)
983
0
{
984
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
985
0
    (void)buf;
986
0
    (void)cc;
987
    /* This function somehow incorrectly assumes that a whole strile was read,
988
     */
989
    /* which is not true when TIFFReadScanline() is called, */
990
    /* and may thus incorrectly consider it has read the whole image, causing */
991
    /* OJPEGLibjpegSessionAbort() to be called prematurely. */
992
    /* So this logic should be fixed to take into account cc, or disable */
993
    /* the scan line reading interface. */
994
    /* Triggered by https://gitlab.com/libtiff/libtiff/-/issues/337 */
995
0
    sp->write_curstrile++;
996
0
    if (sp->write_curstrile % tif->tif_dir.td_stripsperimage == 0)
997
0
    {
998
0
        assert(sp->libjpeg_session_active != 0);
999
0
        OJPEGLibjpegSessionAbort(tif);
1000
0
        sp->writeheader_done = 0;
1001
0
    }
1002
0
}
1003
1004
static int OJPEGSetupEncode(TIFF *tif)
1005
0
{
1006
0
    static const char module[] = "OJPEGSetupEncode";
1007
0
    TIFFErrorExtR(
1008
0
        tif, module,
1009
0
        "OJPEG encoding not supported; use new-style JPEG compression instead");
1010
0
    return (0);
1011
0
}
1012
1013
static int OJPEGPreEncode(TIFF *tif, uint16_t s)
1014
0
{
1015
0
    static const char module[] = "OJPEGPreEncode";
1016
0
    (void)s;
1017
0
    TIFFErrorExtR(
1018
0
        tif, module,
1019
0
        "OJPEG encoding not supported; use new-style JPEG compression instead");
1020
0
    return (0);
1021
0
}
1022
1023
static int OJPEGEncode(TIFF *tif, uint8_t *buf, tmsize_t cc, uint16_t s)
1024
0
{
1025
0
    static const char module[] = "OJPEGEncode";
1026
0
    (void)buf;
1027
0
    (void)cc;
1028
0
    (void)s;
1029
0
    TIFFErrorExtR(
1030
0
        tif, module,
1031
0
        "OJPEG encoding not supported; use new-style JPEG compression instead");
1032
0
    return (0);
1033
0
}
1034
1035
static int OJPEGPostEncode(TIFF *tif)
1036
0
{
1037
0
    static const char module[] = "OJPEGPostEncode";
1038
0
    TIFFErrorExtR(
1039
0
        tif, module,
1040
0
        "OJPEG encoding not supported; use new-style JPEG compression instead");
1041
0
    return (0);
1042
0
}
1043
1044
static void OJPEGCleanup(TIFF *tif)
1045
0
{
1046
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1047
0
    if (sp != 0)
1048
0
    {
1049
0
        tif->tif_tagmethods.vgetfield = sp->vgetparent;
1050
0
        tif->tif_tagmethods.vsetfield = sp->vsetparent;
1051
0
        tif->tif_tagmethods.printdir = sp->printdir;
1052
0
        if (sp->qtable[0] != 0)
1053
0
            _TIFFfreeExt(tif, sp->qtable[0]);
1054
0
        if (sp->qtable[1] != 0)
1055
0
            _TIFFfreeExt(tif, sp->qtable[1]);
1056
0
        if (sp->qtable[2] != 0)
1057
0
            _TIFFfreeExt(tif, sp->qtable[2]);
1058
0
        if (sp->qtable[3] != 0)
1059
0
            _TIFFfreeExt(tif, sp->qtable[3]);
1060
0
        if (sp->dctable[0] != 0)
1061
0
            _TIFFfreeExt(tif, sp->dctable[0]);
1062
0
        if (sp->dctable[1] != 0)
1063
0
            _TIFFfreeExt(tif, sp->dctable[1]);
1064
0
        if (sp->dctable[2] != 0)
1065
0
            _TIFFfreeExt(tif, sp->dctable[2]);
1066
0
        if (sp->dctable[3] != 0)
1067
0
            _TIFFfreeExt(tif, sp->dctable[3]);
1068
0
        if (sp->actable[0] != 0)
1069
0
            _TIFFfreeExt(tif, sp->actable[0]);
1070
0
        if (sp->actable[1] != 0)
1071
0
            _TIFFfreeExt(tif, sp->actable[1]);
1072
0
        if (sp->actable[2] != 0)
1073
0
            _TIFFfreeExt(tif, sp->actable[2]);
1074
0
        if (sp->actable[3] != 0)
1075
0
            _TIFFfreeExt(tif, sp->actable[3]);
1076
0
        if (sp->libjpeg_session_active != 0)
1077
0
            OJPEGLibjpegSessionAbort(tif);
1078
0
        if (sp->subsampling_convert_ycbcrbuf != 0)
1079
0
            _TIFFfreeExt(tif, sp->subsampling_convert_ycbcrbuf);
1080
0
        if (sp->subsampling_convert_ycbcrimage != 0)
1081
0
            _TIFFfreeExt(tif, sp->subsampling_convert_ycbcrimage);
1082
0
        if (sp->skip_buffer != 0)
1083
0
            _TIFFfreeExt(tif, sp->skip_buffer);
1084
0
        _TIFFfreeExt(tif, sp);
1085
0
        tif->tif_data = NULL;
1086
0
        _TIFFSetDefaultCompressionState(tif);
1087
0
    }
1088
0
}
1089
1090
static void OJPEGSubsamplingCorrect(TIFF *tif)
1091
0
{
1092
0
    static const char module[] = "OJPEGSubsamplingCorrect";
1093
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1094
0
    uint8_t mh;
1095
0
    uint8_t mv;
1096
1097
0
    assert(sp->subsamplingcorrect_done == 0);
1098
0
    if ((tif->tif_dir.td_samplesperpixel != 3) ||
1099
0
        ((tif->tif_dir.td_photometric != PHOTOMETRIC_YCBCR) &&
1100
0
         (tif->tif_dir.td_photometric != PHOTOMETRIC_ITULAB)))
1101
0
    {
1102
0
        if (sp->subsampling_tag != 0)
1103
0
            TIFFWarningExtR(tif, module,
1104
0
                            "Subsampling tag not appropriate for this "
1105
0
                            "Photometric and/or SamplesPerPixel");
1106
0
        sp->subsampling_hor = 1;
1107
0
        sp->subsampling_ver = 1;
1108
0
        sp->subsampling_force_desubsampling_inside_decompression = 0;
1109
0
    }
1110
0
    else
1111
0
    {
1112
0
        sp->subsamplingcorrect_done = 1;
1113
0
        mh = sp->subsampling_hor;
1114
0
        mv = sp->subsampling_ver;
1115
0
        sp->subsamplingcorrect = 1;
1116
0
        OJPEGReadHeaderInfoSec(tif);
1117
0
        if (sp->subsampling_force_desubsampling_inside_decompression != 0)
1118
0
        {
1119
0
            sp->subsampling_hor = 1;
1120
0
            sp->subsampling_ver = 1;
1121
0
        }
1122
0
        sp->subsamplingcorrect = 0;
1123
0
        if (((sp->subsampling_hor != mh) || (sp->subsampling_ver != mv)) &&
1124
0
            (sp->subsampling_force_desubsampling_inside_decompression == 0))
1125
0
        {
1126
0
            if (sp->subsampling_tag == 0)
1127
0
                TIFFWarningExtR(
1128
0
                    tif, module,
1129
0
                    "Subsampling tag is not set, yet subsampling inside JPEG "
1130
0
                    "data [%" PRIu8 ",%" PRIu8
1131
0
                    "] does not match default values [2,2]; assuming "
1132
0
                    "subsampling inside JPEG data is correct",
1133
0
                    sp->subsampling_hor, sp->subsampling_ver);
1134
0
            else
1135
0
                TIFFWarningExtR(
1136
0
                    tif, module,
1137
0
                    "Subsampling inside JPEG data [%" PRIu8 ",%" PRIu8
1138
0
                    "] does not match subsampling tag values [%" PRIu8
1139
0
                    ",%" PRIu8
1140
0
                    "]; assuming subsampling inside JPEG data is correct",
1141
0
                    sp->subsampling_hor, sp->subsampling_ver, mh, mv);
1142
0
        }
1143
0
        if (sp->subsampling_force_desubsampling_inside_decompression != 0)
1144
0
        {
1145
0
            if (sp->subsampling_tag == 0)
1146
0
                TIFFWarningExtR(
1147
0
                    tif, module,
1148
0
                    "Subsampling tag is not set, yet subsampling inside JPEG "
1149
0
                    "data does not match default values [2,2] (nor any other "
1150
0
                    "values allowed in TIFF); assuming subsampling inside JPEG "
1151
0
                    "data is correct and desubsampling inside JPEG "
1152
0
                    "decompression");
1153
0
            else
1154
0
                TIFFWarningExtR(
1155
0
                    tif, module,
1156
0
                    "Subsampling inside JPEG data does not match subsampling "
1157
0
                    "tag values [%" PRIu8 ",%" PRIu8
1158
0
                    "] (nor any other values allowed in TIFF); assuming "
1159
0
                    "subsampling inside JPEG data is correct and desubsampling "
1160
0
                    "inside JPEG decompression",
1161
0
                    mh, mv);
1162
0
        }
1163
0
        if (sp->subsampling_force_desubsampling_inside_decompression == 0)
1164
0
        {
1165
0
            if (sp->subsampling_hor < sp->subsampling_ver)
1166
0
                TIFFWarningExtR(tif, module,
1167
0
                                "Subsampling values [%" PRIu8 ",%" PRIu8
1168
0
                                "] are not allowed in TIFF",
1169
0
                                sp->subsampling_hor, sp->subsampling_ver);
1170
0
        }
1171
0
    }
1172
0
    sp->subsamplingcorrect_done = 1;
1173
0
}
1174
1175
static int OJPEGReadHeaderInfo(TIFF *tif)
1176
0
{
1177
0
    static const char module[] = "OJPEGReadHeaderInfo";
1178
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1179
0
    assert(sp->readheader_done == 0);
1180
0
    sp->image_width = tif->tif_dir.td_imagewidth;
1181
0
    sp->image_length = tif->tif_dir.td_imagelength;
1182
0
    if (isTiled(tif))
1183
0
    {
1184
0
        sp->strile_width = tif->tif_dir.td_tilewidth;
1185
0
        sp->strile_length = tif->tif_dir.td_tilelength;
1186
0
        sp->strile_length_total =
1187
0
            ((sp->image_length + sp->strile_length - 1) / sp->strile_length) *
1188
0
            sp->strile_length;
1189
0
    }
1190
0
    else
1191
0
    {
1192
0
        sp->strile_width = sp->image_width;
1193
0
        sp->strile_length = tif->tif_dir.td_rowsperstrip;
1194
0
        if (sp->strile_length == (uint32_t)-1)
1195
0
            sp->strile_length = sp->image_length;
1196
0
        sp->strile_length_total = sp->image_length;
1197
0
    }
1198
0
    if (tif->tif_dir.td_samplesperpixel == 1)
1199
0
    {
1200
0
        sp->samples_per_pixel = 1;
1201
0
        sp->plane_sample_offset = 0;
1202
0
        sp->samples_per_pixel_per_plane = sp->samples_per_pixel;
1203
0
        sp->subsampling_hor = 1;
1204
0
        sp->subsampling_ver = 1;
1205
0
    }
1206
0
    else
1207
0
    {
1208
0
        if (tif->tif_dir.td_samplesperpixel != 3)
1209
0
        {
1210
0
            TIFFErrorExtR(tif, module,
1211
0
                          "SamplesPerPixel %" PRIu8
1212
0
                          " not supported for this compression scheme",
1213
0
                          sp->samples_per_pixel);
1214
0
            return (0);
1215
0
        }
1216
0
        sp->samples_per_pixel = 3;
1217
0
        sp->plane_sample_offset = 0;
1218
0
        if (tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG)
1219
0
            sp->samples_per_pixel_per_plane = 3;
1220
0
        else
1221
0
            sp->samples_per_pixel_per_plane = 1;
1222
0
    }
1223
0
    if (sp->strile_length < sp->image_length)
1224
0
    {
1225
0
        if (((sp->subsampling_hor != 1) && (sp->subsampling_hor != 2) &&
1226
0
             (sp->subsampling_hor != 4)) ||
1227
0
            ((sp->subsampling_ver != 1) && (sp->subsampling_ver != 2) &&
1228
0
             (sp->subsampling_ver != 4)))
1229
0
        {
1230
0
            TIFFErrorExtR(tif, module, "Invalid subsampling values");
1231
0
            return (0);
1232
0
        }
1233
0
        if (sp->strile_length % (sp->subsampling_ver * 8) != 0)
1234
0
        {
1235
0
            TIFFErrorExtR(tif, module,
1236
0
                          "Incompatible vertical subsampling and image "
1237
0
                          "strip/tile length");
1238
0
            return (0);
1239
0
        }
1240
0
        sp->restart_interval =
1241
0
            (uint16_t)(((sp->strile_width + sp->subsampling_hor * 8 - 1) /
1242
0
                        (sp->subsampling_hor * 8)) *
1243
0
                       (sp->strile_length / (sp->subsampling_ver * 8)));
1244
0
    }
1245
0
    if (OJPEGReadHeaderInfoSec(tif) == 0)
1246
0
        return (0);
1247
0
    sp->sos_end[0].log = 1;
1248
0
    sp->sos_end[0].in_buffer_source = sp->in_buffer_source;
1249
0
    sp->sos_end[0].in_buffer_next_strile = sp->in_buffer_next_strile;
1250
0
    sp->sos_end[0].in_buffer_file_pos =
1251
0
        sp->in_buffer_file_pos - sp->in_buffer_togo;
1252
0
    sp->sos_end[0].in_buffer_file_togo =
1253
0
        sp->in_buffer_file_togo + sp->in_buffer_togo;
1254
0
    sp->readheader_done = 1;
1255
0
    return (1);
1256
0
}
1257
1258
static int OJPEGReadSecondarySos(TIFF *tif, uint16_t s)
1259
0
{
1260
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1261
0
    uint8_t m;
1262
0
    assert(s > 0);
1263
0
    assert(s < 3);
1264
0
    assert(sp->sos_end[0].log != 0);
1265
0
    assert(sp->sos_end[s].log == 0);
1266
0
    sp->plane_sample_offset = (uint8_t)(s - 1);
1267
0
    while (sp->sos_end[sp->plane_sample_offset].log == 0)
1268
0
        sp->plane_sample_offset--;
1269
0
    sp->in_buffer_source =
1270
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_source;
1271
0
    sp->in_buffer_next_strile =
1272
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_next_strile;
1273
0
    sp->in_buffer_file_pos =
1274
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_file_pos;
1275
0
    sp->in_buffer_file_pos_log = 0;
1276
0
    sp->in_buffer_file_togo =
1277
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_file_togo;
1278
0
    sp->in_buffer_togo = 0;
1279
0
    sp->in_buffer_cur = 0;
1280
0
    while (sp->plane_sample_offset < s)
1281
0
    {
1282
0
        do
1283
0
        {
1284
0
            if (OJPEGReadByte(sp, &m) == 0)
1285
0
                return (0);
1286
0
            if (m == 255)
1287
0
            {
1288
0
                do
1289
0
                {
1290
0
                    if (OJPEGReadByte(sp, &m) == 0)
1291
0
                        return (0);
1292
0
                    if (m != 255)
1293
0
                        break;
1294
0
                } while (1);
1295
0
                if (m == JPEG_MARKER_SOS)
1296
0
                    break;
1297
0
            }
1298
0
        } while (1);
1299
0
        sp->plane_sample_offset++;
1300
0
        if (OJPEGReadHeaderInfoSecStreamSos(tif) == 0)
1301
0
            return (0);
1302
0
        sp->sos_end[sp->plane_sample_offset].log = 1;
1303
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_source =
1304
0
            sp->in_buffer_source;
1305
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_next_strile =
1306
0
            sp->in_buffer_next_strile;
1307
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_file_pos =
1308
0
            sp->in_buffer_file_pos - sp->in_buffer_togo;
1309
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_file_togo =
1310
0
            sp->in_buffer_file_togo + sp->in_buffer_togo;
1311
0
    }
1312
0
    return (1);
1313
0
}
1314
1315
static int OJPEGWriteHeaderInfo(TIFF *tif)
1316
0
{
1317
0
    static const char module[] = "OJPEGWriteHeaderInfo";
1318
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1319
0
    uint8_t **m;
1320
0
    uint32_t n;
1321
    /* if a previous attempt failed, don't try again */
1322
0
    if (sp->libjpeg_session_active != 0)
1323
0
        return 0;
1324
0
    sp->out_state = ososSoi;
1325
0
    sp->restart_index = 0;
1326
0
    jpeg_std_error(&(sp->libjpeg_jpeg_error_mgr));
1327
0
    sp->libjpeg_jpeg_error_mgr.output_message =
1328
0
        OJPEGLibjpegJpegErrorMgrOutputMessage;
1329
0
    sp->libjpeg_jpeg_error_mgr.error_exit = OJPEGLibjpegJpegErrorMgrErrorExit;
1330
0
    sp->libjpeg_jpeg_decompress_struct.err = &(sp->libjpeg_jpeg_error_mgr);
1331
0
    sp->libjpeg_jpeg_decompress_struct.client_data = (void *)tif;
1332
0
    if (jpeg_create_decompress_encap(
1333
0
            sp, &(sp->libjpeg_jpeg_decompress_struct)) == 0)
1334
0
        return (0);
1335
0
    sp->libjpeg_session_active = 1;
1336
0
    sp->libjpeg_jpeg_source_mgr.bytes_in_buffer = 0;
1337
0
    sp->libjpeg_jpeg_source_mgr.init_source =
1338
0
        OJPEGLibjpegJpegSourceMgrInitSource;
1339
0
    sp->libjpeg_jpeg_source_mgr.fill_input_buffer =
1340
0
        OJPEGLibjpegJpegSourceMgrFillInputBuffer;
1341
0
    sp->libjpeg_jpeg_source_mgr.skip_input_data =
1342
0
        OJPEGLibjpegJpegSourceMgrSkipInputData;
1343
0
    sp->libjpeg_jpeg_source_mgr.resync_to_restart =
1344
0
        OJPEGLibjpegJpegSourceMgrResyncToRestart;
1345
0
    sp->libjpeg_jpeg_source_mgr.term_source =
1346
0
        OJPEGLibjpegJpegSourceMgrTermSource;
1347
0
    sp->libjpeg_jpeg_decompress_struct.src = &(sp->libjpeg_jpeg_source_mgr);
1348
0
    if (jpeg_read_header_encap(sp, &(sp->libjpeg_jpeg_decompress_struct), 1) ==
1349
0
        0)
1350
0
        return (0);
1351
0
    if ((sp->subsampling_force_desubsampling_inside_decompression == 0) &&
1352
0
        (sp->samples_per_pixel_per_plane > 1))
1353
0
    {
1354
0
        sp->libjpeg_jpeg_decompress_struct.raw_data_out = 1;
1355
0
#if JPEG_LIB_VERSION >= 70
1356
0
        sp->libjpeg_jpeg_decompress_struct.do_fancy_upsampling = FALSE;
1357
0
#endif
1358
0
        sp->libjpeg_jpeg_query_style = 0;
1359
0
        if (sp->subsampling_convert_log == 0)
1360
0
        {
1361
0
            assert(sp->subsampling_convert_ycbcrbuf == 0);
1362
0
            assert(sp->subsampling_convert_ycbcrimage == 0);
1363
            /* Check for division by zero. */
1364
0
            if (sp->subsampling_hor == 0 || sp->subsampling_ver == 0)
1365
0
                return (0);
1366
0
            sp->subsampling_convert_ylinelen =
1367
0
                ((sp->strile_width + sp->subsampling_hor * 8 - 1) /
1368
0
                 (sp->subsampling_hor * 8) * sp->subsampling_hor * 8);
1369
0
            sp->subsampling_convert_ylines = sp->subsampling_ver * 8;
1370
0
            sp->subsampling_convert_clinelen =
1371
0
                sp->subsampling_convert_ylinelen / sp->subsampling_hor;
1372
0
            sp->subsampling_convert_clines = 8;
1373
0
            sp->subsampling_convert_ybuflen = sp->subsampling_convert_ylinelen *
1374
0
                                              sp->subsampling_convert_ylines;
1375
0
            sp->subsampling_convert_cbuflen = sp->subsampling_convert_clinelen *
1376
0
                                              sp->subsampling_convert_clines;
1377
0
            sp->subsampling_convert_ycbcrbuflen =
1378
0
                sp->subsampling_convert_ybuflen +
1379
0
                2 * sp->subsampling_convert_cbuflen;
1380
            /* The calloc is not normally necessary, except in some edge/broken
1381
             * cases */
1382
            /* for example for a tiled image of height 1 with a tile height of 1
1383
             * and subsampling_hor=subsampling_ver=2 */
1384
            /* In that case, libjpeg will only fill the 8 first lines of the 16
1385
             * lines */
1386
            /* See https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16844
1387
             */
1388
            /* Even if this case is allowed (?), its handling is broken because
1389
             * OJPEGPreDecode() should also likely */
1390
            /* reset subsampling_convert_state to 0 when changing tile. */
1391
0
            sp->subsampling_convert_ycbcrbuf =
1392
0
                _TIFFcallocExt(tif, 1, sp->subsampling_convert_ycbcrbuflen);
1393
0
            if (sp->subsampling_convert_ycbcrbuf == 0)
1394
0
            {
1395
0
                TIFFErrorExtR(tif, module, "Out of memory");
1396
0
                return (0);
1397
0
            }
1398
0
            sp->subsampling_convert_ybuf = sp->subsampling_convert_ycbcrbuf;
1399
0
            sp->subsampling_convert_cbbuf =
1400
0
                sp->subsampling_convert_ybuf + sp->subsampling_convert_ybuflen;
1401
0
            sp->subsampling_convert_crbuf =
1402
0
                sp->subsampling_convert_cbbuf + sp->subsampling_convert_cbuflen;
1403
0
            sp->subsampling_convert_ycbcrimagelen =
1404
0
                3 + sp->subsampling_convert_ylines +
1405
0
                2 * sp->subsampling_convert_clines;
1406
0
            sp->subsampling_convert_ycbcrimage = _TIFFmallocExt(
1407
0
                tif, sp->subsampling_convert_ycbcrimagelen * sizeof(uint8_t *));
1408
0
            if (sp->subsampling_convert_ycbcrimage == 0)
1409
0
            {
1410
0
                TIFFErrorExtR(tif, module, "Out of memory");
1411
0
                return (0);
1412
0
            }
1413
0
            m = sp->subsampling_convert_ycbcrimage;
1414
0
            *m++ = (uint8_t *)(sp->subsampling_convert_ycbcrimage + 3);
1415
0
            *m++ = (uint8_t *)(sp->subsampling_convert_ycbcrimage + 3 +
1416
0
                               sp->subsampling_convert_ylines);
1417
0
            *m++ = (uint8_t *)(sp->subsampling_convert_ycbcrimage + 3 +
1418
0
                               sp->subsampling_convert_ylines +
1419
0
                               sp->subsampling_convert_clines);
1420
0
            for (n = 0; n < sp->subsampling_convert_ylines; n++)
1421
0
                *m++ = sp->subsampling_convert_ybuf +
1422
0
                       n * sp->subsampling_convert_ylinelen;
1423
0
            for (n = 0; n < sp->subsampling_convert_clines; n++)
1424
0
                *m++ = sp->subsampling_convert_cbbuf +
1425
0
                       n * sp->subsampling_convert_clinelen;
1426
0
            for (n = 0; n < sp->subsampling_convert_clines; n++)
1427
0
                *m++ = sp->subsampling_convert_crbuf +
1428
0
                       n * sp->subsampling_convert_clinelen;
1429
0
            sp->subsampling_convert_clinelenout =
1430
0
                sp->strile_width / sp->subsampling_hor +
1431
0
                ((sp->strile_width % sp->subsampling_hor) != 0 ? 1 : 0);
1432
0
            sp->subsampling_convert_state = 0;
1433
0
            sp->error_in_raw_data_decoding = 0;
1434
0
            sp->bytes_per_line =
1435
0
                sp->subsampling_convert_clinelenout *
1436
0
                (sp->subsampling_ver * sp->subsampling_hor + 2);
1437
0
            sp->lines_per_strile =
1438
0
                sp->strile_length / sp->subsampling_ver +
1439
0
                ((sp->strile_length % sp->subsampling_ver) != 0 ? 1 : 0);
1440
0
            sp->subsampling_convert_log = 1;
1441
0
        }
1442
0
    }
1443
0
    else
1444
0
    {
1445
0
        sp->libjpeg_jpeg_decompress_struct.jpeg_color_space = JCS_UNKNOWN;
1446
0
        sp->libjpeg_jpeg_decompress_struct.out_color_space = JCS_UNKNOWN;
1447
0
        sp->libjpeg_jpeg_query_style = 1;
1448
0
        sp->bytes_per_line = sp->samples_per_pixel_per_plane * sp->strile_width;
1449
0
        sp->lines_per_strile = sp->strile_length;
1450
0
    }
1451
0
    if (jpeg_start_decompress_encap(sp,
1452
0
                                    &(sp->libjpeg_jpeg_decompress_struct)) == 0)
1453
0
        return (0);
1454
0
    if (sp->libjpeg_jpeg_decompress_struct.image_width != sp->strile_width)
1455
0
    {
1456
0
        TIFFErrorExtR(tif, module,
1457
0
                      "jpeg_start_decompress() returned image_width = %u, "
1458
0
                      "expected %" PRIu32,
1459
0
                      sp->libjpeg_jpeg_decompress_struct.image_width,
1460
0
                      sp->strile_width);
1461
0
        return 0;
1462
0
    }
1463
0
    if (sp->libjpeg_jpeg_decompress_struct.max_h_samp_factor !=
1464
0
            sp->subsampling_hor ||
1465
0
        sp->libjpeg_jpeg_decompress_struct.max_v_samp_factor !=
1466
0
            sp->subsampling_ver)
1467
0
    {
1468
0
        TIFFErrorExtR(tif, module,
1469
0
                      "jpeg_start_decompress() returned max_h_samp_factor = %d "
1470
0
                      "and max_v_samp_factor = %d, expected %" PRIu8
1471
0
                      " and %" PRIu8,
1472
0
                      sp->libjpeg_jpeg_decompress_struct.max_h_samp_factor,
1473
0
                      sp->libjpeg_jpeg_decompress_struct.max_v_samp_factor,
1474
0
                      sp->subsampling_hor, sp->subsampling_ver);
1475
0
        return 0;
1476
0
    }
1477
1478
0
    sp->writeheader_done = 1;
1479
0
    return (1);
1480
0
}
1481
1482
static void OJPEGLibjpegSessionAbort(TIFF *tif)
1483
0
{
1484
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1485
0
    assert(sp->libjpeg_session_active != 0);
1486
0
    jpeg_destroy((jpeg_common_struct *)(&(sp->libjpeg_jpeg_decompress_struct)));
1487
0
    sp->libjpeg_session_active = 0;
1488
0
}
1489
1490
static int OJPEGReadHeaderInfoSec(TIFF *tif)
1491
0
{
1492
0
    static const char module[] = "OJPEGReadHeaderInfoSec";
1493
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1494
0
    uint8_t m;
1495
0
    uint16_t n;
1496
0
    uint8_t o;
1497
0
    if (sp->file_size == 0)
1498
0
        sp->file_size = TIFFGetFileSize(tif);
1499
0
    if (sp->jpeg_interchange_format != 0)
1500
0
    {
1501
0
        if (sp->jpeg_interchange_format >= sp->file_size)
1502
0
        {
1503
0
            sp->jpeg_interchange_format = 0;
1504
0
            sp->jpeg_interchange_format_length = 0;
1505
0
        }
1506
0
        else
1507
0
        {
1508
0
            if ((sp->jpeg_interchange_format_length == 0) ||
1509
0
                (sp->jpeg_interchange_format >
1510
0
                 UINT64_MAX - sp->jpeg_interchange_format_length) ||
1511
0
                (sp->jpeg_interchange_format +
1512
0
                     sp->jpeg_interchange_format_length >
1513
0
                 sp->file_size))
1514
0
                sp->jpeg_interchange_format_length =
1515
0
                    sp->file_size - sp->jpeg_interchange_format;
1516
0
        }
1517
0
    }
1518
0
    sp->in_buffer_source = osibsNotSetYet;
1519
0
    sp->in_buffer_next_strile = 0;
1520
0
    sp->in_buffer_strile_count = tif->tif_dir.td_nstrips;
1521
0
    sp->in_buffer_file_togo = 0;
1522
0
    sp->in_buffer_togo = 0;
1523
0
    do
1524
0
    {
1525
0
        if (OJPEGReadBytePeek(sp, &m) == 0)
1526
0
            return (0);
1527
0
        if (m != 255)
1528
0
            break;
1529
0
        OJPEGReadByteAdvance(sp);
1530
0
        do
1531
0
        {
1532
0
            if (OJPEGReadByte(sp, &m) == 0)
1533
0
                return (0);
1534
0
        } while (m == 255);
1535
0
        switch (m)
1536
0
        {
1537
0
            case JPEG_MARKER_SOI:
1538
                /* this type of marker has no data, and should be skipped */
1539
0
                break;
1540
0
            case JPEG_MARKER_COM:
1541
0
            case JPEG_MARKER_APP0:
1542
0
            case JPEG_MARKER_APP0 + 1:
1543
0
            case JPEG_MARKER_APP0 + 2:
1544
0
            case JPEG_MARKER_APP0 + 3:
1545
0
            case JPEG_MARKER_APP0 + 4:
1546
0
            case JPEG_MARKER_APP0 + 5:
1547
0
            case JPEG_MARKER_APP0 + 6:
1548
0
            case JPEG_MARKER_APP0 + 7:
1549
0
            case JPEG_MARKER_APP0 + 8:
1550
0
            case JPEG_MARKER_APP0 + 9:
1551
0
            case JPEG_MARKER_APP0 + 10:
1552
0
            case JPEG_MARKER_APP0 + 11:
1553
0
            case JPEG_MARKER_APP0 + 12:
1554
0
            case JPEG_MARKER_APP0 + 13:
1555
0
            case JPEG_MARKER_APP0 + 14:
1556
0
            case JPEG_MARKER_APP0 + 15:
1557
                /* this type of marker has data, but it has no use to us (and no
1558
                 * place here) and should be skipped */
1559
0
                if (OJPEGReadWord(sp, &n) == 0)
1560
0
                    return (0);
1561
0
                if (n < 2)
1562
0
                {
1563
0
                    if (sp->subsamplingcorrect == 0)
1564
0
                        TIFFErrorExtR(tif, module, "Corrupt JPEG data");
1565
0
                    return (0);
1566
0
                }
1567
0
                if (n > 2)
1568
0
                    OJPEGReadSkip(sp, n - 2);
1569
0
                break;
1570
0
            case JPEG_MARKER_DRI:
1571
0
                if (OJPEGReadHeaderInfoSecStreamDri(tif) == 0)
1572
0
                    return (0);
1573
0
                break;
1574
0
            case JPEG_MARKER_DQT:
1575
0
                if (OJPEGReadHeaderInfoSecStreamDqt(tif) == 0)
1576
0
                    return (0);
1577
0
                break;
1578
0
            case JPEG_MARKER_DHT:
1579
0
                if (OJPEGReadHeaderInfoSecStreamDht(tif) == 0)
1580
0
                    return (0);
1581
0
                break;
1582
0
            case JPEG_MARKER_SOF0:
1583
0
            case JPEG_MARKER_SOF1:
1584
0
            case JPEG_MARKER_SOF3:
1585
0
                if (OJPEGReadHeaderInfoSecStreamSof(tif, m) == 0)
1586
0
                    return (0);
1587
0
                if (sp->subsamplingcorrect != 0)
1588
0
                    return (1);
1589
0
                break;
1590
0
            case JPEG_MARKER_SOS:
1591
0
                if (sp->subsamplingcorrect != 0)
1592
0
                    return (1);
1593
0
                assert(sp->plane_sample_offset == 0);
1594
0
                if (OJPEGReadHeaderInfoSecStreamSos(tif) == 0)
1595
0
                    return (0);
1596
0
                break;
1597
0
            default:
1598
0
                TIFFErrorExtR(tif, module,
1599
0
                              "Unknown marker type %" PRIu8 " in JPEG data", m);
1600
0
                return (0);
1601
0
        }
1602
0
    } while (m != JPEG_MARKER_SOS);
1603
0
    if (sp->subsamplingcorrect)
1604
0
        return (1);
1605
0
    if (sp->sof_log == 0)
1606
0
    {
1607
0
        if (OJPEGReadHeaderInfoSecTablesQTable(tif) == 0)
1608
0
            return (0);
1609
0
        sp->sof_marker_id = JPEG_MARKER_SOF0;
1610
0
        for (o = 0; o < sp->samples_per_pixel; o++)
1611
0
            sp->sof_c[o] = o;
1612
0
        sp->sof_hv[0] = ((sp->subsampling_hor << 4) | sp->subsampling_ver);
1613
0
        for (o = 1; o < sp->samples_per_pixel; o++)
1614
0
            sp->sof_hv[o] = 17;
1615
0
        sp->sof_x = sp->strile_width;
1616
0
        sp->sof_y = sp->strile_length_total;
1617
0
        sp->sof_log = 1;
1618
0
        if (OJPEGReadHeaderInfoSecTablesDcTable(tif) == 0)
1619
0
            return (0);
1620
0
        if (OJPEGReadHeaderInfoSecTablesAcTable(tif) == 0)
1621
0
            return (0);
1622
0
        for (o = 1; o < sp->samples_per_pixel; o++)
1623
0
            sp->sos_cs[o] = o;
1624
0
    }
1625
0
    return (1);
1626
0
}
1627
1628
static int OJPEGReadHeaderInfoSecStreamDri(TIFF *tif)
1629
0
{
1630
    /* This could easily cause trouble in some cases... but no such cases have
1631
       occurred so far */
1632
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamDri";
1633
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1634
0
    uint16_t m;
1635
0
    if (OJPEGReadWord(sp, &m) == 0)
1636
0
        return (0);
1637
0
    if (m != 4)
1638
0
    {
1639
0
        TIFFErrorExtR(tif, module, "Corrupt DRI marker in JPEG data");
1640
0
        return (0);
1641
0
    }
1642
0
    if (OJPEGReadWord(sp, &m) == 0)
1643
0
        return (0);
1644
0
    sp->restart_interval = m;
1645
0
    return (1);
1646
0
}
1647
1648
static int OJPEGReadHeaderInfoSecStreamDqt(TIFF *tif)
1649
0
{
1650
    /* this is a table marker, and it is to be saved as a whole for exact
1651
     * pushing on the jpeg stream later on */
1652
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamDqt";
1653
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1654
0
    uint16_t m;
1655
0
    uint32_t na;
1656
0
    uint8_t *nb;
1657
0
    uint8_t o;
1658
0
    if (OJPEGReadWord(sp, &m) == 0)
1659
0
        return (0);
1660
0
    if (m <= 2)
1661
0
    {
1662
0
        if (sp->subsamplingcorrect == 0)
1663
0
            TIFFErrorExtR(tif, module, "Corrupt DQT marker in JPEG data");
1664
0
        return (0);
1665
0
    }
1666
0
    if (sp->subsamplingcorrect != 0)
1667
0
        OJPEGReadSkip(sp, m - 2);
1668
0
    else
1669
0
    {
1670
0
        m -= 2;
1671
0
        do
1672
0
        {
1673
0
            if (m < 65)
1674
0
            {
1675
0
                TIFFErrorExtR(tif, module, "Corrupt DQT marker in JPEG data");
1676
0
                return (0);
1677
0
            }
1678
0
            na = sizeof(uint32_t) + 69;
1679
0
            nb = _TIFFmallocExt(tif, na);
1680
0
            if (nb == 0)
1681
0
            {
1682
0
                TIFFErrorExtR(tif, module, "Out of memory");
1683
0
                return (0);
1684
0
            }
1685
0
            *(uint32_t *)nb = na;
1686
0
            nb[sizeof(uint32_t)] = 255;
1687
0
            nb[sizeof(uint32_t) + 1] = JPEG_MARKER_DQT;
1688
0
            nb[sizeof(uint32_t) + 2] = 0;
1689
0
            nb[sizeof(uint32_t) + 3] = 67;
1690
0
            if (OJPEGReadBlock(sp, 65, &nb[sizeof(uint32_t) + 4]) == 0)
1691
0
            {
1692
0
                _TIFFfreeExt(tif, nb);
1693
0
                return (0);
1694
0
            }
1695
0
            o = nb[sizeof(uint32_t) + 4] & 15;
1696
0
            if (3 < o)
1697
0
            {
1698
0
                TIFFErrorExtR(tif, module, "Corrupt DQT marker in JPEG data");
1699
0
                _TIFFfreeExt(tif, nb);
1700
0
                return (0);
1701
0
            }
1702
0
            if (sp->qtable[o] != 0)
1703
0
                _TIFFfreeExt(tif, sp->qtable[o]);
1704
0
            sp->qtable[o] = nb;
1705
0
            m -= 65;
1706
0
        } while (m > 0);
1707
0
    }
1708
0
    return (1);
1709
0
}
1710
1711
static int OJPEGReadHeaderInfoSecStreamDht(TIFF *tif)
1712
0
{
1713
    /* this is a table marker, and it is to be saved as a whole for exact
1714
     * pushing on the jpeg stream later on */
1715
    /* TODO: the following assumes there is only one table in this marker... but
1716
     * i'm not quite sure that assumption is guaranteed correct */
1717
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamDht";
1718
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1719
0
    uint16_t m;
1720
0
    uint32_t na;
1721
0
    uint8_t *nb;
1722
0
    uint8_t o;
1723
0
    if (OJPEGReadWord(sp, &m) == 0)
1724
0
        return (0);
1725
0
    if (m <= 2)
1726
0
    {
1727
0
        if (sp->subsamplingcorrect == 0)
1728
0
            TIFFErrorExtR(tif, module, "Corrupt DHT marker in JPEG data");
1729
0
        return (0);
1730
0
    }
1731
0
    if (sp->subsamplingcorrect != 0)
1732
0
    {
1733
0
        OJPEGReadSkip(sp, m - 2);
1734
0
    }
1735
0
    else
1736
0
    {
1737
0
        na = sizeof(uint32_t) + 2 + m;
1738
0
        nb = _TIFFmallocExt(tif, na);
1739
0
        if (nb == 0)
1740
0
        {
1741
0
            TIFFErrorExtR(tif, module, "Out of memory");
1742
0
            return (0);
1743
0
        }
1744
0
        *(uint32_t *)nb = na;
1745
0
        nb[sizeof(uint32_t)] = 255;
1746
0
        nb[sizeof(uint32_t) + 1] = JPEG_MARKER_DHT;
1747
0
        nb[sizeof(uint32_t) + 2] = (m >> 8);
1748
0
        nb[sizeof(uint32_t) + 3] = (m & 255);
1749
0
        if (OJPEGReadBlock(sp, m - 2, &nb[sizeof(uint32_t) + 4]) == 0)
1750
0
        {
1751
0
            _TIFFfreeExt(tif, nb);
1752
0
            return (0);
1753
0
        }
1754
0
        o = nb[sizeof(uint32_t) + 4];
1755
0
        if ((o & 240) == 0)
1756
0
        {
1757
0
            if (3 < o)
1758
0
            {
1759
0
                TIFFErrorExtR(tif, module, "Corrupt DHT marker in JPEG data");
1760
0
                _TIFFfreeExt(tif, nb);
1761
0
                return (0);
1762
0
            }
1763
0
            if (sp->dctable[o] != 0)
1764
0
                _TIFFfreeExt(tif, sp->dctable[o]);
1765
0
            sp->dctable[o] = nb;
1766
0
        }
1767
0
        else
1768
0
        {
1769
0
            if ((o & 240) != 16)
1770
0
            {
1771
0
                TIFFErrorExtR(tif, module, "Corrupt DHT marker in JPEG data");
1772
0
                _TIFFfreeExt(tif, nb);
1773
0
                return (0);
1774
0
            }
1775
0
            o &= 15;
1776
0
            if (3 < o)
1777
0
            {
1778
0
                TIFFErrorExtR(tif, module, "Corrupt DHT marker in JPEG data");
1779
0
                _TIFFfreeExt(tif, nb);
1780
0
                return (0);
1781
0
            }
1782
0
            if (sp->actable[o] != 0)
1783
0
                _TIFFfreeExt(tif, sp->actable[o]);
1784
0
            sp->actable[o] = nb;
1785
0
        }
1786
0
    }
1787
0
    return (1);
1788
0
}
1789
1790
static int OJPEGReadHeaderInfoSecStreamSof(TIFF *tif, uint8_t marker_id)
1791
0
{
1792
    /* this marker needs to be checked, and part of its data needs to be saved
1793
     * for regeneration later on */
1794
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamSof";
1795
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1796
0
    uint16_t m;
1797
0
    uint16_t n;
1798
0
    uint8_t o;
1799
0
    uint16_t p;
1800
0
    uint16_t q;
1801
0
    if (sp->sof_log != 0)
1802
0
    {
1803
0
        TIFFErrorExtR(tif, module, "Corrupt JPEG data");
1804
0
        return (0);
1805
0
    }
1806
0
    if (sp->subsamplingcorrect == 0)
1807
0
        sp->sof_marker_id = marker_id;
1808
    /* Lf: data length */
1809
0
    if (OJPEGReadWord(sp, &m) == 0)
1810
0
        return (0);
1811
0
    if (m < 11)
1812
0
    {
1813
0
        if (sp->subsamplingcorrect == 0)
1814
0
            TIFFErrorExtR(tif, module, "Corrupt SOF marker in JPEG data");
1815
0
        return (0);
1816
0
    }
1817
0
    m -= 8;
1818
0
    if (m % 3 != 0)
1819
0
    {
1820
0
        if (sp->subsamplingcorrect == 0)
1821
0
            TIFFErrorExtR(tif, module, "Corrupt SOF marker in JPEG data");
1822
0
        return (0);
1823
0
    }
1824
0
    n = m / 3;
1825
0
    if (sp->subsamplingcorrect == 0)
1826
0
    {
1827
0
        if (n != sp->samples_per_pixel)
1828
0
        {
1829
0
            TIFFErrorExtR(
1830
0
                tif, module,
1831
0
                "JPEG compressed data indicates unexpected number of samples");
1832
0
            return (0);
1833
0
        }
1834
0
    }
1835
    /* P: Sample precision */
1836
0
    if (OJPEGReadByte(sp, &o) == 0)
1837
0
        return (0);
1838
0
    if (o != 8)
1839
0
    {
1840
0
        if (sp->subsamplingcorrect == 0)
1841
0
            TIFFErrorExtR(tif, module,
1842
0
                          "JPEG compressed data indicates unexpected number of "
1843
0
                          "bits per sample");
1844
0
        return (0);
1845
0
    }
1846
    /* Y: Number of lines, X: Number of samples per line */
1847
0
    if (sp->subsamplingcorrect)
1848
0
        OJPEGReadSkip(sp, 4);
1849
0
    else
1850
0
    {
1851
        /* Y: Number of lines */
1852
0
        if (OJPEGReadWord(sp, &p) == 0)
1853
0
            return (0);
1854
0
        if (((uint32_t)p < sp->image_length) &&
1855
0
            ((uint32_t)p < sp->strile_length_total))
1856
0
        {
1857
0
            TIFFErrorExtR(tif, module,
1858
0
                          "JPEG compressed data indicates unexpected height");
1859
0
            return (0);
1860
0
        }
1861
0
        sp->sof_y = p;
1862
        /* X: Number of samples per line */
1863
0
        if (OJPEGReadWord(sp, &p) == 0)
1864
0
            return (0);
1865
0
        if (((uint32_t)p < sp->image_width) && ((uint32_t)p < sp->strile_width))
1866
0
        {
1867
0
            TIFFErrorExtR(tif, module,
1868
0
                          "JPEG compressed data indicates unexpected width");
1869
0
            return (0);
1870
0
        }
1871
0
        if ((uint32_t)p > sp->strile_width)
1872
0
        {
1873
0
            TIFFErrorExtR(tif, module,
1874
0
                          "JPEG compressed data image width exceeds expected "
1875
0
                          "image width");
1876
0
            return (0);
1877
0
        }
1878
0
        sp->sof_x = p;
1879
0
    }
1880
    /* Nf: Number of image components in frame */
1881
0
    if (OJPEGReadByte(sp, &o) == 0)
1882
0
        return (0);
1883
0
    if (o != n)
1884
0
    {
1885
0
        if (sp->subsamplingcorrect == 0)
1886
0
            TIFFErrorExtR(tif, module, "Corrupt SOF marker in JPEG data");
1887
0
        return (0);
1888
0
    }
1889
    /* per component stuff */
1890
    /* TODO: double-check that flow implies that n cannot be as big as to make
1891
     * us overflow sof_c, sof_hv and sof_tq arrays */
1892
0
    for (q = 0; q < n; q++)
1893
0
    {
1894
        /* C: Component identifier */
1895
0
        if (OJPEGReadByte(sp, &o) == 0)
1896
0
            return (0);
1897
0
        if (sp->subsamplingcorrect == 0)
1898
0
            sp->sof_c[q] = o;
1899
        /* H: Horizontal sampling factor, and V: Vertical sampling factor */
1900
0
        if (OJPEGReadByte(sp, &o) == 0)
1901
0
            return (0);
1902
0
        if (sp->subsamplingcorrect != 0)
1903
0
        {
1904
0
            if (q == 0)
1905
0
            {
1906
0
                sp->subsampling_hor = (o >> 4);
1907
0
                sp->subsampling_ver = (o & 15);
1908
0
                if (((sp->subsampling_hor != 1) && (sp->subsampling_hor != 2) &&
1909
0
                     (sp->subsampling_hor != 4)) ||
1910
0
                    ((sp->subsampling_ver != 1) && (sp->subsampling_ver != 2) &&
1911
0
                     (sp->subsampling_ver != 4)))
1912
0
                    sp->subsampling_force_desubsampling_inside_decompression =
1913
0
                        1;
1914
0
            }
1915
0
            else
1916
0
            {
1917
0
                if (o != 17)
1918
0
                    sp->subsampling_force_desubsampling_inside_decompression =
1919
0
                        1;
1920
0
            }
1921
0
        }
1922
0
        else
1923
0
        {
1924
0
            sp->sof_hv[q] = o;
1925
0
            if (sp->subsampling_force_desubsampling_inside_decompression == 0)
1926
0
            {
1927
0
                if (q == 0)
1928
0
                {
1929
0
                    if (o != ((sp->subsampling_hor << 4) | sp->subsampling_ver))
1930
0
                    {
1931
0
                        TIFFErrorExtR(tif, module,
1932
0
                                      "JPEG compressed data indicates "
1933
0
                                      "unexpected subsampling values");
1934
0
                        return (0);
1935
0
                    }
1936
0
                }
1937
0
                else
1938
0
                {
1939
0
                    if (o != 17)
1940
0
                    {
1941
0
                        TIFFErrorExtR(tif, module,
1942
0
                                      "JPEG compressed data indicates "
1943
0
                                      "unexpected subsampling values");
1944
0
                        return (0);
1945
0
                    }
1946
0
                }
1947
0
            }
1948
0
        }
1949
        /* Tq: Quantization table destination selector */
1950
0
        if (OJPEGReadByte(sp, &o) == 0)
1951
0
            return (0);
1952
0
        if (sp->subsamplingcorrect == 0)
1953
0
            sp->sof_tq[q] = o;
1954
0
    }
1955
0
    if (sp->subsamplingcorrect == 0)
1956
0
        sp->sof_log = 1;
1957
0
    return (1);
1958
0
}
1959
1960
static int OJPEGReadHeaderInfoSecStreamSos(TIFF *tif)
1961
0
{
1962
    /* this marker needs to be checked, and part of its data needs to be saved
1963
     * for regeneration later on */
1964
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamSos";
1965
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1966
0
    uint16_t m;
1967
0
    uint8_t n;
1968
0
    uint8_t o;
1969
0
    assert(sp->subsamplingcorrect == 0);
1970
0
    if (sp->sof_log == 0)
1971
0
    {
1972
0
        TIFFErrorExtR(tif, module, "Corrupt SOS marker in JPEG data");
1973
0
        return (0);
1974
0
    }
1975
    /* Ls */
1976
0
    if (OJPEGReadWord(sp, &m) == 0)
1977
0
        return (0);
1978
0
    if (m != 6 + sp->samples_per_pixel_per_plane * 2)
1979
0
    {
1980
0
        TIFFErrorExtR(tif, module, "Corrupt SOS marker in JPEG data");
1981
0
        return (0);
1982
0
    }
1983
    /* Ns */
1984
0
    if (OJPEGReadByte(sp, &n) == 0)
1985
0
        return (0);
1986
0
    if (n != sp->samples_per_pixel_per_plane)
1987
0
    {
1988
0
        TIFFErrorExtR(tif, module, "Corrupt SOS marker in JPEG data");
1989
0
        return (0);
1990
0
    }
1991
    /* Cs, Td, and Ta */
1992
0
    for (o = 0; o < sp->samples_per_pixel_per_plane; o++)
1993
0
    {
1994
        /* Cs */
1995
0
        if (OJPEGReadByte(sp, &n) == 0)
1996
0
            return (0);
1997
0
        sp->sos_cs[sp->plane_sample_offset + o] = n;
1998
        /* Td and Ta */
1999
0
        if (OJPEGReadByte(sp, &n) == 0)
2000
0
            return (0);
2001
0
        sp->sos_tda[sp->plane_sample_offset + o] = n;
2002
0
    }
2003
    /* skip Ss, Se, Ah, en Al -> no check, as per Tom Lane recommendation, as
2004
     * per LibJpeg source */
2005
0
    OJPEGReadSkip(sp, 3);
2006
0
    return (1);
2007
0
}
2008
2009
static int OJPEGReadHeaderInfoSecTablesQTable(TIFF *tif)
2010
0
{
2011
0
    static const char module[] = "OJPEGReadHeaderInfoSecTablesQTable";
2012
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2013
0
    uint8_t m;
2014
0
    uint8_t n;
2015
0
    uint32_t oa;
2016
0
    uint8_t *ob;
2017
0
    uint32_t p;
2018
0
    if (sp->qtable_offset[0] == 0)
2019
0
    {
2020
0
        TIFFErrorExtR(tif, module, "Missing JPEG tables");
2021
0
        return (0);
2022
0
    }
2023
0
    sp->in_buffer_file_pos_log = 0;
2024
0
    for (m = 0; m < sp->samples_per_pixel; m++)
2025
0
    {
2026
0
        if ((sp->qtable_offset[m] != 0) &&
2027
0
            ((m == 0) || (sp->qtable_offset[m] != sp->qtable_offset[m - 1])))
2028
0
        {
2029
0
            for (n = 0; n < m - 1; n++)
2030
0
            {
2031
0
                if (sp->qtable_offset[m] == sp->qtable_offset[n])
2032
0
                {
2033
0
                    TIFFErrorExtR(tif, module, "Corrupt JpegQTables tag value");
2034
0
                    return (0);
2035
0
                }
2036
0
            }
2037
0
            oa = sizeof(uint32_t) + 69;
2038
0
            ob = _TIFFmallocExt(tif, oa);
2039
0
            if (ob == 0)
2040
0
            {
2041
0
                TIFFErrorExtR(tif, module, "Out of memory");
2042
0
                return (0);
2043
0
            }
2044
0
            *(uint32_t *)ob = oa;
2045
0
            ob[sizeof(uint32_t)] = 255;
2046
0
            ob[sizeof(uint32_t) + 1] = JPEG_MARKER_DQT;
2047
0
            ob[sizeof(uint32_t) + 2] = 0;
2048
0
            ob[sizeof(uint32_t) + 3] = 67;
2049
0
            ob[sizeof(uint32_t) + 4] = m;
2050
0
            TIFFSeekFile(tif, sp->qtable_offset[m], SEEK_SET);
2051
0
            p = (uint32_t)TIFFReadFile(tif, &ob[sizeof(uint32_t) + 5], 64);
2052
0
            if (p != 64)
2053
0
            {
2054
0
                _TIFFfreeExt(tif, ob);
2055
0
                return (0);
2056
0
            }
2057
0
            if (sp->qtable[m] != 0)
2058
0
                _TIFFfreeExt(tif, sp->qtable[m]);
2059
0
            sp->qtable[m] = ob;
2060
0
            sp->sof_tq[m] = m;
2061
0
        }
2062
0
        else
2063
0
            sp->sof_tq[m] = sp->sof_tq[m - 1];
2064
0
    }
2065
0
    return (1);
2066
0
}
2067
2068
static int OJPEGReadHeaderInfoSecTablesDcTable(TIFF *tif)
2069
0
{
2070
0
    static const char module[] = "OJPEGReadHeaderInfoSecTablesDcTable";
2071
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2072
0
    uint8_t m;
2073
0
    uint8_t n;
2074
0
    uint8_t o[16];
2075
0
    uint32_t p;
2076
0
    uint32_t q;
2077
0
    uint32_t ra;
2078
0
    uint8_t *rb;
2079
0
    if (sp->dctable_offset[0] == 0)
2080
0
    {
2081
0
        TIFFErrorExtR(tif, module, "Missing JPEG tables");
2082
0
        return (0);
2083
0
    }
2084
0
    sp->in_buffer_file_pos_log = 0;
2085
0
    for (m = 0; m < sp->samples_per_pixel; m++)
2086
0
    {
2087
0
        if ((sp->dctable_offset[m] != 0) &&
2088
0
            ((m == 0) || (sp->dctable_offset[m] != sp->dctable_offset[m - 1])))
2089
0
        {
2090
0
            for (n = 0; n < m - 1; n++)
2091
0
            {
2092
0
                if (sp->dctable_offset[m] == sp->dctable_offset[n])
2093
0
                {
2094
0
                    TIFFErrorExtR(tif, module,
2095
0
                                  "Corrupt JpegDcTables tag value");
2096
0
                    return (0);
2097
0
                }
2098
0
            }
2099
0
            TIFFSeekFile(tif, sp->dctable_offset[m], SEEK_SET);
2100
0
            p = (uint32_t)TIFFReadFile(tif, o, 16);
2101
0
            if (p != 16)
2102
0
                return (0);
2103
0
            q = 0;
2104
0
            for (n = 0; n < 16; n++)
2105
0
                q += o[n];
2106
0
            ra = sizeof(uint32_t) + 21 + q;
2107
0
            rb = _TIFFmallocExt(tif, ra);
2108
0
            if (rb == 0)
2109
0
            {
2110
0
                TIFFErrorExtR(tif, module, "Out of memory");
2111
0
                return (0);
2112
0
            }
2113
0
            *(uint32_t *)rb = ra;
2114
0
            rb[sizeof(uint32_t)] = 255;
2115
0
            rb[sizeof(uint32_t) + 1] = JPEG_MARKER_DHT;
2116
0
            rb[sizeof(uint32_t) + 2] = (uint8_t)((19 + q) >> 8);
2117
0
            rb[sizeof(uint32_t) + 3] = ((19 + q) & 255);
2118
0
            rb[sizeof(uint32_t) + 4] = m;
2119
0
            for (n = 0; n < 16; n++)
2120
0
                rb[sizeof(uint32_t) + 5 + n] = o[n];
2121
0
            p = (uint32_t)TIFFReadFile(tif, &(rb[sizeof(uint32_t) + 21]), q);
2122
0
            if (p != q)
2123
0
            {
2124
0
                _TIFFfreeExt(tif, rb);
2125
0
                return (0);
2126
0
            }
2127
0
            if (sp->dctable[m] != 0)
2128
0
                _TIFFfreeExt(tif, sp->dctable[m]);
2129
0
            sp->dctable[m] = rb;
2130
0
            sp->sos_tda[m] = (m << 4);
2131
0
        }
2132
0
        else
2133
0
            sp->sos_tda[m] = sp->sos_tda[m - 1];
2134
0
    }
2135
0
    return (1);
2136
0
}
2137
2138
static int OJPEGReadHeaderInfoSecTablesAcTable(TIFF *tif)
2139
0
{
2140
0
    static const char module[] = "OJPEGReadHeaderInfoSecTablesAcTable";
2141
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2142
0
    uint8_t m;
2143
0
    uint8_t n;
2144
0
    uint8_t o[16];
2145
0
    uint32_t p;
2146
0
    uint32_t q;
2147
0
    uint32_t ra;
2148
0
    uint8_t *rb;
2149
0
    if (sp->actable_offset[0] == 0)
2150
0
    {
2151
0
        TIFFErrorExtR(tif, module, "Missing JPEG tables");
2152
0
        return (0);
2153
0
    }
2154
0
    sp->in_buffer_file_pos_log = 0;
2155
0
    for (m = 0; m < sp->samples_per_pixel; m++)
2156
0
    {
2157
0
        if ((sp->actable_offset[m] != 0) &&
2158
0
            ((m == 0) || (sp->actable_offset[m] != sp->actable_offset[m - 1])))
2159
0
        {
2160
0
            for (n = 0; n < m - 1; n++)
2161
0
            {
2162
0
                if (sp->actable_offset[m] == sp->actable_offset[n])
2163
0
                {
2164
0
                    TIFFErrorExtR(tif, module,
2165
0
                                  "Corrupt JpegAcTables tag value");
2166
0
                    return (0);
2167
0
                }
2168
0
            }
2169
0
            TIFFSeekFile(tif, sp->actable_offset[m], SEEK_SET);
2170
0
            p = (uint32_t)TIFFReadFile(tif, o, 16);
2171
0
            if (p != 16)
2172
0
                return (0);
2173
0
            q = 0;
2174
0
            for (n = 0; n < 16; n++)
2175
0
                q += o[n];
2176
0
            ra = sizeof(uint32_t) + 21 + q;
2177
0
            rb = _TIFFmallocExt(tif, ra);
2178
0
            if (rb == 0)
2179
0
            {
2180
0
                TIFFErrorExtR(tif, module, "Out of memory");
2181
0
                return (0);
2182
0
            }
2183
0
            *(uint32_t *)rb = ra;
2184
0
            rb[sizeof(uint32_t)] = 255;
2185
0
            rb[sizeof(uint32_t) + 1] = JPEG_MARKER_DHT;
2186
0
            rb[sizeof(uint32_t) + 2] = (uint8_t)((19 + q) >> 8);
2187
0
            rb[sizeof(uint32_t) + 3] = ((19 + q) & 255);
2188
0
            rb[sizeof(uint32_t) + 4] = (16 | m);
2189
0
            for (n = 0; n < 16; n++)
2190
0
                rb[sizeof(uint32_t) + 5 + n] = o[n];
2191
0
            p = (uint32_t)TIFFReadFile(tif, &(rb[sizeof(uint32_t) + 21]), q);
2192
0
            if (p != q)
2193
0
            {
2194
0
                _TIFFfreeExt(tif, rb);
2195
0
                return (0);
2196
0
            }
2197
0
            if (sp->actable[m] != 0)
2198
0
                _TIFFfreeExt(tif, sp->actable[m]);
2199
0
            sp->actable[m] = rb;
2200
0
            sp->sos_tda[m] = (sp->sos_tda[m] | m);
2201
0
        }
2202
0
        else
2203
0
            sp->sos_tda[m] = (sp->sos_tda[m] | (sp->sos_tda[m - 1] & 15));
2204
0
    }
2205
0
    return (1);
2206
0
}
2207
2208
static int OJPEGReadBufferFill(OJPEGState *sp)
2209
0
{
2210
0
    uint16_t m;
2211
0
    tmsize_t n;
2212
    /* TODO: double-check: when subsamplingcorrect is set, no call to
2213
     * TIFFErrorExt or TIFFWarningExt should be made in any other case, seek or
2214
     * read errors should be passed through */
2215
0
    do
2216
0
    {
2217
0
        if (sp->in_buffer_file_togo != 0)
2218
0
        {
2219
0
            if (sp->in_buffer_file_pos_log == 0)
2220
0
            {
2221
0
                TIFFSeekFile(sp->tif, sp->in_buffer_file_pos, SEEK_SET);
2222
0
                sp->in_buffer_file_pos_log = 1;
2223
0
            }
2224
0
            m = OJPEG_BUFFER;
2225
0
            if ((uint64_t)m > sp->in_buffer_file_togo)
2226
0
                m = (uint16_t)sp->in_buffer_file_togo;
2227
0
            n = TIFFReadFile(sp->tif, sp->in_buffer, (tmsize_t)m);
2228
0
            if (n == 0)
2229
0
                return (0);
2230
0
            assert(n > 0);
2231
0
            assert(n <= OJPEG_BUFFER);
2232
0
            assert(n < 65536);
2233
0
            assert((uint64_t)n <= sp->in_buffer_file_togo);
2234
0
            m = (uint16_t)n;
2235
0
            sp->in_buffer_togo = m;
2236
0
            sp->in_buffer_cur = sp->in_buffer;
2237
0
            sp->in_buffer_file_togo -= m;
2238
0
            sp->in_buffer_file_pos += m;
2239
0
            break;
2240
0
        }
2241
0
        sp->in_buffer_file_pos_log = 0;
2242
0
        switch (sp->in_buffer_source)
2243
0
        {
2244
0
            case osibsNotSetYet:
2245
0
                if (sp->jpeg_interchange_format != 0)
2246
0
                {
2247
0
                    sp->in_buffer_file_pos = sp->jpeg_interchange_format;
2248
0
                    sp->in_buffer_file_togo =
2249
0
                        sp->jpeg_interchange_format_length;
2250
0
                }
2251
0
                sp->in_buffer_source = osibsJpegInterchangeFormat;
2252
0
                break;
2253
0
            case osibsJpegInterchangeFormat:
2254
0
                sp->in_buffer_source = osibsStrile;
2255
0
                break;
2256
0
            case osibsStrile:
2257
0
                if (sp->in_buffer_next_strile == sp->in_buffer_strile_count)
2258
0
                    sp->in_buffer_source = osibsEof;
2259
0
                else
2260
0
                {
2261
0
                    int err = 0;
2262
0
                    sp->in_buffer_file_pos = TIFFGetStrileOffsetWithErr(
2263
0
                        sp->tif, sp->in_buffer_next_strile, &err);
2264
0
                    if (err)
2265
0
                        return 0;
2266
0
                    if (sp->in_buffer_file_pos != 0)
2267
0
                    {
2268
0
                        uint64_t bytecount = TIFFGetStrileByteCountWithErr(
2269
0
                            sp->tif, sp->in_buffer_next_strile, &err);
2270
0
                        if (err)
2271
0
                            return 0;
2272
0
                        if (sp->in_buffer_file_pos >= sp->file_size)
2273
0
                            sp->in_buffer_file_pos = 0;
2274
0
                        else if (bytecount == 0)
2275
0
                            sp->in_buffer_file_togo =
2276
0
                                sp->file_size - sp->in_buffer_file_pos;
2277
0
                        else
2278
0
                        {
2279
0
                            sp->in_buffer_file_togo = bytecount;
2280
0
                            if (sp->in_buffer_file_togo == 0)
2281
0
                                sp->in_buffer_file_pos = 0;
2282
0
                            else if (sp->in_buffer_file_pos >
2283
0
                                         UINT64_MAX - sp->in_buffer_file_togo ||
2284
0
                                     sp->in_buffer_file_pos +
2285
0
                                             sp->in_buffer_file_togo >
2286
0
                                         sp->file_size)
2287
0
                                sp->in_buffer_file_togo =
2288
0
                                    sp->file_size - sp->in_buffer_file_pos;
2289
0
                        }
2290
0
                    }
2291
0
                    sp->in_buffer_next_strile++;
2292
0
                }
2293
0
                break;
2294
0
            default:
2295
0
                return (0);
2296
0
        }
2297
0
    } while (1);
2298
0
    return (1);
2299
0
}
2300
2301
static int OJPEGReadByte(OJPEGState *sp, uint8_t *byte)
2302
0
{
2303
0
    if (sp->in_buffer_togo == 0)
2304
0
    {
2305
0
        if (OJPEGReadBufferFill(sp) == 0)
2306
0
            return (0);
2307
0
        assert(sp->in_buffer_togo > 0);
2308
0
    }
2309
0
    *byte = *(sp->in_buffer_cur);
2310
0
    sp->in_buffer_cur++;
2311
0
    sp->in_buffer_togo--;
2312
0
    return (1);
2313
0
}
2314
2315
static int OJPEGReadBytePeek(OJPEGState *sp, uint8_t *byte)
2316
0
{
2317
0
    if (sp->in_buffer_togo == 0)
2318
0
    {
2319
0
        if (OJPEGReadBufferFill(sp) == 0)
2320
0
            return (0);
2321
0
        assert(sp->in_buffer_togo > 0);
2322
0
    }
2323
0
    *byte = *(sp->in_buffer_cur);
2324
0
    return (1);
2325
0
}
2326
2327
static void OJPEGReadByteAdvance(OJPEGState *sp)
2328
0
{
2329
0
    assert(sp->in_buffer_togo > 0);
2330
0
    sp->in_buffer_cur++;
2331
0
    sp->in_buffer_togo--;
2332
0
}
2333
2334
static int OJPEGReadWord(OJPEGState *sp, uint16_t *word)
2335
0
{
2336
0
    uint8_t m;
2337
0
    if (OJPEGReadByte(sp, &m) == 0)
2338
0
        return (0);
2339
0
    *word = (m << 8);
2340
0
    if (OJPEGReadByte(sp, &m) == 0)
2341
0
        return (0);
2342
0
    *word |= m;
2343
0
    return (1);
2344
0
}
2345
2346
static int OJPEGReadBlock(OJPEGState *sp, uint16_t len, void *mem)
2347
0
{
2348
0
    uint16_t mlen;
2349
0
    uint8_t *mmem;
2350
0
    uint16_t n;
2351
0
    assert(len > 0);
2352
0
    mlen = len;
2353
0
    mmem = mem;
2354
0
    do
2355
0
    {
2356
0
        if (sp->in_buffer_togo == 0)
2357
0
        {
2358
0
            if (OJPEGReadBufferFill(sp) == 0)
2359
0
                return (0);
2360
0
            assert(sp->in_buffer_togo > 0);
2361
0
        }
2362
0
        n = mlen;
2363
0
        if (n > sp->in_buffer_togo)
2364
0
            n = sp->in_buffer_togo;
2365
0
        _TIFFmemcpy(mmem, sp->in_buffer_cur, n);
2366
0
        sp->in_buffer_cur += n;
2367
0
        sp->in_buffer_togo -= n;
2368
0
        mlen -= n;
2369
0
        mmem += n;
2370
0
    } while (mlen > 0);
2371
0
    return (1);
2372
0
}
2373
2374
static void OJPEGReadSkip(OJPEGState *sp, uint16_t len)
2375
0
{
2376
0
    uint16_t m;
2377
0
    uint16_t n;
2378
0
    m = len;
2379
0
    n = m;
2380
0
    if (n > sp->in_buffer_togo)
2381
0
        n = sp->in_buffer_togo;
2382
0
    sp->in_buffer_cur += n;
2383
0
    sp->in_buffer_togo -= n;
2384
0
    m -= n;
2385
0
    if (m > 0)
2386
0
    {
2387
0
        assert(sp->in_buffer_togo == 0);
2388
0
        n = m;
2389
0
        if ((uint64_t)n > sp->in_buffer_file_togo)
2390
0
            n = (uint16_t)sp->in_buffer_file_togo;
2391
0
        sp->in_buffer_file_pos += n;
2392
0
        sp->in_buffer_file_togo -= n;
2393
0
        sp->in_buffer_file_pos_log = 0;
2394
        /* we don't skip past jpeginterchangeformat/strile block...
2395
         * if that is asked from us, we're dealing with totally bazurk
2396
         * data anyway, and we've not seen this happening on any
2397
         * testfile, so we might as well likely cause some other
2398
         * meaningless error to be passed at some later time
2399
         */
2400
0
    }
2401
0
}
2402
2403
static int OJPEGWriteStream(TIFF *tif, void **mem, uint32_t *len)
2404
0
{
2405
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2406
0
    *len = 0;
2407
0
    do
2408
0
    {
2409
0
        assert(sp->out_state <= ososEoi);
2410
0
        switch (sp->out_state)
2411
0
        {
2412
0
            case ososSoi:
2413
0
                OJPEGWriteStreamSoi(tif, mem, len);
2414
0
                break;
2415
0
            case ososQTable0:
2416
0
                OJPEGWriteStreamQTable(tif, 0, mem, len);
2417
0
                break;
2418
0
            case ososQTable1:
2419
0
                OJPEGWriteStreamQTable(tif, 1, mem, len);
2420
0
                break;
2421
0
            case ososQTable2:
2422
0
                OJPEGWriteStreamQTable(tif, 2, mem, len);
2423
0
                break;
2424
0
            case ososQTable3:
2425
0
                OJPEGWriteStreamQTable(tif, 3, mem, len);
2426
0
                break;
2427
0
            case ososDcTable0:
2428
0
                OJPEGWriteStreamDcTable(tif, 0, mem, len);
2429
0
                break;
2430
0
            case ososDcTable1:
2431
0
                OJPEGWriteStreamDcTable(tif, 1, mem, len);
2432
0
                break;
2433
0
            case ososDcTable2:
2434
0
                OJPEGWriteStreamDcTable(tif, 2, mem, len);
2435
0
                break;
2436
0
            case ososDcTable3:
2437
0
                OJPEGWriteStreamDcTable(tif, 3, mem, len);
2438
0
                break;
2439
0
            case ososAcTable0:
2440
0
                OJPEGWriteStreamAcTable(tif, 0, mem, len);
2441
0
                break;
2442
0
            case ososAcTable1:
2443
0
                OJPEGWriteStreamAcTable(tif, 1, mem, len);
2444
0
                break;
2445
0
            case ososAcTable2:
2446
0
                OJPEGWriteStreamAcTable(tif, 2, mem, len);
2447
0
                break;
2448
0
            case ososAcTable3:
2449
0
                OJPEGWriteStreamAcTable(tif, 3, mem, len);
2450
0
                break;
2451
0
            case ososDri:
2452
0
                OJPEGWriteStreamDri(tif, mem, len);
2453
0
                break;
2454
0
            case ososSof:
2455
0
                OJPEGWriteStreamSof(tif, mem, len);
2456
0
                break;
2457
0
            case ososSos:
2458
0
                OJPEGWriteStreamSos(tif, mem, len);
2459
0
                break;
2460
0
            case ososCompressed:
2461
0
                if (OJPEGWriteStreamCompressed(tif, mem, len) == 0)
2462
0
                    return (0);
2463
0
                break;
2464
0
            case ososRst:
2465
0
                OJPEGWriteStreamRst(tif, mem, len);
2466
0
                break;
2467
0
            case ososEoi:
2468
0
                OJPEGWriteStreamEoi(tif, mem, len);
2469
0
                break;
2470
0
        }
2471
0
    } while (*len == 0);
2472
0
    return (1);
2473
0
}
2474
2475
static void OJPEGWriteStreamSoi(TIFF *tif, void **mem, uint32_t *len)
2476
0
{
2477
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2478
0
    assert(OJPEG_BUFFER >= 2);
2479
0
    sp->out_buffer[0] = 255;
2480
0
    sp->out_buffer[1] = JPEG_MARKER_SOI;
2481
0
    *len = 2;
2482
0
    *mem = (void *)sp->out_buffer;
2483
0
    sp->out_state++;
2484
0
}
2485
2486
static void OJPEGWriteStreamQTable(TIFF *tif, uint8_t table_index, void **mem,
2487
                                   uint32_t *len)
2488
0
{
2489
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2490
0
    if (sp->qtable[table_index] != 0)
2491
0
    {
2492
0
        *mem = (void *)(sp->qtable[table_index] + sizeof(uint32_t));
2493
0
        *len = *((uint32_t *)sp->qtable[table_index]) - sizeof(uint32_t);
2494
0
    }
2495
0
    sp->out_state++;
2496
0
}
2497
2498
static void OJPEGWriteStreamDcTable(TIFF *tif, uint8_t table_index, void **mem,
2499
                                    uint32_t *len)
2500
0
{
2501
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2502
0
    if (sp->dctable[table_index] != 0)
2503
0
    {
2504
0
        *mem = (void *)(sp->dctable[table_index] + sizeof(uint32_t));
2505
0
        *len = *((uint32_t *)sp->dctable[table_index]) - sizeof(uint32_t);
2506
0
    }
2507
0
    sp->out_state++;
2508
0
}
2509
2510
static void OJPEGWriteStreamAcTable(TIFF *tif, uint8_t table_index, void **mem,
2511
                                    uint32_t *len)
2512
0
{
2513
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2514
0
    if (sp->actable[table_index] != 0)
2515
0
    {
2516
0
        *mem = (void *)(sp->actable[table_index] + sizeof(uint32_t));
2517
0
        *len = *((uint32_t *)sp->actable[table_index]) - sizeof(uint32_t);
2518
0
    }
2519
0
    sp->out_state++;
2520
0
}
2521
2522
static void OJPEGWriteStreamDri(TIFF *tif, void **mem, uint32_t *len)
2523
0
{
2524
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2525
0
    assert(OJPEG_BUFFER >= 6);
2526
0
    if (sp->restart_interval != 0)
2527
0
    {
2528
0
        sp->out_buffer[0] = 255;
2529
0
        sp->out_buffer[1] = JPEG_MARKER_DRI;
2530
0
        sp->out_buffer[2] = 0;
2531
0
        sp->out_buffer[3] = 4;
2532
0
        sp->out_buffer[4] = (sp->restart_interval >> 8);
2533
0
        sp->out_buffer[5] = (sp->restart_interval & 255);
2534
0
        *len = 6;
2535
0
        *mem = (void *)sp->out_buffer;
2536
0
    }
2537
0
    sp->out_state++;
2538
0
}
2539
2540
static void OJPEGWriteStreamSof(TIFF *tif, void **mem, uint32_t *len)
2541
0
{
2542
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2543
0
    uint8_t m;
2544
0
    assert(OJPEG_BUFFER >= 2 + 8 + sp->samples_per_pixel_per_plane * 3);
2545
0
    assert(255 >= 8 + sp->samples_per_pixel_per_plane * 3);
2546
0
    sp->out_buffer[0] = 255;
2547
0
    sp->out_buffer[1] = sp->sof_marker_id;
2548
    /* Lf */
2549
0
    sp->out_buffer[2] = 0;
2550
0
    sp->out_buffer[3] = 8 + sp->samples_per_pixel_per_plane * 3;
2551
    /* P */
2552
0
    sp->out_buffer[4] = 8;
2553
    /* Y */
2554
0
    sp->out_buffer[5] = (uint8_t)(sp->sof_y >> 8);
2555
0
    sp->out_buffer[6] = (sp->sof_y & 255);
2556
    /* X */
2557
0
    sp->out_buffer[7] = (uint8_t)(sp->sof_x >> 8);
2558
0
    sp->out_buffer[8] = (sp->sof_x & 255);
2559
    /* Nf */
2560
0
    sp->out_buffer[9] = sp->samples_per_pixel_per_plane;
2561
0
    for (m = 0; m < sp->samples_per_pixel_per_plane; m++)
2562
0
    {
2563
        /* C */
2564
0
        sp->out_buffer[10 + m * 3] = sp->sof_c[sp->plane_sample_offset + m];
2565
        /* H and V */
2566
0
        sp->out_buffer[10 + m * 3 + 1] =
2567
0
            sp->sof_hv[sp->plane_sample_offset + m];
2568
        /* Tq */
2569
0
        sp->out_buffer[10 + m * 3 + 2] =
2570
0
            sp->sof_tq[sp->plane_sample_offset + m];
2571
0
    }
2572
0
    *len = 10 + sp->samples_per_pixel_per_plane * 3;
2573
0
    *mem = (void *)sp->out_buffer;
2574
0
    sp->out_state++;
2575
0
}
2576
2577
static void OJPEGWriteStreamSos(TIFF *tif, void **mem, uint32_t *len)
2578
0
{
2579
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2580
0
    uint8_t m;
2581
0
    assert(OJPEG_BUFFER >= 2 + 6 + sp->samples_per_pixel_per_plane * 2);
2582
0
    assert(255 >= 6 + sp->samples_per_pixel_per_plane * 2);
2583
0
    sp->out_buffer[0] = 255;
2584
0
    sp->out_buffer[1] = JPEG_MARKER_SOS;
2585
    /* Ls */
2586
0
    sp->out_buffer[2] = 0;
2587
0
    sp->out_buffer[3] = 6 + sp->samples_per_pixel_per_plane * 2;
2588
    /* Ns */
2589
0
    sp->out_buffer[4] = sp->samples_per_pixel_per_plane;
2590
0
    for (m = 0; m < sp->samples_per_pixel_per_plane; m++)
2591
0
    {
2592
        /* Cs */
2593
0
        sp->out_buffer[5 + m * 2] = sp->sos_cs[sp->plane_sample_offset + m];
2594
        /* Td and Ta */
2595
0
        sp->out_buffer[5 + m * 2 + 1] =
2596
0
            sp->sos_tda[sp->plane_sample_offset + m];
2597
0
    }
2598
    /* Ss */
2599
0
    sp->out_buffer[5 + sp->samples_per_pixel_per_plane * 2] = 0;
2600
    /* Se */
2601
0
    sp->out_buffer[5 + sp->samples_per_pixel_per_plane * 2 + 1] = 63;
2602
    /* Ah and Al */
2603
0
    sp->out_buffer[5 + sp->samples_per_pixel_per_plane * 2 + 2] = 0;
2604
0
    *len = 8 + sp->samples_per_pixel_per_plane * 2;
2605
0
    *mem = (void *)sp->out_buffer;
2606
0
    sp->out_state++;
2607
0
}
2608
2609
static int OJPEGWriteStreamCompressed(TIFF *tif, void **mem, uint32_t *len)
2610
0
{
2611
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2612
0
    if (sp->in_buffer_togo == 0)
2613
0
    {
2614
0
        if (OJPEGReadBufferFill(sp) == 0)
2615
0
            return (0);
2616
0
        assert(sp->in_buffer_togo > 0);
2617
0
    }
2618
0
    *len = sp->in_buffer_togo;
2619
0
    *mem = (void *)sp->in_buffer_cur;
2620
0
    sp->in_buffer_togo = 0;
2621
0
    if (sp->in_buffer_file_togo == 0)
2622
0
    {
2623
0
        switch (sp->in_buffer_source)
2624
0
        {
2625
0
            case osibsStrile:
2626
0
                if (sp->in_buffer_next_strile < sp->in_buffer_strile_count)
2627
0
                    sp->out_state = ososRst;
2628
0
                else
2629
0
                    sp->out_state = ososEoi;
2630
0
                break;
2631
0
            case osibsEof:
2632
0
                sp->out_state = ososEoi;
2633
0
                break;
2634
0
            default:
2635
0
                break;
2636
0
        }
2637
0
    }
2638
0
    return (1);
2639
0
}
2640
2641
static void OJPEGWriteStreamRst(TIFF *tif, void **mem, uint32_t *len)
2642
0
{
2643
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2644
0
    assert(OJPEG_BUFFER >= 2);
2645
0
    sp->out_buffer[0] = 255;
2646
0
    sp->out_buffer[1] = JPEG_MARKER_RST0 + sp->restart_index;
2647
0
    sp->restart_index++;
2648
0
    if (sp->restart_index == 8)
2649
0
        sp->restart_index = 0;
2650
0
    *len = 2;
2651
0
    *mem = (void *)sp->out_buffer;
2652
0
    sp->out_state = ososCompressed;
2653
0
}
2654
2655
static void OJPEGWriteStreamEoi(TIFF *tif, void **mem, uint32_t *len)
2656
0
{
2657
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2658
0
    assert(OJPEG_BUFFER >= 2);
2659
0
    sp->out_buffer[0] = 255;
2660
0
    sp->out_buffer[1] = JPEG_MARKER_EOI;
2661
0
    *len = 2;
2662
0
    *mem = (void *)sp->out_buffer;
2663
0
}
2664
2665
#ifndef LIBJPEG_ENCAP_EXTERNAL
2666
static int jpeg_create_decompress_encap(OJPEGState *sp,
2667
                                        jpeg_decompress_struct *cinfo)
2668
0
{
2669
0
    if (SETJMP(sp->exit_jmpbuf))
2670
0
        return 0;
2671
0
    else
2672
0
    {
2673
0
        jpeg_create_decompress(cinfo);
2674
0
        return 1;
2675
0
    }
2676
0
}
2677
#endif
2678
2679
#ifndef LIBJPEG_ENCAP_EXTERNAL
2680
static int jpeg_read_header_encap(OJPEGState *sp, jpeg_decompress_struct *cinfo,
2681
                                  uint8_t require_image)
2682
0
{
2683
0
    if (SETJMP(sp->exit_jmpbuf))
2684
0
        return 0;
2685
0
    else
2686
0
    {
2687
0
        jpeg_read_header(cinfo, require_image);
2688
0
        return 1;
2689
0
    }
2690
0
}
2691
#endif
2692
2693
#ifndef LIBJPEG_ENCAP_EXTERNAL
2694
static int jpeg_start_decompress_encap(OJPEGState *sp,
2695
                                       jpeg_decompress_struct *cinfo)
2696
0
{
2697
0
    if (SETJMP(sp->exit_jmpbuf))
2698
0
        return 0;
2699
0
    else
2700
0
    {
2701
0
        jpeg_start_decompress(cinfo);
2702
0
        return 1;
2703
0
    }
2704
0
}
2705
#endif
2706
2707
#ifndef LIBJPEG_ENCAP_EXTERNAL
2708
static int jpeg_read_scanlines_encap(OJPEGState *sp,
2709
                                     jpeg_decompress_struct *cinfo,
2710
                                     void *scanlines, uint32_t max_lines)
2711
0
{
2712
0
    if (SETJMP(sp->exit_jmpbuf))
2713
0
        return 0;
2714
0
    else
2715
0
    {
2716
0
        jpeg_read_scanlines(cinfo, scanlines, max_lines);
2717
0
        return 1;
2718
0
    }
2719
0
}
2720
#endif
2721
2722
#ifndef LIBJPEG_ENCAP_EXTERNAL
2723
static int jpeg_read_raw_data_encap(OJPEGState *sp,
2724
                                    jpeg_decompress_struct *cinfo, void *data,
2725
                                    uint32_t max_lines)
2726
0
{
2727
0
    if (SETJMP(sp->exit_jmpbuf))
2728
0
        return 0;
2729
0
    else
2730
0
    {
2731
0
        jpeg_read_raw_data(cinfo, data, max_lines);
2732
0
        return 1;
2733
0
    }
2734
0
}
2735
#endif
2736
2737
#ifndef LIBJPEG_ENCAP_EXTERNAL
2738
static void jpeg_encap_unwind(TIFF *tif)
2739
0
{
2740
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2741
0
    LONGJMP(sp->exit_jmpbuf, 1);
2742
0
}
2743
#endif
2744
2745
static void OJPEGLibjpegJpegErrorMgrOutputMessage(jpeg_common_struct *cinfo)
2746
0
{
2747
0
    char buffer[JMSG_LENGTH_MAX];
2748
0
    (*cinfo->err->format_message)(cinfo, buffer);
2749
0
    TIFFWarningExtR(((TIFF *)(cinfo->client_data)), "LibJpeg", "%s", buffer);
2750
0
}
2751
2752
static void OJPEGLibjpegJpegErrorMgrErrorExit(jpeg_common_struct *cinfo)
2753
0
{
2754
0
    char buffer[JMSG_LENGTH_MAX];
2755
0
    (*cinfo->err->format_message)(cinfo, buffer);
2756
0
    TIFFErrorExtR(((TIFF *)(cinfo->client_data)), "LibJpeg", "%s", buffer);
2757
0
    jpeg_encap_unwind((TIFF *)(cinfo->client_data));
2758
0
}
2759
2760
static void OJPEGLibjpegJpegSourceMgrInitSource(jpeg_decompress_struct *cinfo)
2761
0
{
2762
0
    (void)cinfo;
2763
0
}
2764
2765
static boolean
2766
OJPEGLibjpegJpegSourceMgrFillInputBuffer(jpeg_decompress_struct *cinfo)
2767
0
{
2768
0
    TIFF *tif = (TIFF *)cinfo->client_data;
2769
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2770
0
    void *mem = 0;
2771
0
    uint32_t len = 0U;
2772
0
    if (OJPEGWriteStream(tif, &mem, &len) == 0)
2773
0
    {
2774
0
        TIFFErrorExtR(tif, "LibJpeg", "Premature end of JPEG data");
2775
0
        jpeg_encap_unwind(tif);
2776
0
    }
2777
0
    sp->libjpeg_jpeg_source_mgr.bytes_in_buffer = len;
2778
0
    sp->libjpeg_jpeg_source_mgr.next_input_byte = mem;
2779
0
    return (1);
2780
0
}
2781
2782
static void
2783
OJPEGLibjpegJpegSourceMgrSkipInputData(jpeg_decompress_struct *cinfo,
2784
                                       long num_bytes)
2785
0
{
2786
0
    TIFF *tif = (TIFF *)cinfo->client_data;
2787
0
    (void)num_bytes;
2788
0
    TIFFErrorExtR(tif, "LibJpeg", "Unexpected error");
2789
0
    jpeg_encap_unwind(tif);
2790
0
}
2791
2792
#ifdef _MSC_VER
2793
#pragma warning(push)
2794
#pragma warning(disable : 4702) /* unreachable code */
2795
#endif
2796
static boolean
2797
OJPEGLibjpegJpegSourceMgrResyncToRestart(jpeg_decompress_struct *cinfo,
2798
                                         int desired)
2799
0
{
2800
0
    TIFF *tif = (TIFF *)cinfo->client_data;
2801
0
    (void)desired;
2802
0
    TIFFErrorExtR(tif, "LibJpeg", "Unexpected error");
2803
0
    jpeg_encap_unwind(tif);
2804
0
    return (0);
2805
0
}
2806
#ifdef _MSC_VER
2807
#pragma warning(pop)
2808
#endif
2809
2810
static void OJPEGLibjpegJpegSourceMgrTermSource(jpeg_decompress_struct *cinfo)
2811
0
{
2812
0
    (void)cinfo;
2813
0
}
2814
2815
#endif