Coverage Report

Created: 2025-08-11 09:23

/src/gdal/frmts/gtiff/libtiff/tif_dir.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright (c) 1988-1997 Sam Leffler
3
 * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4
 *
5
 * Permission to use, copy, modify, distribute, and sell this software and
6
 * its documentation for any purpose is hereby granted without fee, provided
7
 * that (i) the above copyright notices and this permission notice appear in
8
 * all copies of the software and related documentation, and (ii) the names of
9
 * Sam Leffler and Silicon Graphics may not be used in any advertising or
10
 * publicity relating to the software without the specific, prior written
11
 * permission of Sam Leffler and Silicon Graphics.
12
 *
13
 * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14
 * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15
 * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16
 *
17
 * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18
 * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19
 * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20
 * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21
 * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22
 * OF THIS SOFTWARE.
23
 */
24
25
/*
26
 * TIFF Library.
27
 *
28
 * Directory Tag Get & Set Routines.
29
 * (and also some miscellaneous stuff)
30
 */
31
#include "tiffiop.h"
32
#include <float.h> /*--: for Rational2Double */
33
#include <limits.h>
34
35
/*
36
 * These are used in the backwards compatibility code...
37
 */
38
659
#define DATATYPE_VOID 0   /* !untyped data */
39
2.10k
#define DATATYPE_INT 1    /* !signed integer data */
40
344
#define DATATYPE_UINT 2   /* !unsigned integer data */
41
1.37k
#define DATATYPE_IEEEFP 3 /* !IEEE floating point data */
42
43
static void setByteArray(TIFF *tif, void **vpp, const void *vp, size_t nmemb,
44
                         size_t elem_size)
45
1.09M
{
46
1.09M
    if (*vpp)
47
221k
    {
48
221k
        _TIFFfreeExt(tif, *vpp);
49
221k
        *vpp = 0;
50
221k
    }
51
1.09M
    if (vp)
52
1.08M
    {
53
1.08M
        tmsize_t bytes = _TIFFMultiplySSize(NULL, nmemb, elem_size, NULL);
54
1.08M
        if (bytes)
55
1.08M
            *vpp = (void *)_TIFFmallocExt(tif, bytes);
56
1.08M
        if (*vpp)
57
1.08M
            _TIFFmemcpy(*vpp, vp, bytes);
58
1.08M
    }
59
1.09M
}
60
void _TIFFsetByteArray(void **vpp, const void *vp, uint32_t n)
61
0
{
62
0
    setByteArray(NULL, vpp, vp, n, 1);
63
0
}
64
void _TIFFsetByteArrayExt(TIFF *tif, void **vpp, const void *vp, uint32_t n)
65
438k
{
66
438k
    setByteArray(tif, vpp, vp, n, 1);
67
438k
}
68
69
static void _TIFFsetNString(TIFF *tif, char **cpp, const char *cp, uint32_t n)
70
3.60k
{
71
3.60k
    setByteArray(tif, (void **)cpp, cp, n, 1);
72
3.60k
}
73
74
void _TIFFsetShortArray(uint16_t **wpp, const uint16_t *wp, uint32_t n)
75
0
{
76
0
    setByteArray(NULL, (void **)wpp, wp, n, sizeof(uint16_t));
77
0
}
78
void _TIFFsetShortArrayExt(TIFF *tif, uint16_t **wpp, const uint16_t *wp,
79
                           uint32_t n)
80
192k
{
81
192k
    setByteArray(tif, (void **)wpp, wp, n, sizeof(uint16_t));
82
192k
}
83
84
void _TIFFsetLongArray(uint32_t **lpp, const uint32_t *lp, uint32_t n)
85
0
{
86
0
    setByteArray(NULL, (void **)lpp, lp, n, sizeof(uint32_t));
87
0
}
88
void _TIFFsetLongArrayExt(TIFF *tif, uint32_t **lpp, const uint32_t *lp,
89
                          uint32_t n)
90
0
{
91
0
    setByteArray(tif, (void **)lpp, lp, n, sizeof(uint32_t));
92
0
}
93
94
static void _TIFFsetLong8Array(TIFF *tif, uint64_t **lpp, const uint64_t *lp,
95
                               uint32_t n)
96
172k
{
97
172k
    setByteArray(tif, (void **)lpp, lp, n, sizeof(uint64_t));
98
172k
}
99
100
void _TIFFsetFloatArray(float **fpp, const float *fp, uint32_t n)
101
0
{
102
0
    setByteArray(NULL, (void **)fpp, fp, n, sizeof(float));
103
0
}
104
void _TIFFsetFloatArrayExt(TIFF *tif, float **fpp, const float *fp, uint32_t n)
105
44.3k
{
106
44.3k
    setByteArray(tif, (void **)fpp, fp, n, sizeof(float));
107
44.3k
}
108
109
void _TIFFsetDoubleArray(double **dpp, const double *dp, uint32_t n)
110
0
{
111
0
    setByteArray(NULL, (void **)dpp, dp, n, sizeof(double));
112
0
}
113
void _TIFFsetDoubleArrayExt(TIFF *tif, double **dpp, const double *dp,
114
                            uint32_t n)
115
5.25k
{
116
5.25k
    setByteArray(tif, (void **)dpp, dp, n, sizeof(double));
117
5.25k
}
118
119
static void setDoubleArrayOneValue(TIFF *tif, double **vpp, double value,
120
                                   size_t nmemb)
121
0
{
122
0
    if (*vpp)
123
0
        _TIFFfreeExt(tif, *vpp);
124
0
    *vpp = _TIFFmallocExt(tif, nmemb * sizeof(double));
125
0
    if (*vpp)
126
0
    {
127
0
        while (nmemb--)
128
0
            ((double *)*vpp)[nmemb] = value;
129
0
    }
130
0
}
131
132
/*
133
 * Install extra samples information.
134
 */
135
static int setExtraSamples(TIFF *tif, va_list ap, uint32_t *v)
136
82.0k
{
137
/* XXX: Unassociated alpha data == 999 is a known Corel Draw bug, see below */
138
82.0k
#define EXTRASAMPLE_COREL_UNASSALPHA 999
139
140
82.0k
    uint16_t *va;
141
82.0k
    uint32_t i;
142
82.0k
    TIFFDirectory *td = &tif->tif_dir;
143
82.0k
    static const char module[] = "setExtraSamples";
144
145
82.0k
    *v = (uint16_t)va_arg(ap, uint16_vap);
146
82.0k
    if ((uint16_t)*v > td->td_samplesperpixel)
147
29
        return 0;
148
82.0k
    va = va_arg(ap, uint16_t *);
149
82.0k
    if (*v > 0 && va == NULL) /* typically missing param */
150
0
        return 0;
151
2.77M
    for (i = 0; i < *v; i++)
152
2.68M
    {
153
2.68M
        if (va[i] > EXTRASAMPLE_UNASSALPHA)
154
130
        {
155
            /*
156
             * XXX: Corel Draw is known to produce incorrect
157
             * ExtraSamples tags which must be patched here if we
158
             * want to be able to open some of the damaged TIFF
159
             * files:
160
             */
161
130
            if (va[i] == EXTRASAMPLE_COREL_UNASSALPHA)
162
23
                va[i] = EXTRASAMPLE_UNASSALPHA;
163
107
            else
164
107
                return 0;
165
130
        }
166
2.68M
    }
167
168
81.8k
    if (td->td_transferfunction[0] != NULL &&
169
81.8k
        (td->td_samplesperpixel - *v > 1) &&
170
81.8k
        !(td->td_samplesperpixel - td->td_extrasamples > 1))
171
0
    {
172
0
        TIFFWarningExtR(tif, module,
173
0
                        "ExtraSamples tag value is changing, "
174
0
                        "but TransferFunction was read with a different value. "
175
0
                        "Canceling it");
176
0
        TIFFClrFieldBit(tif, FIELD_TRANSFERFUNCTION);
177
0
        _TIFFfreeExt(tif, td->td_transferfunction[0]);
178
0
        td->td_transferfunction[0] = NULL;
179
0
    }
180
181
81.8k
    td->td_extrasamples = (uint16_t)*v;
182
81.8k
    _TIFFsetShortArrayExt(tif, &td->td_sampleinfo, va, td->td_extrasamples);
183
81.8k
    return 1;
184
185
82.0k
#undef EXTRASAMPLE_COREL_UNASSALPHA
186
82.0k
}
187
188
/*
189
 * Count ink names separated by \0.  Returns
190
 * zero if the ink names are not as expected.
191
 */
192
static uint16_t countInkNamesString(TIFF *tif, uint32_t slen, const char *s)
193
4.23k
{
194
4.23k
    uint16_t i = 0;
195
196
4.23k
    if (slen > 0)
197
3.60k
    {
198
3.60k
        const char *ep = s + slen;
199
3.60k
        const char *cp = s;
200
3.60k
        do
201
658k
        {
202
755k
            for (; cp < ep && *cp != '\0'; cp++)
203
96.6k
            {
204
96.6k
            }
205
658k
            if (cp >= ep)
206
0
                goto bad;
207
658k
            cp++; /* skip \0 */
208
658k
            i++;
209
658k
        } while (cp < ep);
210
3.60k
        return (i);
211
3.60k
    }
212
629
bad:
213
629
    TIFFErrorExtR(tif, "TIFFSetField",
214
629
                  "%s: Invalid InkNames value; no null at given buffer end "
215
629
                  "location %" PRIu32 ", after %" PRIu16 " ink",
216
629
                  tif->tif_name, slen, i);
217
629
    return (0);
218
4.23k
}
219
220
static int _TIFFVSetField(TIFF *tif, uint32_t tag, va_list ap)
221
21.0M
{
222
21.0M
    static const char module[] = "_TIFFVSetField";
223
224
21.0M
    TIFFDirectory *td = &tif->tif_dir;
225
21.0M
    int status = 1;
226
21.0M
    uint32_t v32, v;
227
21.0M
    double dblval;
228
21.0M
    char *s;
229
21.0M
    const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
230
21.0M
    uint32_t standard_tag = tag;
231
21.0M
    if (fip == NULL) /* cannot happen since OkToChangeTag() already checks it */
232
0
        return 0;
233
    /*
234
     * We want to force the custom code to be used for custom
235
     * fields even if the tag happens to match a well known
236
     * one - important for reinterpreted handling of standard
237
     * tag values in custom directories (i.e. EXIF)
238
     */
239
21.0M
    if (fip->field_bit == FIELD_CUSTOM)
240
1.11M
    {
241
1.11M
        standard_tag = 0;
242
1.11M
    }
243
244
21.0M
    switch (standard_tag)
245
21.0M
    {
246
248k
        case TIFFTAG_SUBFILETYPE:
247
248k
            td->td_subfiletype = (uint32_t)va_arg(ap, uint32_t);
248
248k
            break;
249
1.92M
        case TIFFTAG_IMAGEWIDTH:
250
1.92M
            td->td_imagewidth = (uint32_t)va_arg(ap, uint32_t);
251
1.92M
            break;
252
1.91M
        case TIFFTAG_IMAGELENGTH:
253
1.91M
            td->td_imagelength = (uint32_t)va_arg(ap, uint32_t);
254
1.91M
            break;
255
1.52M
        case TIFFTAG_BITSPERSAMPLE:
256
1.52M
            td->td_bitspersample = (uint16_t)va_arg(ap, uint16_vap);
257
            /*
258
             * If the data require post-decoding processing to byte-swap
259
             * samples, set it up here.  Note that since tags are required
260
             * to be ordered, compression code can override this behavior
261
             * in the setup method if it wants to roll the post decoding
262
             * work in with its normal work.
263
             */
264
1.52M
            if (tif->tif_flags & TIFF_SWAB)
265
1.67k
            {
266
1.67k
                if (td->td_bitspersample == 8)
267
1.09k
                    tif->tif_postdecode = _TIFFNoPostDecode;
268
582
                else if (td->td_bitspersample == 16)
269
104
                    tif->tif_postdecode = _TIFFSwab16BitData;
270
478
                else if (td->td_bitspersample == 24)
271
79
                    tif->tif_postdecode = _TIFFSwab24BitData;
272
399
                else if (td->td_bitspersample == 32)
273
103
                    tif->tif_postdecode = _TIFFSwab32BitData;
274
296
                else if (td->td_bitspersample == 64)
275
122
                    tif->tif_postdecode = _TIFFSwab64BitData;
276
174
                else if (td->td_bitspersample == 128) /* two 64's */
277
2
                    tif->tif_postdecode = _TIFFSwab64BitData;
278
1.67k
            }
279
1.52M
            break;
280
4.72M
        case TIFFTAG_COMPRESSION:
281
4.72M
            v = (uint16_t)va_arg(ap, uint16_vap);
282
            /*
283
             * If we're changing the compression scheme, notify the
284
             * previous module so that it can cleanup any state it's
285
             * setup.
286
             */
287
4.72M
            if (TIFFFieldSet(tif, FIELD_COMPRESSION))
288
1.93M
            {
289
1.93M
                if ((uint32_t)td->td_compression == v)
290
452k
                    break;
291
1.47M
                (*tif->tif_cleanup)(tif);
292
1.47M
                tif->tif_flags &= ~TIFF_CODERSETUP;
293
1.47M
            }
294
            /*
295
             * Setup new compression routine state.
296
             */
297
4.27M
            if ((status = TIFFSetCompressionScheme(tif, v)) != 0)
298
4.27M
                td->td_compression = (uint16_t)v;
299
0
            else
300
0
                status = 0;
301
4.27M
            break;
302
1.47M
        case TIFFTAG_PHOTOMETRIC:
303
1.47M
            td->td_photometric = (uint16_t)va_arg(ap, uint16_vap);
304
1.47M
            break;
305
3.23k
        case TIFFTAG_THRESHHOLDING:
306
3.23k
            td->td_threshholding = (uint16_t)va_arg(ap, uint16_vap);
307
3.23k
            break;
308
8.31k
        case TIFFTAG_FILLORDER:
309
8.31k
            v = (uint16_t)va_arg(ap, uint16_vap);
310
8.31k
            if (v != FILLORDER_LSB2MSB && v != FILLORDER_MSB2LSB)
311
1.96k
                goto badvalue;
312
6.35k
            td->td_fillorder = (uint16_t)v;
313
6.35k
            break;
314
7.21k
        case TIFFTAG_ORIENTATION:
315
7.21k
            v = (uint16_t)va_arg(ap, uint16_vap);
316
7.21k
            if (v < ORIENTATION_TOPLEFT || ORIENTATION_LEFTBOT < v)
317
2.51k
                goto badvalue;
318
4.69k
            else
319
4.69k
                td->td_orientation = (uint16_t)v;
320
4.69k
            break;
321
1.55M
        case TIFFTAG_SAMPLESPERPIXEL:
322
1.55M
            v = (uint16_t)va_arg(ap, uint16_vap);
323
1.55M
            if (v == 0)
324
37
                goto badvalue;
325
1.55M
            if (v != td->td_samplesperpixel)
326
340k
            {
327
                /* See http://bugzilla.maptools.org/show_bug.cgi?id=2500 */
328
340k
                if (td->td_sminsamplevalue != NULL)
329
833
                {
330
833
                    TIFFWarningExtR(tif, module,
331
833
                                    "SamplesPerPixel tag value is changing, "
332
833
                                    "but SMinSampleValue tag was read with a "
333
833
                                    "different value. Canceling it");
334
833
                    TIFFClrFieldBit(tif, FIELD_SMINSAMPLEVALUE);
335
833
                    _TIFFfreeExt(tif, td->td_sminsamplevalue);
336
833
                    td->td_sminsamplevalue = NULL;
337
833
                }
338
340k
                if (td->td_smaxsamplevalue != NULL)
339
544
                {
340
544
                    TIFFWarningExtR(tif, module,
341
544
                                    "SamplesPerPixel tag value is changing, "
342
544
                                    "but SMaxSampleValue tag was read with a "
343
544
                                    "different value. Canceling it");
344
544
                    TIFFClrFieldBit(tif, FIELD_SMAXSAMPLEVALUE);
345
544
                    _TIFFfreeExt(tif, td->td_smaxsamplevalue);
346
544
                    td->td_smaxsamplevalue = NULL;
347
544
                }
348
                /* Test if 3 transfer functions instead of just one are now
349
                   needed See http://bugzilla.maptools.org/show_bug.cgi?id=2820
350
                 */
351
340k
                if (td->td_transferfunction[0] != NULL &&
352
340k
                    (v - td->td_extrasamples > 1) &&
353
340k
                    !(td->td_samplesperpixel - td->td_extrasamples > 1))
354
135
                {
355
135
                    TIFFWarningExtR(tif, module,
356
135
                                    "SamplesPerPixel tag value is changing, "
357
135
                                    "but TransferFunction was read with a "
358
135
                                    "different value. Canceling it");
359
135
                    TIFFClrFieldBit(tif, FIELD_TRANSFERFUNCTION);
360
135
                    _TIFFfreeExt(tif, td->td_transferfunction[0]);
361
135
                    td->td_transferfunction[0] = NULL;
362
135
                }
363
340k
            }
364
1.55M
            td->td_samplesperpixel = (uint16_t)v;
365
1.55M
            break;
366
1.61M
        case TIFFTAG_ROWSPERSTRIP:
367
1.61M
            v32 = (uint32_t)va_arg(ap, uint32_t);
368
1.61M
            if (v32 == 0)
369
43
                goto badvalue32;
370
1.61M
            td->td_rowsperstrip = v32;
371
1.61M
            if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS))
372
1.61M
            {
373
1.61M
                td->td_tilelength = v32;
374
1.61M
                td->td_tilewidth = td->td_imagewidth;
375
1.61M
            }
376
1.61M
            break;
377
12.4k
        case TIFFTAG_MINSAMPLEVALUE:
378
12.4k
            td->td_minsamplevalue = (uint16_t)va_arg(ap, uint16_vap);
379
12.4k
            break;
380
8.67k
        case TIFFTAG_MAXSAMPLEVALUE:
381
8.67k
            td->td_maxsamplevalue = (uint16_t)va_arg(ap, uint16_vap);
382
8.67k
            break;
383
2.08k
        case TIFFTAG_SMINSAMPLEVALUE:
384
2.08k
            if (tif->tif_flags & TIFF_PERSAMPLE)
385
2.08k
                _TIFFsetDoubleArrayExt(tif, &td->td_sminsamplevalue,
386
2.08k
                                       va_arg(ap, double *),
387
2.08k
                                       td->td_samplesperpixel);
388
0
            else
389
0
                setDoubleArrayOneValue(tif, &td->td_sminsamplevalue,
390
0
                                       va_arg(ap, double),
391
0
                                       td->td_samplesperpixel);
392
2.08k
            break;
393
3.16k
        case TIFFTAG_SMAXSAMPLEVALUE:
394
3.16k
            if (tif->tif_flags & TIFF_PERSAMPLE)
395
3.16k
                _TIFFsetDoubleArrayExt(tif, &td->td_smaxsamplevalue,
396
3.16k
                                       va_arg(ap, double *),
397
3.16k
                                       td->td_samplesperpixel);
398
0
            else
399
0
                setDoubleArrayOneValue(tif, &td->td_smaxsamplevalue,
400
0
                                       va_arg(ap, double),
401
0
                                       td->td_samplesperpixel);
402
3.16k
            break;
403
9.72k
        case TIFFTAG_XRESOLUTION:
404
9.72k
            dblval = va_arg(ap, double);
405
9.72k
            if (dblval != dblval || dblval < 0)
406
1.31k
                goto badvaluedouble;
407
8.41k
            td->td_xresolution = _TIFFClampDoubleToFloat(dblval);
408
8.41k
            break;
409
11.6k
        case TIFFTAG_YRESOLUTION:
410
11.6k
            dblval = va_arg(ap, double);
411
11.6k
            if (dblval != dblval || dblval < 0)
412
767
                goto badvaluedouble;
413
10.9k
            td->td_yresolution = _TIFFClampDoubleToFloat(dblval);
414
10.9k
            break;
415
2.74M
        case TIFFTAG_PLANARCONFIG:
416
2.74M
            v = (uint16_t)va_arg(ap, uint16_vap);
417
2.74M
            if (v != PLANARCONFIG_CONTIG && v != PLANARCONFIG_SEPARATE)
418
135
                goto badvalue;
419
2.74M
            td->td_planarconfig = (uint16_t)v;
420
2.74M
            break;
421
10.7k
        case TIFFTAG_XPOSITION:
422
10.7k
            td->td_xposition = _TIFFClampDoubleToFloat(va_arg(ap, double));
423
10.7k
            break;
424
10.2k
        case TIFFTAG_YPOSITION:
425
10.2k
            td->td_yposition = _TIFFClampDoubleToFloat(va_arg(ap, double));
426
10.2k
            break;
427
8.46k
        case TIFFTAG_RESOLUTIONUNIT:
428
8.46k
            v = (uint16_t)va_arg(ap, uint16_vap);
429
8.46k
            if (v < RESUNIT_NONE || RESUNIT_CENTIMETER < v)
430
2.12k
                goto badvalue;
431
6.33k
            td->td_resolutionunit = (uint16_t)v;
432
6.33k
            break;
433
1.33k
        case TIFFTAG_PAGENUMBER:
434
1.33k
            td->td_pagenumber[0] = (uint16_t)va_arg(ap, uint16_vap);
435
1.33k
            td->td_pagenumber[1] = (uint16_t)va_arg(ap, uint16_vap);
436
1.33k
            break;
437
489
        case TIFFTAG_HALFTONEHINTS:
438
489
            td->td_halftonehints[0] = (uint16_t)va_arg(ap, uint16_vap);
439
489
            td->td_halftonehints[1] = (uint16_t)va_arg(ap, uint16_vap);
440
489
            break;
441
6.22k
        case TIFFTAG_COLORMAP:
442
6.22k
            v32 = (uint32_t)(1L << td->td_bitspersample);
443
6.22k
            _TIFFsetShortArrayExt(tif, &td->td_colormap[0],
444
6.22k
                                  va_arg(ap, uint16_t *), v32);
445
6.22k
            _TIFFsetShortArrayExt(tif, &td->td_colormap[1],
446
6.22k
                                  va_arg(ap, uint16_t *), v32);
447
6.22k
            _TIFFsetShortArrayExt(tif, &td->td_colormap[2],
448
6.22k
                                  va_arg(ap, uint16_t *), v32);
449
6.22k
            break;
450
82.0k
        case TIFFTAG_EXTRASAMPLES:
451
82.0k
            if (!setExtraSamples(tif, ap, &v))
452
136
                goto badvalue;
453
81.8k
            break;
454
81.8k
        case TIFFTAG_MATTEING:
455
1.26k
            td->td_extrasamples = (((uint16_t)va_arg(ap, uint16_vap)) != 0);
456
1.26k
            if (td->td_extrasamples)
457
821
            {
458
821
                uint16_t sv = EXTRASAMPLE_ASSOCALPHA;
459
821
                _TIFFsetShortArrayExt(tif, &td->td_sampleinfo, &sv, 1);
460
821
            }
461
1.26k
            break;
462
147k
        case TIFFTAG_TILEWIDTH:
463
147k
            v32 = (uint32_t)va_arg(ap, uint32_t);
464
147k
            if (v32 % 16)
465
34.1k
            {
466
34.1k
                if (tif->tif_mode != O_RDONLY)
467
0
                    goto badvalue32;
468
34.1k
                TIFFWarningExtR(
469
34.1k
                    tif, tif->tif_name,
470
34.1k
                    "Nonstandard tile width %" PRIu32 ", convert file", v32);
471
34.1k
            }
472
147k
            td->td_tilewidth = v32;
473
147k
            tif->tif_flags |= TIFF_ISTILED;
474
147k
            break;
475
145k
        case TIFFTAG_TILELENGTH:
476
145k
            v32 = (uint32_t)va_arg(ap, uint32_t);
477
145k
            if (v32 % 16)
478
46.8k
            {
479
46.8k
                if (tif->tif_mode != O_RDONLY)
480
0
                    goto badvalue32;
481
46.8k
                TIFFWarningExtR(
482
46.8k
                    tif, tif->tif_name,
483
46.8k
                    "Nonstandard tile length %" PRIu32 ", convert file", v32);
484
46.8k
            }
485
145k
            td->td_tilelength = v32;
486
145k
            tif->tif_flags |= TIFF_ISTILED;
487
145k
            break;
488
1.08k
        case TIFFTAG_TILEDEPTH:
489
1.08k
            v32 = (uint32_t)va_arg(ap, uint32_t);
490
1.08k
            if (v32 == 0)
491
13
                goto badvalue32;
492
1.07k
            td->td_tiledepth = v32;
493
1.07k
            break;
494
4.50k
        case TIFFTAG_DATATYPE:
495
4.50k
            v = (uint16_t)va_arg(ap, uint16_vap);
496
4.50k
            switch (v)
497
4.50k
            {
498
659
                case DATATYPE_VOID:
499
659
                    v = SAMPLEFORMAT_VOID;
500
659
                    break;
501
2.10k
                case DATATYPE_INT:
502
2.10k
                    v = SAMPLEFORMAT_INT;
503
2.10k
                    break;
504
344
                case DATATYPE_UINT:
505
344
                    v = SAMPLEFORMAT_UINT;
506
344
                    break;
507
1.37k
                case DATATYPE_IEEEFP:
508
1.37k
                    v = SAMPLEFORMAT_IEEEFP;
509
1.37k
                    break;
510
27
                default:
511
27
                    goto badvalue;
512
4.50k
            }
513
4.48k
            td->td_sampleformat = (uint16_t)v;
514
4.48k
            break;
515
1.34M
        case TIFFTAG_SAMPLEFORMAT:
516
1.34M
            v = (uint16_t)va_arg(ap, uint16_vap);
517
1.34M
            if (v < SAMPLEFORMAT_UINT || SAMPLEFORMAT_COMPLEXIEEEFP < v)
518
98
                goto badvalue;
519
1.34M
            td->td_sampleformat = (uint16_t)v;
520
521
            /*  Try to fix up the SWAB function for complex data. */
522
1.34M
            if (td->td_sampleformat == SAMPLEFORMAT_COMPLEXINT &&
523
1.34M
                td->td_bitspersample == 32 &&
524
1.34M
                tif->tif_postdecode == _TIFFSwab32BitData)
525
1
                tif->tif_postdecode = _TIFFSwab16BitData;
526
1.34M
            else if ((td->td_sampleformat == SAMPLEFORMAT_COMPLEXINT ||
527
1.34M
                      td->td_sampleformat == SAMPLEFORMAT_COMPLEXIEEEFP) &&
528
1.34M
                     td->td_bitspersample == 64 &&
529
1.34M
                     tif->tif_postdecode == _TIFFSwab64BitData)
530
4
                tif->tif_postdecode = _TIFFSwab32BitData;
531
1.34M
            break;
532
1.15k
        case TIFFTAG_IMAGEDEPTH:
533
1.15k
            td->td_imagedepth = (uint32_t)va_arg(ap, uint32_t);
534
1.15k
            break;
535
172k
        case TIFFTAG_SUBIFD:
536
172k
            if ((tif->tif_flags & TIFF_INSUBIFD) == 0)
537
172k
            {
538
172k
                td->td_nsubifd = (uint16_t)va_arg(ap, uint16_vap);
539
172k
                _TIFFsetLong8Array(tif, &td->td_subifd,
540
172k
                                   (uint64_t *)va_arg(ap, uint64_t *),
541
172k
                                   (uint32_t)td->td_nsubifd);
542
172k
            }
543
0
            else
544
0
            {
545
0
                TIFFErrorExtR(tif, module, "%s: Sorry, cannot nest SubIFDs",
546
0
                              tif->tif_name);
547
0
                status = 0;
548
0
            }
549
172k
            break;
550
1.47k
        case TIFFTAG_YCBCRPOSITIONING:
551
1.47k
            td->td_ycbcrpositioning = (uint16_t)va_arg(ap, uint16_vap);
552
1.47k
            break;
553
103k
        case TIFFTAG_YCBCRSUBSAMPLING:
554
103k
            td->td_ycbcrsubsampling[0] = (uint16_t)va_arg(ap, uint16_vap);
555
103k
            td->td_ycbcrsubsampling[1] = (uint16_t)va_arg(ap, uint16_vap);
556
103k
            break;
557
524
        case TIFFTAG_TRANSFERFUNCTION:
558
524
        {
559
524
            uint32_t i;
560
524
            v = (td->td_samplesperpixel - td->td_extrasamples) > 1 ? 3 : 1;
561
1.49k
            for (i = 0; i < v; i++)
562
968
                _TIFFsetShortArrayExt(tif, &td->td_transferfunction[i],
563
968
                                      va_arg(ap, uint16_t *),
564
968
                                      1U << td->td_bitspersample);
565
524
            break;
566
1.34M
        }
567
44.3k
        case TIFFTAG_REFERENCEBLACKWHITE:
568
            /* XXX should check for null range */
569
44.3k
            _TIFFsetFloatArrayExt(tif, &td->td_refblackwhite,
570
44.3k
                                  va_arg(ap, float *), 6);
571
44.3k
            break;
572
4.23k
        case TIFFTAG_INKNAMES:
573
4.23k
        {
574
4.23k
            v = (uint16_t)va_arg(ap, uint16_vap);
575
4.23k
            s = va_arg(ap, char *);
576
4.23k
            uint16_t ninksinstring;
577
4.23k
            ninksinstring = countInkNamesString(tif, v, s);
578
4.23k
            status = ninksinstring > 0;
579
4.23k
            if (ninksinstring > 0)
580
3.60k
            {
581
3.60k
                _TIFFsetNString(tif, &td->td_inknames, s, v);
582
3.60k
                td->td_inknameslen = v;
583
                /* Set NumberOfInks to the value ninksinstring */
584
3.60k
                if (TIFFFieldSet(tif, FIELD_NUMBEROFINKS))
585
430
                {
586
430
                    if (td->td_numberofinks != ninksinstring)
587
280
                    {
588
280
                        TIFFErrorExtR(
589
280
                            tif, module,
590
280
                            "Warning %s; Tag %s:\n  Value %" PRIu16
591
280
                            " of NumberOfInks is different from the number of "
592
280
                            "inks %" PRIu16
593
280
                            ".\n  -> NumberOfInks value adapted to %" PRIu16 "",
594
280
                            tif->tif_name, fip->field_name, td->td_numberofinks,
595
280
                            ninksinstring, ninksinstring);
596
280
                        td->td_numberofinks = ninksinstring;
597
280
                    }
598
430
                }
599
3.17k
                else
600
3.17k
                {
601
3.17k
                    td->td_numberofinks = ninksinstring;
602
3.17k
                    TIFFSetFieldBit(tif, FIELD_NUMBEROFINKS);
603
3.17k
                }
604
3.60k
                if (TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL))
605
2.77k
                {
606
2.77k
                    if (td->td_numberofinks != td->td_samplesperpixel)
607
2.10k
                    {
608
2.10k
                        TIFFErrorExtR(tif, module,
609
2.10k
                                      "Warning %s; Tag %s:\n  Value %" PRIu16
610
2.10k
                                      " of NumberOfInks is different from the "
611
2.10k
                                      "SamplesPerPixel value %" PRIu16 "",
612
2.10k
                                      tif->tif_name, fip->field_name,
613
2.10k
                                      td->td_numberofinks,
614
2.10k
                                      td->td_samplesperpixel);
615
2.10k
                    }
616
2.77k
                }
617
3.60k
            }
618
4.23k
        }
619
4.23k
        break;
620
4.11k
        case TIFFTAG_NUMBEROFINKS:
621
4.11k
            v = (uint16_t)va_arg(ap, uint16_vap);
622
            /* If InkNames already set also NumberOfInks is set accordingly and
623
             * should be equal */
624
4.11k
            if (TIFFFieldSet(tif, FIELD_INKNAMES))
625
1.05k
            {
626
1.05k
                if (v != td->td_numberofinks)
627
596
                {
628
596
                    TIFFErrorExtR(
629
596
                        tif, module,
630
596
                        "Error %s; Tag %s:\n  It is not possible to set the "
631
596
                        "value %" PRIu32
632
596
                        " for NumberOfInks\n  which is different from the "
633
596
                        "number of inks in the InkNames tag (%" PRIu16 ")",
634
596
                        tif->tif_name, fip->field_name, v, td->td_numberofinks);
635
                    /* Do not set / overwrite number of inks already set by
636
                     * InkNames case accordingly. */
637
596
                    status = 0;
638
596
                }
639
1.05k
            }
640
3.06k
            else
641
3.06k
            {
642
3.06k
                td->td_numberofinks = (uint16_t)v;
643
3.06k
                if (TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL))
644
1.58k
                {
645
1.58k
                    if (td->td_numberofinks != td->td_samplesperpixel)
646
1.20k
                    {
647
1.20k
                        TIFFErrorExtR(tif, module,
648
1.20k
                                      "Warning %s; Tag %s:\n  Value %" PRIu32
649
1.20k
                                      " of NumberOfInks is different from the "
650
1.20k
                                      "SamplesPerPixel value %" PRIu16 "",
651
1.20k
                                      tif->tif_name, fip->field_name, v,
652
1.20k
                                      td->td_samplesperpixel);
653
1.20k
                    }
654
1.58k
                }
655
3.06k
            }
656
4.11k
            break;
657
0
        case TIFFTAG_PERSAMPLE:
658
0
            v = (uint16_t)va_arg(ap, uint16_vap);
659
0
            if (v == PERSAMPLE_MULTI)
660
0
                tif->tif_flags |= TIFF_PERSAMPLE;
661
0
            else
662
0
                tif->tif_flags &= ~TIFF_PERSAMPLE;
663
0
            break;
664
1.11M
        default:
665
1.11M
        {
666
1.11M
            TIFFTagValue *tv;
667
1.11M
            int tv_size, iCustom;
668
669
            /*
670
             * This can happen if multiple images are open with different
671
             * codecs which have private tags.  The global tag information
672
             * table may then have tags that are valid for one file but not
673
             * the other. If the client tries to set a tag that is not valid
674
             * for the image's codec then we'll arrive here.  This
675
             * happens, for example, when tiffcp is used to convert between
676
             * compression schemes and codec-specific tags are blindly copied.
677
             *
678
             * This also happens when a FIELD_IGNORE tag is written.
679
             */
680
1.11M
            if (fip->field_bit == FIELD_IGNORE)
681
0
            {
682
0
                TIFFErrorExtR(
683
0
                    tif, module,
684
0
                    "%s: Ignored %stag \"%s\" (not supported by libtiff)",
685
0
                    tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
686
0
                    fip->field_name);
687
0
                status = 0;
688
0
                break;
689
0
            }
690
1.11M
            if (fip->field_bit != FIELD_CUSTOM)
691
0
            {
692
0
                TIFFErrorExtR(
693
0
                    tif, module,
694
0
                    "%s: Invalid %stag \"%s\" (not supported by codec)",
695
0
                    tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
696
0
                    fip->field_name);
697
0
                status = 0;
698
0
                break;
699
0
            }
700
701
            /*
702
             * Find the existing entry for this custom value.
703
             */
704
1.11M
            tv = NULL;
705
2.52M
            for (iCustom = 0; iCustom < td->td_customValueCount; iCustom++)
706
1.42M
            {
707
1.42M
                if (td->td_customValues[iCustom].info->field_tag == tag)
708
16.2k
                {
709
16.2k
                    tv = td->td_customValues + iCustom;
710
16.2k
                    if (tv->value != NULL)
711
16.2k
                    {
712
16.2k
                        _TIFFfreeExt(tif, tv->value);
713
16.2k
                        tv->value = NULL;
714
16.2k
                    }
715
16.2k
                    break;
716
16.2k
                }
717
1.42M
            }
718
719
            /*
720
             * Grow the custom list if the entry was not found.
721
             */
722
1.11M
            if (tv == NULL)
723
1.10M
            {
724
1.10M
                TIFFTagValue *new_customValues;
725
726
1.10M
                new_customValues = (TIFFTagValue *)_TIFFreallocExt(
727
1.10M
                    tif, td->td_customValues,
728
1.10M
                    sizeof(TIFFTagValue) * (td->td_customValueCount + 1));
729
1.10M
                if (!new_customValues)
730
0
                {
731
0
                    TIFFErrorExtR(tif, module,
732
0
                                  "%s: Failed to allocate space for list of "
733
0
                                  "custom values",
734
0
                                  tif->tif_name);
735
0
                    status = 0;
736
0
                    goto end;
737
0
                }
738
739
1.10M
                td->td_customValueCount++;
740
1.10M
                td->td_customValues = new_customValues;
741
742
1.10M
                tv = td->td_customValues + (td->td_customValueCount - 1);
743
1.10M
                tv->info = fip;
744
1.10M
                tv->value = NULL;
745
1.10M
                tv->count = 0;
746
1.10M
            }
747
748
            /*
749
             * Set custom value ... save a copy of the custom tag value.
750
             */
751
            /*--: Rational2Double: For Rationals evaluate "set_get_field_type"
752
             * to determine internal storage size. */
753
1.11M
            tv_size = TIFFFieldSetGetSize(fip);
754
1.11M
            if (tv_size == 0)
755
0
            {
756
0
                status = 0;
757
0
                TIFFErrorExtR(tif, module, "%s: Bad field type %d for \"%s\"",
758
0
                              tif->tif_name, fip->field_type, fip->field_name);
759
0
                goto end;
760
0
            }
761
762
1.11M
            if (fip->field_type == TIFF_ASCII)
763
242k
            {
764
242k
                uint32_t ma;
765
242k
                const char *mb;
766
242k
                if (fip->field_passcount)
767
34.9k
                {
768
34.9k
                    assert(fip->field_writecount == TIFF_VARIABLE2);
769
34.9k
                    ma = (uint32_t)va_arg(ap, uint32_t);
770
34.9k
                    mb = (const char *)va_arg(ap, const char *);
771
34.9k
                }
772
207k
                else
773
207k
                {
774
207k
                    mb = (const char *)va_arg(ap, const char *);
775
207k
                    size_t len = strlen(mb) + 1;
776
207k
                    if (len >= 0x80000000U)
777
0
                    {
778
0
                        status = 0;
779
0
                        TIFFErrorExtR(tif, module,
780
0
                                      "%s: Too long string value for \"%s\". "
781
0
                                      "Maximum supported is 2147483647 bytes",
782
0
                                      tif->tif_name, fip->field_name);
783
0
                        goto end;
784
0
                    }
785
207k
                    ma = (uint32_t)len;
786
207k
                }
787
242k
                tv->count = ma;
788
242k
                setByteArray(tif, &tv->value, mb, ma, 1);
789
242k
            }
790
876k
            else
791
876k
            {
792
876k
                if (fip->field_passcount)
793
849k
                {
794
849k
                    if (fip->field_writecount == TIFF_VARIABLE2)
795
623k
                        tv->count = (uint32_t)va_arg(ap, uint32_t);
796
225k
                    else
797
225k
                        tv->count = (int)va_arg(ap, int);
798
849k
                }
799
26.7k
                else if (fip->field_writecount == TIFF_VARIABLE ||
800
26.7k
                         fip->field_writecount == TIFF_VARIABLE2)
801
0
                    tv->count = 1;
802
26.7k
                else if (fip->field_writecount == TIFF_SPP)
803
0
                    tv->count = td->td_samplesperpixel;
804
26.7k
                else
805
26.7k
                    tv->count = fip->field_writecount;
806
807
876k
                if (tv->count == 0)
808
123k
                {
809
123k
                    TIFFWarningExtR(tif, module,
810
123k
                                    "%s: Null count for \"%s\" (type "
811
123k
                                    "%d, writecount %d, passcount %d)",
812
123k
                                    tif->tif_name, fip->field_name,
813
123k
                                    fip->field_type, fip->field_writecount,
814
123k
                                    fip->field_passcount);
815
123k
                    break;
816
123k
                }
817
818
752k
                tv->value = _TIFFCheckMalloc(tif, tv->count, tv_size,
819
752k
                                             "custom tag binary object");
820
752k
                if (!tv->value)
821
0
                {
822
0
                    status = 0;
823
0
                    goto end;
824
0
                }
825
826
752k
                if (fip->field_tag == TIFFTAG_DOTRANGE &&
827
752k
                    strcmp(fip->field_name, "DotRange") == 0)
828
134
                {
829
                    /* TODO: This is an evil exception and should not have been
830
                       handled this way ... likely best if we move it into
831
                       the directory structure with an explicit field in
832
                       libtiff 4.1 and assign it a FIELD_ value */
833
134
                    uint16_t v2[2];
834
134
                    v2[0] = (uint16_t)va_arg(ap, int);
835
134
                    v2[1] = (uint16_t)va_arg(ap, int);
836
134
                    _TIFFmemcpy(tv->value, &v2, 4);
837
134
                }
838
839
752k
                else if (fip->field_passcount ||
840
752k
                         fip->field_writecount == TIFF_VARIABLE ||
841
752k
                         fip->field_writecount == TIFF_VARIABLE2 ||
842
752k
                         fip->field_writecount == TIFF_SPP || tv->count > 1)
843
729k
                {
844
                    /*--: Rational2Double: For Rationals tv_size is set above to
845
                     * 4 or 8 according to fip->set_get_field_type! */
846
729k
                    _TIFFmemcpy(tv->value, va_arg(ap, void *),
847
729k
                                tv->count * tv_size);
848
                    /* Test here for too big values for LONG8, SLONG8 in
849
                     * ClassicTIFF and delete custom field from custom list */
850
729k
                    if (!(tif->tif_flags & TIFF_BIGTIFF))
851
728k
                    {
852
728k
                        if (tv->info->field_type == TIFF_LONG8)
853
5.51k
                        {
854
5.51k
                            uint64_t *pui64 = (uint64_t *)tv->value;
855
9.20k
                            for (int i = 0; i < tv->count; i++)
856
8.83k
                            {
857
8.83k
                                if (pui64[i] > 0xffffffffu)
858
5.14k
                                {
859
5.14k
                                    TIFFErrorExtR(
860
5.14k
                                        tif, module,
861
5.14k
                                        "%s: Bad LONG8 value %" PRIu64
862
5.14k
                                        " at %d. array position for \"%s\" tag "
863
5.14k
                                        "%d in ClassicTIFF. Tag won't be "
864
5.14k
                                        "written to file",
865
5.14k
                                        tif->tif_name, pui64[i], i,
866
5.14k
                                        fip->field_name, tag);
867
5.14k
                                    goto badvalueifd8long8;
868
5.14k
                                }
869
8.83k
                            }
870
5.51k
                        }
871
723k
                        else if (tv->info->field_type == TIFF_SLONG8)
872
5.81k
                        {
873
5.81k
                            int64_t *pi64 = (int64_t *)tv->value;
874
9.91k
                            for (int i = 0; i < tv->count; i++)
875
9.09k
                            {
876
9.09k
                                if (pi64[i] > 2147483647 ||
877
9.09k
                                    pi64[i] < (-2147483647 - 1))
878
4.98k
                                {
879
4.98k
                                    TIFFErrorExtR(
880
4.98k
                                        tif, module,
881
4.98k
                                        "%s: Bad SLONG8 value %" PRIi64
882
4.98k
                                        " at %d. array position for \"%s\" tag "
883
4.98k
                                        "%d in ClassicTIFF. Tag won't be "
884
4.98k
                                        "written to file",
885
4.98k
                                        tif->tif_name, pi64[i], i,
886
4.98k
                                        fip->field_name, tag);
887
4.98k
                                    goto badvalueifd8long8;
888
4.98k
                                }
889
9.09k
                            }
890
5.81k
                        }
891
728k
                    }
892
729k
                }
893
23.3k
                else
894
23.3k
                {
895
23.3k
                    char *val = (char *)tv->value;
896
23.3k
                    assert(tv->count == 1);
897
898
23.3k
                    switch (fip->field_type)
899
23.3k
                    {
900
3.15k
                        case TIFF_BYTE:
901
3.15k
                        case TIFF_UNDEFINED:
902
3.15k
                        {
903
3.15k
                            uint8_t v2 = (uint8_t)va_arg(ap, int);
904
3.15k
                            _TIFFmemcpy(val, &v2, tv_size);
905
3.15k
                        }
906
3.15k
                        break;
907
0
                        case TIFF_SBYTE:
908
0
                        {
909
0
                            int8_t v2 = (int8_t)va_arg(ap, int);
910
0
                            _TIFFmemcpy(val, &v2, tv_size);
911
0
                        }
912
0
                        break;
913
3.63k
                        case TIFF_SHORT:
914
3.63k
                        {
915
3.63k
                            uint16_t v2 = (uint16_t)va_arg(ap, int);
916
3.63k
                            _TIFFmemcpy(val, &v2, tv_size);
917
3.63k
                        }
918
3.63k
                        break;
919
0
                        case TIFF_SSHORT:
920
0
                        {
921
0
                            int16_t v2 = (int16_t)va_arg(ap, int);
922
0
                            _TIFFmemcpy(val, &v2, tv_size);
923
0
                        }
924
0
                        break;
925
4.62k
                        case TIFF_LONG:
926
4.62k
                        case TIFF_IFD:
927
4.62k
                        {
928
4.62k
                            uint32_t v2 = va_arg(ap, uint32_t);
929
4.62k
                            _TIFFmemcpy(val, &v2, tv_size);
930
4.62k
                        }
931
4.62k
                        break;
932
0
                        case TIFF_SLONG:
933
0
                        {
934
0
                            int32_t v2 = va_arg(ap, int32_t);
935
0
                            _TIFFmemcpy(val, &v2, tv_size);
936
0
                        }
937
0
                        break;
938
0
                        case TIFF_LONG8:
939
2.11k
                        case TIFF_IFD8:
940
2.11k
                        {
941
2.11k
                            uint64_t v2 = va_arg(ap, uint64_t);
942
2.11k
                            _TIFFmemcpy(val, &v2, tv_size);
943
                            /* Test here for too big values for ClassicTIFF and
944
                             * delete custom field from custom list */
945
2.11k
                            if (!(tif->tif_flags & TIFF_BIGTIFF) &&
946
2.11k
                                (v2 > 0xffffffffu))
947
832
                            {
948
832
                                TIFFErrorExtR(
949
832
                                    tif, module,
950
832
                                    "%s: Bad LONG8 or IFD8 value %" PRIu64
951
832
                                    " for \"%s\" tag %d in ClassicTIFF. Tag "
952
832
                                    "won't be written to file",
953
832
                                    tif->tif_name, v2, fip->field_name, tag);
954
832
                                goto badvalueifd8long8;
955
832
                            }
956
2.11k
                        }
957
1.28k
                        break;
958
1.28k
                        case TIFF_SLONG8:
959
0
                        {
960
0
                            int64_t v2 = va_arg(ap, int64_t);
961
0
                            _TIFFmemcpy(val, &v2, tv_size);
962
                            /* Test here for too big values for ClassicTIFF and
963
                             * delete custom field from custom list */
964
0
                            if (!(tif->tif_flags & TIFF_BIGTIFF) &&
965
0
                                ((v2 > 2147483647) || (v2 < (-2147483647 - 1))))
966
0
                            {
967
0
                                TIFFErrorExtR(
968
0
                                    tif, module,
969
0
                                    "%s: Bad SLONG8 value %" PRIi64
970
0
                                    " for \"%s\" tag %d in ClassicTIFF. Tag "
971
0
                                    "won't be written to file",
972
0
                                    tif->tif_name, v2, fip->field_name, tag);
973
0
                                goto badvalueifd8long8;
974
0
                            }
975
0
                        }
976
0
                        break;
977
4.52k
                        case TIFF_RATIONAL:
978
6.19k
                        case TIFF_SRATIONAL:
979
                            /*-- Rational2Double: For Rationals tv_size is set
980
                             * above to 4 or 8 according to
981
                             * fip->set_get_field_type!
982
                             */
983
6.19k
                            {
984
6.19k
                                if (tv_size == 8)
985
0
                                {
986
0
                                    double v2 = va_arg(ap, double);
987
0
                                    _TIFFmemcpy(val, &v2, tv_size);
988
0
                                }
989
6.19k
                                else
990
6.19k
                                {
991
                                    /*-- default should be tv_size == 4 */
992
6.19k
                                    float v3 = (float)va_arg(ap, double);
993
6.19k
                                    _TIFFmemcpy(val, &v3, tv_size);
994
                                    /*-- ToDo: After Testing, this should be
995
                                     * removed and tv_size==4 should be set as
996
                                     * default. */
997
6.19k
                                    if (tv_size != 4)
998
0
                                    {
999
0
                                        TIFFErrorExtR(tif, module,
1000
0
                                                      "Rational2Double: "
1001
0
                                                      ".set_get_field_type "
1002
0
                                                      "in not 4 but %d",
1003
0
                                                      tv_size);
1004
0
                                    }
1005
6.19k
                                }
1006
6.19k
                            }
1007
6.19k
                            break;
1008
566
                        case TIFF_FLOAT:
1009
566
                        {
1010
566
                            float v2 =
1011
566
                                _TIFFClampDoubleToFloat(va_arg(ap, double));
1012
566
                            _TIFFmemcpy(val, &v2, tv_size);
1013
566
                        }
1014
566
                        break;
1015
3.08k
                        case TIFF_DOUBLE:
1016
3.08k
                        {
1017
3.08k
                            double v2 = va_arg(ap, double);
1018
3.08k
                            _TIFFmemcpy(val, &v2, tv_size);
1019
3.08k
                        }
1020
3.08k
                        break;
1021
0
                        default:
1022
0
                            _TIFFmemset(val, 0, tv_size);
1023
0
                            status = 0;
1024
0
                            break;
1025
23.3k
                    }
1026
23.3k
                }
1027
752k
            }
1028
1.11M
        }
1029
21.0M
    }
1030
20.9M
    if (status)
1031
20.9M
    {
1032
20.9M
        const TIFFField *fip2 = TIFFFieldWithTag(tif, tag);
1033
20.9M
        if (fip2)
1034
20.9M
            TIFFSetFieldBit(tif, fip2->field_bit);
1035
20.9M
        tif->tif_flags |= TIFF_DIRTYDIRECT;
1036
20.9M
    }
1037
1038
20.9M
end:
1039
20.9M
    va_end(ap);
1040
20.9M
    return (status);
1041
7.03k
badvalue:
1042
7.03k
{
1043
7.03k
    const TIFFField *fip2 = TIFFFieldWithTag(tif, tag);
1044
7.03k
    TIFFErrorExtR(tif, module, "%s: Bad value %" PRIu32 " for \"%s\" tag",
1045
7.03k
                  tif->tif_name, v, fip2 ? fip2->field_name : "Unknown");
1046
7.03k
    va_end(ap);
1047
7.03k
}
1048
7.03k
    return (0);
1049
56
badvalue32:
1050
56
{
1051
56
    const TIFFField *fip2 = TIFFFieldWithTag(tif, tag);
1052
56
    TIFFErrorExtR(tif, module, "%s: Bad value %" PRIu32 " for \"%s\" tag",
1053
56
                  tif->tif_name, v32, fip2 ? fip2->field_name : "Unknown");
1054
56
    va_end(ap);
1055
56
}
1056
56
    return (0);
1057
2.07k
badvaluedouble:
1058
2.07k
{
1059
2.07k
    const TIFFField *fip2 = TIFFFieldWithTag(tif, tag);
1060
2.07k
    TIFFErrorExtR(tif, module, "%s: Bad value %f for \"%s\" tag", tif->tif_name,
1061
2.07k
                  dblval, fip2 ? fip2->field_name : "Unknown");
1062
2.07k
    va_end(ap);
1063
2.07k
}
1064
2.07k
    return (0);
1065
10.9k
badvalueifd8long8:
1066
10.9k
{
1067
    /* Error message issued already above. */
1068
10.9k
    TIFFTagValue *tv2 = NULL;
1069
10.9k
    int iCustom2, iC2;
1070
    /* Find the existing entry for this custom value. */
1071
28.1k
    for (iCustom2 = 0; iCustom2 < td->td_customValueCount; iCustom2++)
1072
28.1k
    {
1073
28.1k
        if (td->td_customValues[iCustom2].info->field_tag == tag)
1074
10.9k
        {
1075
10.9k
            tv2 = td->td_customValues + (iCustom2);
1076
10.9k
            break;
1077
10.9k
        }
1078
28.1k
    }
1079
10.9k
    if (tv2 != NULL)
1080
10.9k
    {
1081
        /* Remove custom field from custom list */
1082
10.9k
        if (tv2->value != NULL)
1083
10.9k
        {
1084
10.9k
            _TIFFfreeExt(tif, tv2->value);
1085
10.9k
            tv2->value = NULL;
1086
10.9k
        }
1087
        /* Shorten list and close gap in customValues list.
1088
         * Re-allocation of td_customValues not necessary here. */
1089
10.9k
        td->td_customValueCount--;
1090
10.9k
        for (iC2 = iCustom2; iC2 < td->td_customValueCount; iC2++)
1091
0
        {
1092
0
            td->td_customValues[iC2] = td->td_customValues[iC2 + 1];
1093
0
        }
1094
10.9k
    }
1095
0
    else
1096
0
    {
1097
0
        assert(0);
1098
0
    }
1099
10.9k
    va_end(ap);
1100
10.9k
}
1101
0
    return (0);
1102
10.9k
} /*-- _TIFFVSetField() --*/
1103
1104
/*
1105
 * Return 1/0 according to whether or not
1106
 * it is permissible to set the tag's value.
1107
 * Note that we allow ImageLength to be changed
1108
 * so that we can append and extend to images.
1109
 * Any other tag may not be altered once writing
1110
 * has commenced, unless its value has no effect
1111
 * on the format of the data that is written.
1112
 */
1113
static int OkToChangeTag(TIFF *tif, uint32_t tag)
1114
23.4M
{
1115
23.4M
    const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
1116
23.4M
    if (!fip)
1117
0
    { /* unknown tag */
1118
0
        TIFFErrorExtR(tif, "TIFFSetField", "%s: Unknown %stag %" PRIu32,
1119
0
                      tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "", tag);
1120
0
        return (0);
1121
0
    }
1122
23.4M
    if (tag != TIFFTAG_IMAGELENGTH && (tif->tif_flags & TIFF_BEENWRITING) &&
1123
23.4M
        !fip->field_oktochange)
1124
0
    {
1125
        /*
1126
         * Consult info table to see if tag can be changed
1127
         * after we've started writing.  We only allow changes
1128
         * to those tags that don't/shouldn't affect the
1129
         * compression and/or format of the data.
1130
         */
1131
0
        TIFFErrorExtR(tif, "TIFFSetField",
1132
0
                      "%s: Cannot modify tag \"%s\" while writing",
1133
0
                      tif->tif_name, fip->field_name);
1134
0
        return (0);
1135
0
    }
1136
23.4M
    return (1);
1137
23.4M
}
1138
1139
/*
1140
 * Record the value of a field in the
1141
 * internal directory structure.  The
1142
 * field will be written to the file
1143
 * when/if the directory structure is
1144
 * updated.
1145
 */
1146
int TIFFSetField(TIFF *tif, uint32_t tag, ...)
1147
23.4M
{
1148
23.4M
    va_list ap;
1149
23.4M
    int status;
1150
1151
23.4M
    va_start(ap, tag);
1152
23.4M
    status = TIFFVSetField(tif, tag, ap);
1153
23.4M
    va_end(ap);
1154
23.4M
    return (status);
1155
23.4M
}
1156
1157
/*
1158
 * Clear the contents of the field in the internal structure.
1159
 */
1160
int TIFFUnsetField(TIFF *tif, uint32_t tag)
1161
0
{
1162
0
    const TIFFField *fip = TIFFFieldWithTag(tif, tag);
1163
0
    TIFFDirectory *td = &tif->tif_dir;
1164
1165
0
    if (!fip)
1166
0
        return 0;
1167
1168
0
    if (fip->field_bit != FIELD_CUSTOM)
1169
0
        TIFFClrFieldBit(tif, fip->field_bit);
1170
0
    else
1171
0
    {
1172
0
        TIFFTagValue *tv = NULL;
1173
0
        int i;
1174
1175
0
        for (i = 0; i < td->td_customValueCount; i++)
1176
0
        {
1177
1178
0
            tv = td->td_customValues + i;
1179
0
            if (tv->info->field_tag == tag)
1180
0
                break;
1181
0
        }
1182
1183
0
        if (i < td->td_customValueCount)
1184
0
        {
1185
0
            _TIFFfreeExt(tif, tv->value);
1186
0
            for (; i < td->td_customValueCount - 1; i++)
1187
0
            {
1188
0
                td->td_customValues[i] = td->td_customValues[i + 1];
1189
0
            }
1190
0
            td->td_customValueCount--;
1191
0
        }
1192
0
    }
1193
1194
0
    tif->tif_flags |= TIFF_DIRTYDIRECT;
1195
1196
0
    return (1);
1197
0
}
1198
1199
/*
1200
 * Like TIFFSetField, but taking a varargs
1201
 * parameter list.  This routine is useful
1202
 * for building higher-level interfaces on
1203
 * top of the library.
1204
 */
1205
int TIFFVSetField(TIFF *tif, uint32_t tag, va_list ap)
1206
23.4M
{
1207
23.4M
    return OkToChangeTag(tif, tag)
1208
23.4M
               ? (*tif->tif_tagmethods.vsetfield)(tif, tag, ap)
1209
23.4M
               : 0;
1210
23.4M
}
1211
1212
static int _TIFFVGetField(TIFF *tif, uint32_t tag, va_list ap)
1213
12.1M
{
1214
12.1M
    TIFFDirectory *td = &tif->tif_dir;
1215
12.1M
    int ret_val = 1;
1216
12.1M
    uint32_t standard_tag = tag;
1217
12.1M
    const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
1218
12.1M
    if (fip == NULL) /* cannot happen since TIFFGetField() already checks it */
1219
0
        return 0;
1220
1221
    /*
1222
     * We want to force the custom code to be used for custom
1223
     * fields even if the tag happens to match a well known
1224
     * one - important for reinterpreted handling of standard
1225
     * tag values in custom directories (i.e. EXIF)
1226
     */
1227
12.1M
    if (fip->field_bit == FIELD_CUSTOM)
1228
3.12M
    {
1229
3.12M
        standard_tag = 0;
1230
3.12M
    }
1231
1232
12.1M
    switch (standard_tag)
1233
12.1M
    {
1234
122k
        case TIFFTAG_SUBFILETYPE:
1235
122k
            *va_arg(ap, uint32_t *) = td->td_subfiletype;
1236
122k
            break;
1237
543k
        case TIFFTAG_IMAGEWIDTH:
1238
543k
            *va_arg(ap, uint32_t *) = td->td_imagewidth;
1239
543k
            break;
1240
543k
        case TIFFTAG_IMAGELENGTH:
1241
543k
            *va_arg(ap, uint32_t *) = td->td_imagelength;
1242
543k
            break;
1243
511k
        case TIFFTAG_BITSPERSAMPLE:
1244
511k
            *va_arg(ap, uint16_t *) = td->td_bitspersample;
1245
511k
            break;
1246
456k
        case TIFFTAG_COMPRESSION:
1247
456k
            *va_arg(ap, uint16_t *) = td->td_compression;
1248
456k
            break;
1249
694k
        case TIFFTAG_PHOTOMETRIC:
1250
694k
            *va_arg(ap, uint16_t *) = td->td_photometric;
1251
694k
            break;
1252
0
        case TIFFTAG_THRESHHOLDING:
1253
0
            *va_arg(ap, uint16_t *) = td->td_threshholding;
1254
0
            break;
1255
0
        case TIFFTAG_FILLORDER:
1256
0
            *va_arg(ap, uint16_t *) = td->td_fillorder;
1257
0
            break;
1258
14.0k
        case TIFFTAG_ORIENTATION:
1259
14.0k
            *va_arg(ap, uint16_t *) = td->td_orientation;
1260
14.0k
            break;
1261
554k
        case TIFFTAG_SAMPLESPERPIXEL:
1262
554k
            *va_arg(ap, uint16_t *) = td->td_samplesperpixel;
1263
554k
            break;
1264
199k
        case TIFFTAG_ROWSPERSTRIP:
1265
199k
            *va_arg(ap, uint32_t *) = td->td_rowsperstrip;
1266
199k
            break;
1267
6.07k
        case TIFFTAG_MINSAMPLEVALUE:
1268
6.07k
            *va_arg(ap, uint16_t *) = td->td_minsamplevalue;
1269
6.07k
            break;
1270
3.77k
        case TIFFTAG_MAXSAMPLEVALUE:
1271
3.77k
            *va_arg(ap, uint16_t *) = td->td_maxsamplevalue;
1272
3.77k
            break;
1273
0
        case TIFFTAG_SMINSAMPLEVALUE:
1274
0
            if (tif->tif_flags & TIFF_PERSAMPLE)
1275
0
                *va_arg(ap, double **) = td->td_sminsamplevalue;
1276
0
            else
1277
0
            {
1278
                /* libtiff historically treats this as a single value. */
1279
0
                uint16_t i;
1280
0
                double v = td->td_sminsamplevalue[0];
1281
0
                for (i = 1; i < td->td_samplesperpixel; ++i)
1282
0
                    if (td->td_sminsamplevalue[i] < v)
1283
0
                        v = td->td_sminsamplevalue[i];
1284
0
                *va_arg(ap, double *) = v;
1285
0
            }
1286
0
            break;
1287
0
        case TIFFTAG_SMAXSAMPLEVALUE:
1288
0
            if (tif->tif_flags & TIFF_PERSAMPLE)
1289
0
                *va_arg(ap, double **) = td->td_smaxsamplevalue;
1290
0
            else
1291
0
            {
1292
                /* libtiff historically treats this as a single value. */
1293
0
                uint16_t i;
1294
0
                double v = td->td_smaxsamplevalue[0];
1295
0
                for (i = 1; i < td->td_samplesperpixel; ++i)
1296
0
                    if (td->td_smaxsamplevalue[i] > v)
1297
0
                        v = td->td_smaxsamplevalue[i];
1298
0
                *va_arg(ap, double *) = v;
1299
0
            }
1300
0
            break;
1301
7.08k
        case TIFFTAG_XRESOLUTION:
1302
7.08k
            *va_arg(ap, float *) = td->td_xresolution;
1303
7.08k
            break;
1304
7.08k
        case TIFFTAG_YRESOLUTION:
1305
7.08k
            *va_arg(ap, float *) = td->td_yresolution;
1306
7.08k
            break;
1307
333k
        case TIFFTAG_PLANARCONFIG:
1308
333k
            *va_arg(ap, uint16_t *) = td->td_planarconfig;
1309
333k
            break;
1310
0
        case TIFFTAG_XPOSITION:
1311
0
            *va_arg(ap, float *) = td->td_xposition;
1312
0
            break;
1313
0
        case TIFFTAG_YPOSITION:
1314
0
            *va_arg(ap, float *) = td->td_yposition;
1315
0
            break;
1316
2.84k
        case TIFFTAG_RESOLUTIONUNIT:
1317
2.84k
            *va_arg(ap, uint16_t *) = td->td_resolutionunit;
1318
2.84k
            break;
1319
0
        case TIFFTAG_PAGENUMBER:
1320
0
            *va_arg(ap, uint16_t *) = td->td_pagenumber[0];
1321
0
            *va_arg(ap, uint16_t *) = td->td_pagenumber[1];
1322
0
            break;
1323
0
        case TIFFTAG_HALFTONEHINTS:
1324
0
            *va_arg(ap, uint16_t *) = td->td_halftonehints[0];
1325
0
            *va_arg(ap, uint16_t *) = td->td_halftonehints[1];
1326
0
            break;
1327
2.58k
        case TIFFTAG_COLORMAP:
1328
2.58k
            *va_arg(ap, const uint16_t **) = td->td_colormap[0];
1329
2.58k
            *va_arg(ap, const uint16_t **) = td->td_colormap[1];
1330
2.58k
            *va_arg(ap, const uint16_t **) = td->td_colormap[2];
1331
2.58k
            break;
1332
24.8k
        case TIFFTAG_STRIPOFFSETS:
1333
24.8k
        case TIFFTAG_TILEOFFSETS:
1334
24.8k
            _TIFFFillStriles(tif);
1335
24.8k
            *va_arg(ap, const uint64_t **) = td->td_stripoffset_p;
1336
24.8k
            if (td->td_stripoffset_p == NULL)
1337
0
                ret_val = 0;
1338
24.8k
            break;
1339
52.5k
        case TIFFTAG_STRIPBYTECOUNTS:
1340
52.6k
        case TIFFTAG_TILEBYTECOUNTS:
1341
52.6k
            _TIFFFillStriles(tif);
1342
52.6k
            *va_arg(ap, const uint64_t **) = td->td_stripbytecount_p;
1343
52.6k
            if (td->td_stripbytecount_p == NULL)
1344
0
                ret_val = 0;
1345
52.6k
            break;
1346
0
        case TIFFTAG_MATTEING:
1347
0
            *va_arg(ap, uint16_t *) =
1348
0
                (td->td_extrasamples == 1 &&
1349
0
                 td->td_sampleinfo[0] == EXTRASAMPLE_ASSOCALPHA);
1350
0
            break;
1351
4.41M
        case TIFFTAG_EXTRASAMPLES:
1352
4.41M
            *va_arg(ap, uint16_t *) = td->td_extrasamples;
1353
4.41M
            *va_arg(ap, const uint16_t **) = td->td_sampleinfo;
1354
4.41M
            break;
1355
128k
        case TIFFTAG_TILEWIDTH:
1356
128k
            *va_arg(ap, uint32_t *) = td->td_tilewidth;
1357
128k
            break;
1358
128k
        case TIFFTAG_TILELENGTH:
1359
128k
            *va_arg(ap, uint32_t *) = td->td_tilelength;
1360
128k
            break;
1361
0
        case TIFFTAG_TILEDEPTH:
1362
0
            *va_arg(ap, uint32_t *) = td->td_tiledepth;
1363
0
            break;
1364
0
        case TIFFTAG_DATATYPE:
1365
0
            switch (td->td_sampleformat)
1366
0
            {
1367
0
                case SAMPLEFORMAT_UINT:
1368
0
                    *va_arg(ap, uint16_t *) = DATATYPE_UINT;
1369
0
                    break;
1370
0
                case SAMPLEFORMAT_INT:
1371
0
                    *va_arg(ap, uint16_t *) = DATATYPE_INT;
1372
0
                    break;
1373
0
                case SAMPLEFORMAT_IEEEFP:
1374
0
                    *va_arg(ap, uint16_t *) = DATATYPE_IEEEFP;
1375
0
                    break;
1376
0
                case SAMPLEFORMAT_VOID:
1377
0
                    *va_arg(ap, uint16_t *) = DATATYPE_VOID;
1378
0
                    break;
1379
0
            }
1380
0
            break;
1381
31.1k
        case TIFFTAG_SAMPLEFORMAT:
1382
31.1k
            *va_arg(ap, uint16_t *) = td->td_sampleformat;
1383
31.1k
            break;
1384
0
        case TIFFTAG_IMAGEDEPTH:
1385
0
            *va_arg(ap, uint32_t *) = td->td_imagedepth;
1386
0
            break;
1387
13.1k
        case TIFFTAG_SUBIFD:
1388
13.1k
            *va_arg(ap, uint16_t *) = td->td_nsubifd;
1389
13.1k
            *va_arg(ap, const uint64_t **) = td->td_subifd;
1390
13.1k
            break;
1391
0
        case TIFFTAG_YCBCRPOSITIONING:
1392
0
            *va_arg(ap, uint16_t *) = td->td_ycbcrpositioning;
1393
0
            break;
1394
168k
        case TIFFTAG_YCBCRSUBSAMPLING:
1395
168k
            *va_arg(ap, uint16_t *) = td->td_ycbcrsubsampling[0];
1396
168k
            *va_arg(ap, uint16_t *) = td->td_ycbcrsubsampling[1];
1397
168k
            break;
1398
0
        case TIFFTAG_TRANSFERFUNCTION:
1399
0
            *va_arg(ap, const uint16_t **) = td->td_transferfunction[0];
1400
0
            if (td->td_samplesperpixel - td->td_extrasamples > 1)
1401
0
            {
1402
0
                *va_arg(ap, const uint16_t **) = td->td_transferfunction[1];
1403
0
                *va_arg(ap, const uint16_t **) = td->td_transferfunction[2];
1404
0
            }
1405
0
            else
1406
0
            {
1407
0
                *va_arg(ap, const uint16_t **) = NULL;
1408
0
                *va_arg(ap, const uint16_t **) = NULL;
1409
0
            }
1410
0
            break;
1411
30.5k
        case TIFFTAG_REFERENCEBLACKWHITE:
1412
30.5k
            *va_arg(ap, const float **) = td->td_refblackwhite;
1413
30.5k
            break;
1414
0
        case TIFFTAG_INKNAMES:
1415
0
            *va_arg(ap, const char **) = td->td_inknames;
1416
0
            break;
1417
0
        case TIFFTAG_NUMBEROFINKS:
1418
0
            *va_arg(ap, uint16_t *) = td->td_numberofinks;
1419
0
            break;
1420
3.12M
        default:
1421
3.12M
        {
1422
3.12M
            int i;
1423
1424
            /*
1425
             * This can happen if multiple images are open
1426
             * with different codecs which have private
1427
             * tags.  The global tag information table may
1428
             * then have tags that are valid for one file
1429
             * but not the other. If the client tries to
1430
             * get a tag that is not valid for the image's
1431
             * codec then we'll arrive here.
1432
             */
1433
3.12M
            if (fip->field_bit != FIELD_CUSTOM)
1434
0
            {
1435
0
                TIFFErrorExtR(tif, "_TIFFVGetField",
1436
0
                              "%s: Invalid %stag \"%s\" "
1437
0
                              "(not supported by codec)",
1438
0
                              tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
1439
0
                              fip->field_name);
1440
0
                ret_val = 0;
1441
0
                break;
1442
0
            }
1443
1444
            /*
1445
             * Do we have a custom value?
1446
             */
1447
3.12M
            ret_val = 0;
1448
10.2M
            for (i = 0; i < td->td_customValueCount; i++)
1449
7.45M
            {
1450
7.45M
                TIFFTagValue *tv = td->td_customValues + i;
1451
1452
7.45M
                if (tv->info->field_tag != tag)
1453
7.15M
                    continue;
1454
1455
306k
                if (fip->field_passcount)
1456
156k
                {
1457
156k
                    if (fip->field_readcount == TIFF_VARIABLE2)
1458
7.27k
                        *va_arg(ap, uint32_t *) = (uint32_t)tv->count;
1459
149k
                    else /* Assume TIFF_VARIABLE */
1460
149k
                        *va_arg(ap, uint16_t *) = (uint16_t)tv->count;
1461
156k
                    *va_arg(ap, const void **) = tv->value;
1462
156k
                    ret_val = 1;
1463
156k
                }
1464
150k
                else if (fip->field_tag == TIFFTAG_DOTRANGE &&
1465
150k
                         strcmp(fip->field_name, "DotRange") == 0)
1466
0
                {
1467
                    /* TODO: This is an evil exception and should not have been
1468
                       handled this way ... likely best if we move it into
1469
                       the directory structure with an explicit field in
1470
                       libtiff 4.1 and assign it a FIELD_ value */
1471
0
                    *va_arg(ap, uint16_t *) = ((uint16_t *)tv->value)[0];
1472
0
                    *va_arg(ap, uint16_t *) = ((uint16_t *)tv->value)[1];
1473
0
                    ret_val = 1;
1474
0
                }
1475
150k
                else
1476
150k
                {
1477
150k
                    if (fip->field_type == TIFF_ASCII ||
1478
150k
                        fip->field_readcount == TIFF_VARIABLE ||
1479
150k
                        fip->field_readcount == TIFF_VARIABLE2 ||
1480
150k
                        fip->field_readcount == TIFF_SPP || tv->count > 1)
1481
149k
                    {
1482
149k
                        *va_arg(ap, void **) = tv->value;
1483
149k
                        ret_val = 1;
1484
149k
                    }
1485
710
                    else
1486
710
                    {
1487
710
                        char *val = (char *)tv->value;
1488
710
                        assert(tv->count == 1);
1489
710
                        switch (fip->field_type)
1490
710
                        {
1491
0
                            case TIFF_BYTE:
1492
0
                            case TIFF_UNDEFINED:
1493
0
                                *va_arg(ap, uint8_t *) = *(uint8_t *)val;
1494
0
                                ret_val = 1;
1495
0
                                break;
1496
0
                            case TIFF_SBYTE:
1497
0
                                *va_arg(ap, int8_t *) = *(int8_t *)val;
1498
0
                                ret_val = 1;
1499
0
                                break;
1500
710
                            case TIFF_SHORT:
1501
710
                                *va_arg(ap, uint16_t *) = *(uint16_t *)val;
1502
710
                                ret_val = 1;
1503
710
                                break;
1504
0
                            case TIFF_SSHORT:
1505
0
                                *va_arg(ap, int16_t *) = *(int16_t *)val;
1506
0
                                ret_val = 1;
1507
0
                                break;
1508
0
                            case TIFF_LONG:
1509
0
                            case TIFF_IFD:
1510
0
                                *va_arg(ap, uint32_t *) = *(uint32_t *)val;
1511
0
                                ret_val = 1;
1512
0
                                break;
1513
0
                            case TIFF_SLONG:
1514
0
                                *va_arg(ap, int32_t *) = *(int32_t *)val;
1515
0
                                ret_val = 1;
1516
0
                                break;
1517
0
                            case TIFF_LONG8:
1518
0
                            case TIFF_IFD8:
1519
0
                                *va_arg(ap, uint64_t *) = *(uint64_t *)val;
1520
0
                                ret_val = 1;
1521
0
                                break;
1522
0
                            case TIFF_SLONG8:
1523
0
                                *va_arg(ap, int64_t *) = *(int64_t *)val;
1524
0
                                ret_val = 1;
1525
0
                                break;
1526
0
                            case TIFF_RATIONAL:
1527
0
                            case TIFF_SRATIONAL:
1528
0
                            {
1529
                                /*-- Rational2Double: For Rationals evaluate
1530
                                 * "set_get_field_type" to determine internal
1531
                                 * storage size and return value size. */
1532
0
                                int tv_size = TIFFFieldSetGetSize(fip);
1533
0
                                if (tv_size == 8)
1534
0
                                {
1535
0
                                    *va_arg(ap, double *) = *(double *)val;
1536
0
                                    ret_val = 1;
1537
0
                                }
1538
0
                                else
1539
0
                                {
1540
                                    /*-- default should be tv_size == 4  */
1541
0
                                    *va_arg(ap, float *) = *(float *)val;
1542
0
                                    ret_val = 1;
1543
                                    /*-- ToDo: After Testing, this should be
1544
                                     * removed and tv_size==4 should be set as
1545
                                     * default. */
1546
0
                                    if (tv_size != 4)
1547
0
                                    {
1548
0
                                        TIFFErrorExtR(tif, "_TIFFVGetField",
1549
0
                                                      "Rational2Double: "
1550
0
                                                      ".set_get_field_type "
1551
0
                                                      "in not 4 but %d",
1552
0
                                                      tv_size);
1553
0
                                    }
1554
0
                                }
1555
0
                            }
1556
0
                            break;
1557
0
                            case TIFF_FLOAT:
1558
0
                                *va_arg(ap, float *) = *(float *)val;
1559
0
                                ret_val = 1;
1560
0
                                break;
1561
0
                            case TIFF_DOUBLE:
1562
0
                                *va_arg(ap, double *) = *(double *)val;
1563
0
                                ret_val = 1;
1564
0
                                break;
1565
0
                            default:
1566
0
                                ret_val = 0;
1567
0
                                break;
1568
710
                        }
1569
710
                    }
1570
150k
                }
1571
306k
                break;
1572
306k
            }
1573
3.12M
        }
1574
12.1M
    }
1575
12.1M
    return (ret_val);
1576
12.1M
}
1577
1578
/*
1579
 * Return the value of a field in the
1580
 * internal directory structure.
1581
 */
1582
int TIFFGetField(TIFF *tif, uint32_t tag, ...)
1583
90.1M
{
1584
90.1M
    int status;
1585
90.1M
    va_list ap;
1586
1587
90.1M
    va_start(ap, tag);
1588
90.1M
    status = TIFFVGetField(tif, tag, ap);
1589
90.1M
    va_end(ap);
1590
90.1M
    return (status);
1591
90.1M
}
1592
1593
/*
1594
 * Like TIFFGetField, but taking a varargs
1595
 * parameter list.  This routine is useful
1596
 * for building higher-level interfaces on
1597
 * top of the library.
1598
 */
1599
int TIFFVGetField(TIFF *tif, uint32_t tag, va_list ap)
1600
91.6M
{
1601
91.6M
    const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
1602
91.6M
    return (fip && (isPseudoTag(tag) || TIFFFieldSet(tif, fip->field_bit))
1603
91.6M
                ? (*tif->tif_tagmethods.vgetfield)(tif, tag, ap)
1604
91.6M
                : 0);
1605
91.6M
}
1606
1607
#define CleanupField(member)                                                   \
1608
58.9M
    {                                                                          \
1609
58.9M
        if (td->member)                                                        \
1610
58.9M
        {                                                                      \
1611
4.33M
            _TIFFfreeExt(tif, td->member);                                     \
1612
4.33M
            td->member = 0;                                                    \
1613
4.33M
        }                                                                      \
1614
58.9M
    }
1615
1616
/*
1617
 * Release storage associated with a directory.
1618
 */
1619
void TIFFFreeDirectory(TIFF *tif)
1620
3.92M
{
1621
3.92M
    TIFFDirectory *td = &tif->tif_dir;
1622
3.92M
    int i;
1623
1624
3.92M
    (*tif->tif_cleanup)(tif);
1625
3.92M
    _TIFFmemset(td->td_fieldsset, 0, sizeof(td->td_fieldsset));
1626
3.92M
    CleanupField(td_sminsamplevalue);
1627
3.92M
    CleanupField(td_smaxsamplevalue);
1628
3.92M
    CleanupField(td_colormap[0]);
1629
3.92M
    CleanupField(td_colormap[1]);
1630
3.92M
    CleanupField(td_colormap[2]);
1631
3.92M
    CleanupField(td_sampleinfo);
1632
3.92M
    CleanupField(td_subifd);
1633
3.92M
    CleanupField(td_inknames);
1634
3.92M
    CleanupField(td_refblackwhite);
1635
3.92M
    CleanupField(td_transferfunction[0]);
1636
3.92M
    CleanupField(td_transferfunction[1]);
1637
3.92M
    CleanupField(td_transferfunction[2]);
1638
3.92M
    CleanupField(td_stripoffset_p);
1639
3.92M
    CleanupField(td_stripbytecount_p);
1640
3.92M
    td->td_stripoffsetbyteallocsize = 0;
1641
3.92M
    TIFFClrFieldBit(tif, FIELD_YCBCRSUBSAMPLING);
1642
3.92M
    TIFFClrFieldBit(tif, FIELD_YCBCRPOSITIONING);
1643
1644
    /* Cleanup custom tag values */
1645
5.02M
    for (i = 0; i < td->td_customValueCount; i++)
1646
1.09M
    {
1647
1.09M
        if (td->td_customValues[i].value)
1648
955k
            _TIFFfreeExt(tif, td->td_customValues[i].value);
1649
1.09M
    }
1650
1651
3.92M
    td->td_customValueCount = 0;
1652
3.92M
    CleanupField(td_customValues);
1653
1654
3.92M
    _TIFFmemset(&(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry));
1655
3.92M
    _TIFFmemset(&(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry));
1656
1657
    /* Reset some internal parameters for IFD data size checking. */
1658
3.92M
    tif->tif_dir.td_dirdatasize_read = 0;
1659
3.92M
    tif->tif_dir.td_dirdatasize_write = 0;
1660
3.92M
    if (tif->tif_dir.td_dirdatasize_offsets != NULL)
1661
1.28M
    {
1662
1.28M
        _TIFFfreeExt(tif, tif->tif_dir.td_dirdatasize_offsets);
1663
1.28M
        tif->tif_dir.td_dirdatasize_offsets = NULL;
1664
1.28M
        tif->tif_dir.td_dirdatasize_Noffsets = 0;
1665
1.28M
    }
1666
3.92M
    tif->tif_dir.td_iswrittentofile = FALSE;
1667
3.92M
}
1668
#undef CleanupField
1669
1670
/*
1671
 * Client Tag extension support (from Niles Ritter).
1672
 */
1673
static TIFFExtendProc _TIFFextender = (TIFFExtendProc)NULL;
1674
1675
TIFFExtendProc TIFFSetTagExtender(TIFFExtendProc extender)
1676
20
{
1677
20
    TIFFExtendProc prev = _TIFFextender;
1678
20
    _TIFFextender = extender;
1679
20
    return (prev);
1680
20
}
1681
1682
/*
1683
 * Setup for a new directory.  Should we automatically call
1684
 * TIFFWriteDirectory() if the current one is dirty?
1685
 *
1686
 * The newly created directory will not exist on the file till
1687
 * TIFFWriteDirectory(), TIFFFlush() or TIFFClose() is called.
1688
 */
1689
int TIFFCreateDirectory(TIFF *tif)
1690
859k
{
1691
    /* Free previously allocated memory and setup default values. */
1692
859k
    TIFFFreeDirectory(tif);
1693
859k
    TIFFDefaultDirectory(tif);
1694
859k
    tif->tif_diroff = 0;
1695
859k
    tif->tif_nextdiroff = 0;
1696
859k
    tif->tif_curoff = 0;
1697
859k
    tif->tif_row = (uint32_t)-1;
1698
859k
    tif->tif_curstrip = (uint32_t)-1;
1699
859k
    tif->tif_dir.td_iswrittentofile = FALSE;
1700
1701
859k
    return 0;
1702
859k
}
1703
1704
int TIFFCreateCustomDirectory(TIFF *tif, const TIFFFieldArray *infoarray)
1705
0
{
1706
    /* Free previously allocated memory and setup default values. */
1707
0
    TIFFFreeDirectory(tif);
1708
0
    TIFFDefaultDirectory(tif);
1709
1710
    /*
1711
     * Reset the field definitions to match the application provided list.
1712
     * Hopefully TIFFDefaultDirectory() won't have done anything irreversible
1713
     * based on it's assumption this is an image directory.
1714
     */
1715
0
    _TIFFSetupFields(tif, infoarray);
1716
1717
0
    tif->tif_diroff = 0;
1718
0
    tif->tif_nextdiroff = 0;
1719
0
    tif->tif_curoff = 0;
1720
0
    tif->tif_row = (uint32_t)-1;
1721
0
    tif->tif_curstrip = (uint32_t)-1;
1722
    /* invalidate directory index */
1723
0
    tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
1724
    /* invalidate IFD loop lists */
1725
0
    _TIFFCleanupIFDOffsetAndNumberMaps(tif);
1726
    /* To be able to return from SubIFD or custom-IFD to main-IFD */
1727
0
    tif->tif_setdirectory_force_absolute = TRUE;
1728
1729
0
    return 0;
1730
0
}
1731
1732
int TIFFCreateEXIFDirectory(TIFF *tif)
1733
0
{
1734
0
    const TIFFFieldArray *exifFieldArray;
1735
0
    exifFieldArray = _TIFFGetExifFields();
1736
0
    return TIFFCreateCustomDirectory(tif, exifFieldArray);
1737
0
}
1738
1739
/*
1740
 * Creates the EXIF GPS custom directory
1741
 */
1742
int TIFFCreateGPSDirectory(TIFF *tif)
1743
0
{
1744
0
    const TIFFFieldArray *gpsFieldArray;
1745
0
    gpsFieldArray = _TIFFGetGpsFields();
1746
0
    return TIFFCreateCustomDirectory(tif, gpsFieldArray);
1747
0
}
1748
1749
/*
1750
 * Setup a default directory structure.
1751
 */
1752
int TIFFDefaultDirectory(TIFF *tif)
1753
2.79M
{
1754
2.79M
    register TIFFDirectory *td = &tif->tif_dir;
1755
2.79M
    const TIFFFieldArray *tiffFieldArray;
1756
1757
2.79M
    tiffFieldArray = _TIFFGetFields();
1758
2.79M
    _TIFFSetupFields(tif, tiffFieldArray);
1759
1760
2.79M
    _TIFFmemset(td, 0, sizeof(*td));
1761
2.79M
    td->td_fillorder = FILLORDER_MSB2LSB;
1762
2.79M
    td->td_bitspersample = 1;
1763
2.79M
    td->td_threshholding = THRESHHOLD_BILEVEL;
1764
2.79M
    td->td_orientation = ORIENTATION_TOPLEFT;
1765
2.79M
    td->td_samplesperpixel = 1;
1766
2.79M
    td->td_rowsperstrip = (uint32_t)-1;
1767
2.79M
    td->td_tilewidth = 0;
1768
2.79M
    td->td_tilelength = 0;
1769
2.79M
    td->td_tiledepth = 1;
1770
#ifdef STRIPBYTECOUNTSORTED_UNUSED
1771
    td->td_stripbytecountsorted = 1; /* Our own arrays always sorted. */
1772
#endif
1773
2.79M
    td->td_resolutionunit = RESUNIT_INCH;
1774
2.79M
    td->td_sampleformat = SAMPLEFORMAT_UINT;
1775
2.79M
    td->td_imagedepth = 1;
1776
2.79M
    td->td_ycbcrsubsampling[0] = 2;
1777
2.79M
    td->td_ycbcrsubsampling[1] = 2;
1778
2.79M
    td->td_ycbcrpositioning = YCBCRPOSITION_CENTERED;
1779
2.79M
    tif->tif_postdecode = _TIFFNoPostDecode;
1780
2.79M
    tif->tif_foundfield = NULL;
1781
2.79M
    tif->tif_tagmethods.vsetfield = _TIFFVSetField;
1782
2.79M
    tif->tif_tagmethods.vgetfield = _TIFFVGetField;
1783
2.79M
    tif->tif_tagmethods.printdir = NULL;
1784
    /* additional default values */
1785
2.79M
    td->td_planarconfig = PLANARCONFIG_CONTIG;
1786
2.79M
    td->td_compression = COMPRESSION_NONE;
1787
2.79M
    td->td_subfiletype = 0;
1788
2.79M
    td->td_minsamplevalue = 0;
1789
    /* td_bitspersample=1 is always set in TIFFDefaultDirectory().
1790
     * Therefore, td_maxsamplevalue has to be re-calculated in
1791
     * TIFFGetFieldDefaulted(). */
1792
2.79M
    td->td_maxsamplevalue = 1; /* Default for td_bitspersample=1 */
1793
2.79M
    td->td_extrasamples = 0;
1794
2.79M
    td->td_sampleinfo = NULL;
1795
1796
    /*
1797
     *  Give client code a chance to install their own
1798
     *  tag extensions & methods, prior to compression overloads,
1799
     *  but do some prior cleanup first.
1800
     * (http://trac.osgeo.org/gdal/ticket/5054)
1801
     */
1802
2.79M
    if (tif->tif_nfieldscompat > 0)
1803
1.87M
    {
1804
1.87M
        uint32_t i;
1805
1806
5.63M
        for (i = 0; i < tif->tif_nfieldscompat; i++)
1807
3.75M
        {
1808
3.75M
            if (tif->tif_fieldscompat[i].allocated_size)
1809
3.75M
                _TIFFfreeExt(tif, tif->tif_fieldscompat[i].fields);
1810
3.75M
        }
1811
1.87M
        _TIFFfreeExt(tif, tif->tif_fieldscompat);
1812
1.87M
        tif->tif_nfieldscompat = 0;
1813
1.87M
        tif->tif_fieldscompat = NULL;
1814
1.87M
    }
1815
2.79M
    if (_TIFFextender)
1816
2.79M
        (*_TIFFextender)(tif);
1817
2.79M
    (void)TIFFSetField(tif, TIFFTAG_COMPRESSION, COMPRESSION_NONE);
1818
    /*
1819
     * NB: The directory is marked dirty as a result of setting
1820
     * up the default compression scheme.  However, this really
1821
     * isn't correct -- we want TIFF_DIRTYDIRECT to be set only
1822
     * if the user does something.  We could just do the setup
1823
     * by hand, but it seems better to use the normal mechanism
1824
     * (i.e. TIFFSetField).
1825
     */
1826
2.79M
    tif->tif_flags &= ~TIFF_DIRTYDIRECT;
1827
1828
    /*
1829
     * As per http://bugzilla.remotesensing.org/show_bug.cgi?id=19
1830
     * we clear the ISTILED flag when setting up a new directory.
1831
     * Should we also be clearing stuff like INSUBIFD?
1832
     */
1833
2.79M
    tif->tif_flags &= ~TIFF_ISTILED;
1834
1835
2.79M
    return (1);
1836
2.79M
}
1837
1838
static int TIFFAdvanceDirectory(TIFF *tif, uint64_t *nextdiroff, uint64_t *off,
1839
                                tdir_t *nextdirnum)
1840
355k
{
1841
355k
    static const char module[] = "TIFFAdvanceDirectory";
1842
1843
    /* Add this directory to the directory list, if not already in. */
1844
355k
    if (!_TIFFCheckDirNumberAndOffset(tif, *nextdirnum, *nextdiroff))
1845
0
    {
1846
0
        TIFFErrorExtR(tif, module,
1847
0
                      "Starting directory %u at offset 0x%" PRIx64 " (%" PRIu64
1848
0
                      ") might cause an IFD loop",
1849
0
                      *nextdirnum, *nextdiroff, *nextdiroff);
1850
0
        *nextdiroff = 0;
1851
0
        *nextdirnum = 0;
1852
0
        return (0);
1853
0
    }
1854
1855
355k
    if (isMapped(tif))
1856
126k
    {
1857
126k
        uint64_t poff = *nextdiroff;
1858
126k
        if (!(tif->tif_flags & TIFF_BIGTIFF))
1859
125k
        {
1860
125k
            tmsize_t poffa, poffb, poffc, poffd;
1861
125k
            uint16_t dircount;
1862
125k
            uint32_t nextdir32;
1863
125k
            poffa = (tmsize_t)poff;
1864
125k
            poffb = poffa + sizeof(uint16_t);
1865
125k
            if (((uint64_t)poffa != poff) || (poffb < poffa) ||
1866
125k
                (poffb < (tmsize_t)sizeof(uint16_t)) || (poffb > tif->tif_size))
1867
35.6k
            {
1868
35.6k
                TIFFErrorExtR(tif, module,
1869
35.6k
                              "%s:%d: %s: Error fetching directory count",
1870
35.6k
                              __FILE__, __LINE__, tif->tif_name);
1871
35.6k
                *nextdiroff = 0;
1872
35.6k
                return (0);
1873
35.6k
            }
1874
89.6k
            _TIFFmemcpy(&dircount, tif->tif_base + poffa, sizeof(uint16_t));
1875
89.6k
            if (tif->tif_flags & TIFF_SWAB)
1876
220
                TIFFSwabShort(&dircount);
1877
89.6k
            poffc = poffb + dircount * 12;
1878
89.6k
            poffd = poffc + sizeof(uint32_t);
1879
89.6k
            if ((poffc < poffb) || (poffc < dircount * 12) || (poffd < poffc) ||
1880
89.6k
                (poffd < (tmsize_t)sizeof(uint32_t)) || (poffd > tif->tif_size))
1881
10.4k
            {
1882
10.4k
                TIFFErrorExtR(tif, module, "Error fetching directory link");
1883
10.4k
                return (0);
1884
10.4k
            }
1885
79.2k
            if (off != NULL)
1886
0
                *off = (uint64_t)poffc;
1887
79.2k
            _TIFFmemcpy(&nextdir32, tif->tif_base + poffc, sizeof(uint32_t));
1888
79.2k
            if (tif->tif_flags & TIFF_SWAB)
1889
207
                TIFFSwabLong(&nextdir32);
1890
79.2k
            *nextdiroff = nextdir32;
1891
79.2k
        }
1892
696
        else
1893
696
        {
1894
696
            tmsize_t poffa, poffb, poffc, poffd;
1895
696
            uint64_t dircount64;
1896
696
            uint16_t dircount16;
1897
696
            if (poff > (uint64_t)TIFF_TMSIZE_T_MAX - sizeof(uint64_t))
1898
109
            {
1899
109
                TIFFErrorExtR(tif, module,
1900
109
                              "%s:%d: %s: Error fetching directory count",
1901
109
                              __FILE__, __LINE__, tif->tif_name);
1902
109
                return (0);
1903
109
            }
1904
587
            poffa = (tmsize_t)poff;
1905
587
            poffb = poffa + sizeof(uint64_t);
1906
587
            if (poffb > tif->tif_size)
1907
149
            {
1908
149
                TIFFErrorExtR(tif, module,
1909
149
                              "%s:%d: %s: Error fetching directory count",
1910
149
                              __FILE__, __LINE__, tif->tif_name);
1911
149
                return (0);
1912
149
            }
1913
438
            _TIFFmemcpy(&dircount64, tif->tif_base + poffa, sizeof(uint64_t));
1914
438
            if (tif->tif_flags & TIFF_SWAB)
1915
438
                TIFFSwabLong8(&dircount64);
1916
438
            if (dircount64 > 0xFFFF)
1917
60
            {
1918
60
                TIFFErrorExtR(tif, module,
1919
60
                              "Sanity check on directory count failed");
1920
60
                return (0);
1921
60
            }
1922
378
            dircount16 = (uint16_t)dircount64;
1923
378
            if (poffb > TIFF_TMSIZE_T_MAX - (tmsize_t)(dircount16 * 20) -
1924
378
                            (tmsize_t)sizeof(uint64_t))
1925
0
            {
1926
0
                TIFFErrorExtR(tif, module, "Error fetching directory link");
1927
0
                return (0);
1928
0
            }
1929
378
            poffc = poffb + dircount16 * 20;
1930
378
            poffd = poffc + sizeof(uint64_t);
1931
378
            if (poffd > tif->tif_size)
1932
34
            {
1933
34
                TIFFErrorExtR(tif, module, "Error fetching directory link");
1934
34
                return (0);
1935
34
            }
1936
344
            if (off != NULL)
1937
0
                *off = (uint64_t)poffc;
1938
344
            _TIFFmemcpy(nextdiroff, tif->tif_base + poffc, sizeof(uint64_t));
1939
344
            if (tif->tif_flags & TIFF_SWAB)
1940
344
                TIFFSwabLong8(nextdiroff);
1941
344
        }
1942
126k
    }
1943
229k
    else
1944
229k
    {
1945
229k
        if (!(tif->tif_flags & TIFF_BIGTIFF))
1946
228k
        {
1947
228k
            uint16_t dircount;
1948
228k
            uint32_t nextdir32;
1949
228k
            if (!SeekOK(tif, *nextdiroff) ||
1950
228k
                !ReadOK(tif, &dircount, sizeof(uint16_t)))
1951
69.3k
            {
1952
69.3k
                TIFFErrorExtR(tif, module,
1953
69.3k
                              "%s:%d: %s: Error fetching directory count",
1954
69.3k
                              __FILE__, __LINE__, tif->tif_name);
1955
69.3k
                return (0);
1956
69.3k
            }
1957
158k
            if (tif->tif_flags & TIFF_SWAB)
1958
543
                TIFFSwabShort(&dircount);
1959
158k
            if (off != NULL)
1960
0
                *off = TIFFSeekFile(tif, dircount * 12, SEEK_CUR);
1961
158k
            else
1962
158k
                (void)TIFFSeekFile(tif, dircount * 12, SEEK_CUR);
1963
158k
            if (!ReadOK(tif, &nextdir32, sizeof(uint32_t)))
1964
15.6k
            {
1965
15.6k
                TIFFErrorExtR(tif, module, "%s: Error fetching directory link",
1966
15.6k
                              tif->tif_name);
1967
15.6k
                return (0);
1968
15.6k
            }
1969
143k
            if (tif->tif_flags & TIFF_SWAB)
1970
467
                TIFFSwabLong(&nextdir32);
1971
143k
            *nextdiroff = nextdir32;
1972
143k
        }
1973
1.04k
        else
1974
1.04k
        {
1975
1.04k
            uint64_t dircount64;
1976
1.04k
            uint16_t dircount16;
1977
1.04k
            if (!SeekOK(tif, *nextdiroff) ||
1978
1.04k
                !ReadOK(tif, &dircount64, sizeof(uint64_t)))
1979
331
            {
1980
331
                TIFFErrorExtR(tif, module,
1981
331
                              "%s:%d: %s: Error fetching directory count",
1982
331
                              __FILE__, __LINE__, tif->tif_name);
1983
331
                return (0);
1984
331
            }
1985
718
            if (tif->tif_flags & TIFF_SWAB)
1986
36
                TIFFSwabLong8(&dircount64);
1987
718
            if (dircount64 > 0xFFFF)
1988
172
            {
1989
172
                TIFFErrorExtR(tif, module,
1990
172
                              "%s:%d: %s: Error fetching directory count",
1991
172
                              __FILE__, __LINE__, tif->tif_name);
1992
172
                return (0);
1993
172
            }
1994
546
            dircount16 = (uint16_t)dircount64;
1995
546
            if (off != NULL)
1996
0
                *off = TIFFSeekFile(tif, dircount16 * 20, SEEK_CUR);
1997
546
            else
1998
546
                (void)TIFFSeekFile(tif, dircount16 * 20, SEEK_CUR);
1999
546
            if (!ReadOK(tif, nextdiroff, sizeof(uint64_t)))
2000
25
            {
2001
25
                TIFFErrorExtR(tif, module, "%s: Error fetching directory link",
2002
25
                              tif->tif_name);
2003
25
                return (0);
2004
25
            }
2005
521
            if (tif->tif_flags & TIFF_SWAB)
2006
30
                TIFFSwabLong8(nextdiroff);
2007
521
        }
2008
229k
    }
2009
223k
    if (*nextdiroff != 0)
2010
206k
    {
2011
206k
        (*nextdirnum)++;
2012
        /* Check next directory for IFD looping and if so, set it as last
2013
         * directory. */
2014
206k
        if (!_TIFFCheckDirNumberAndOffset(tif, *nextdirnum, *nextdiroff))
2015
3.13k
        {
2016
3.13k
            TIFFWarningExtR(
2017
3.13k
                tif, module,
2018
3.13k
                "the next directory %u at offset 0x%" PRIx64 " (%" PRIu64
2019
3.13k
                ") might be an IFD loop. Treating directory %d as "
2020
3.13k
                "last directory",
2021
3.13k
                *nextdirnum, *nextdiroff, *nextdiroff, (int)(*nextdirnum) - 1);
2022
3.13k
            *nextdiroff = 0;
2023
3.13k
            (*nextdirnum)--;
2024
3.13k
        }
2025
206k
    }
2026
223k
    return (1);
2027
355k
}
2028
2029
/*
2030
 * Count the number of directories in a file.
2031
 */
2032
tdir_t TIFFNumberOfDirectories(TIFF *tif)
2033
151k
{
2034
151k
    uint64_t nextdiroff;
2035
151k
    tdir_t nextdirnum;
2036
151k
    tdir_t n;
2037
151k
    if (!(tif->tif_flags & TIFF_BIGTIFF))
2038
150k
        nextdiroff = tif->tif_header.classic.tiff_diroff;
2039
886
    else
2040
886
        nextdiroff = tif->tif_header.big.tiff_diroff;
2041
151k
    nextdirnum = 0;
2042
151k
    n = 0;
2043
374k
    while (nextdiroff != 0 &&
2044
374k
           TIFFAdvanceDirectory(tif, &nextdiroff, NULL, &nextdirnum))
2045
223k
    {
2046
223k
        ++n;
2047
223k
    }
2048
    /* Update number of main-IFDs in file. */
2049
151k
    tif->tif_curdircount = n;
2050
151k
    return (n);
2051
151k
}
2052
2053
/*
2054
 * Set the n-th directory as the current directory.
2055
 * NB: Directories are numbered starting at 0.
2056
 */
2057
int TIFFSetDirectory(TIFF *tif, tdir_t dirn)
2058
638k
{
2059
638k
    uint64_t nextdiroff;
2060
638k
    tdir_t nextdirnum = 0;
2061
638k
    tdir_t n;
2062
2063
638k
    if (tif->tif_setdirectory_force_absolute)
2064
0
    {
2065
        /* tif_setdirectory_force_absolute=1 will force parsing the main IFD
2066
         * chain from the beginning, thus IFD directory list needs to be cleared
2067
         * from possible SubIFD offsets.
2068
         */
2069
0
        _TIFFCleanupIFDOffsetAndNumberMaps(tif); /* invalidate IFD loop lists */
2070
0
    }
2071
2072
    /* Even faster path, if offset is available within IFD loop hash list. */
2073
638k
    if (!tif->tif_setdirectory_force_absolute &&
2074
638k
        _TIFFGetOffsetFromDirNumber(tif, dirn, &nextdiroff))
2075
638k
    {
2076
        /* Set parameters for following TIFFReadDirectory() below. */
2077
638k
        tif->tif_nextdiroff = nextdiroff;
2078
638k
        tif->tif_curdir = dirn;
2079
        /* Reset to relative stepping */
2080
638k
        tif->tif_setdirectory_force_absolute = FALSE;
2081
638k
    }
2082
0
    else
2083
0
    {
2084
2085
        /* Fast path when we just advance relative to the current directory:
2086
         * start at the current dir offset and continue to seek from there.
2087
         * Check special cases when relative is not allowed:
2088
         * - jump back from SubIFD or custom directory
2089
         * - right after TIFFWriteDirectory() jump back to that directory
2090
         *   using TIFFSetDirectory() */
2091
0
        const int relative = (dirn >= tif->tif_curdir) &&
2092
0
                             (tif->tif_diroff != 0) &&
2093
0
                             !tif->tif_setdirectory_force_absolute;
2094
2095
0
        if (relative)
2096
0
        {
2097
0
            nextdiroff = tif->tif_diroff;
2098
0
            dirn -= tif->tif_curdir;
2099
0
            nextdirnum = tif->tif_curdir;
2100
0
        }
2101
0
        else if (!(tif->tif_flags & TIFF_BIGTIFF))
2102
0
            nextdiroff = tif->tif_header.classic.tiff_diroff;
2103
0
        else
2104
0
            nextdiroff = tif->tif_header.big.tiff_diroff;
2105
2106
        /* Reset to relative stepping */
2107
0
        tif->tif_setdirectory_force_absolute = FALSE;
2108
2109
0
        for (n = dirn; n > 0 && nextdiroff != 0; n--)
2110
0
            if (!TIFFAdvanceDirectory(tif, &nextdiroff, NULL, &nextdirnum))
2111
0
                return (0);
2112
        /* If the n-th directory could not be reached (does not exist),
2113
         * return here without touching anything further. */
2114
0
        if (nextdiroff == 0 || n > 0)
2115
0
            return (0);
2116
2117
0
        tif->tif_nextdiroff = nextdiroff;
2118
2119
        /* Set curdir to the actual directory index. */
2120
0
        if (relative)
2121
0
            tif->tif_curdir += dirn - n;
2122
0
        else
2123
0
            tif->tif_curdir = dirn - n;
2124
0
    }
2125
2126
    /* The -1 decrement is because TIFFReadDirectory will increment
2127
     * tif_curdir after successfully reading the directory. */
2128
638k
    if (tif->tif_curdir == 0)
2129
638k
        tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2130
112
    else
2131
112
        tif->tif_curdir--;
2132
2133
638k
    tdir_t curdir = tif->tif_curdir;
2134
2135
638k
    int retval = TIFFReadDirectory(tif);
2136
2137
638k
    if (!retval && tif->tif_curdir == curdir)
2138
0
    {
2139
        /* If tif_curdir has not be incremented, TIFFFetchDirectory() in
2140
         * TIFFReadDirectory() has failed and tif_curdir shall be set
2141
         * specifically. */
2142
0
        tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2143
0
    }
2144
638k
    return (retval);
2145
638k
}
2146
2147
/*
2148
 * Set the current directory to be the directory
2149
 * located at the specified file offset.  This interface
2150
 * is used mainly to access directories linked with
2151
 * the SubIFD tag (e.g. thumbnail images).
2152
 */
2153
int TIFFSetSubDirectory(TIFF *tif, uint64_t diroff)
2154
497k
{
2155
    /* Match nextdiroff and curdir for consistent IFD-loop checking.
2156
     * Only with TIFFSetSubDirectory() the IFD list can be corrupted with
2157
     * invalid offsets within the main IFD tree. In the case of several subIFDs
2158
     * of a main image, there are two possibilities that are not even mutually
2159
     * exclusive. a.) The subIFD tag contains an array with all offsets of the
2160
     * subIFDs. b.) The SubIFDs are concatenated with their NextIFD parameters.
2161
     * (refer to
2162
     * https://www.awaresystems.be/imaging/tiff/specification/TIFFPM6.pdf.)
2163
     */
2164
497k
    int retval;
2165
497k
    uint32_t curdir = 0;
2166
497k
    int8_t probablySubIFD = 0;
2167
497k
    if (diroff == 0)
2168
112k
    {
2169
        /* Special case to set tif_diroff=0, which is done in
2170
         * TIFFReadDirectory() below to indicate that the currently read IFD is
2171
         * treated as a new, fresh IFD. */
2172
112k
        tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2173
112k
        tif->tif_dir.td_iswrittentofile = FALSE;
2174
112k
    }
2175
384k
    else
2176
384k
    {
2177
384k
        if (!_TIFFGetDirNumberFromOffset(tif, diroff, &curdir))
2178
74.4k
        {
2179
            /* Non-existing offsets might point to a SubIFD or invalid IFD.*/
2180
74.4k
            probablySubIFD = 1;
2181
74.4k
        }
2182
        /* -1 because TIFFReadDirectory() will increment tif_curdir. */
2183
384k
        if (curdir >= 1)
2184
126k
            tif->tif_curdir = curdir - 1;
2185
258k
        else
2186
258k
            tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2187
384k
    }
2188
497k
    curdir = tif->tif_curdir;
2189
2190
497k
    tif->tif_nextdiroff = diroff;
2191
497k
    retval = TIFFReadDirectory(tif);
2192
2193
    /* tif_curdir is incremented in TIFFReadDirectory(), but if it has not been
2194
     * incremented, TIFFFetchDirectory() has failed there and tif_curdir shall
2195
     * be set specifically. */
2196
497k
    if (!retval && diroff != 0 && tif->tif_curdir == curdir)
2197
10.5k
    {
2198
10.5k
        tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2199
10.5k
    }
2200
2201
497k
    if (probablySubIFD)
2202
74.4k
    {
2203
74.4k
        if (retval)
2204
63.1k
        {
2205
            /* Reset IFD list to start new one for SubIFD chain and also start
2206
             * SubIFD chain with tif_curdir=0 for IFD loop checking. */
2207
            /* invalidate IFD loop lists */
2208
63.1k
            _TIFFCleanupIFDOffsetAndNumberMaps(tif);
2209
63.1k
            tif->tif_curdir = 0; /* first directory of new chain */
2210
            /* add this offset to new IFD list */
2211
63.1k
            retval = _TIFFCheckDirNumberAndOffset(tif, tif->tif_curdir, diroff);
2212
63.1k
        }
2213
        /* To be able to return from SubIFD or custom-IFD to main-IFD */
2214
74.4k
        tif->tif_setdirectory_force_absolute = TRUE;
2215
74.4k
    }
2216
2217
497k
    return (retval);
2218
497k
}
2219
2220
/*
2221
 * Return file offset of the current directory.
2222
 */
2223
824k
uint64_t TIFFCurrentDirOffset(TIFF *tif) { return (tif->tif_diroff); }
2224
2225
/*
2226
 * Return an indication of whether or not we are
2227
 * at the last directory in the file.
2228
 */
2229
176k
int TIFFLastDirectory(TIFF *tif) { return (tif->tif_nextdiroff == 0); }
2230
2231
/*
2232
 * Unlink the specified directory from the directory chain.
2233
 * Note: First directory starts with number dirn=1.
2234
 * This is different to TIFFSetDirectory() where the first directory starts with
2235
 * zero.
2236
 */
2237
int TIFFUnlinkDirectory(TIFF *tif, tdir_t dirn)
2238
0
{
2239
0
    static const char module[] = "TIFFUnlinkDirectory";
2240
0
    uint64_t nextdir;
2241
0
    tdir_t nextdirnum;
2242
0
    uint64_t off;
2243
0
    tdir_t n;
2244
2245
0
    if (tif->tif_mode == O_RDONLY)
2246
0
    {
2247
0
        TIFFErrorExtR(tif, module,
2248
0
                      "Can not unlink directory in read-only file");
2249
0
        return (0);
2250
0
    }
2251
0
    if (dirn == 0)
2252
0
    {
2253
0
        TIFFErrorExtR(tif, module,
2254
0
                      "For TIFFUnlinkDirectory() first directory starts with "
2255
0
                      "number 1 and not 0");
2256
0
        return (0);
2257
0
    }
2258
    /*
2259
     * Go to the directory before the one we want
2260
     * to unlink and nab the offset of the link
2261
     * field we'll need to patch.
2262
     */
2263
0
    if (!(tif->tif_flags & TIFF_BIGTIFF))
2264
0
    {
2265
0
        nextdir = tif->tif_header.classic.tiff_diroff;
2266
0
        off = 4;
2267
0
    }
2268
0
    else
2269
0
    {
2270
0
        nextdir = tif->tif_header.big.tiff_diroff;
2271
0
        off = 8;
2272
0
    }
2273
0
    nextdirnum = 0; /* First directory is dirn=0 */
2274
2275
0
    for (n = dirn - 1; n > 0; n--)
2276
0
    {
2277
0
        if (nextdir == 0)
2278
0
        {
2279
0
            TIFFErrorExtR(tif, module, "Directory %u does not exist", dirn);
2280
0
            return (0);
2281
0
        }
2282
0
        if (!TIFFAdvanceDirectory(tif, &nextdir, &off, &nextdirnum))
2283
0
            return (0);
2284
0
    }
2285
    /*
2286
     * Advance to the directory to be unlinked and fetch
2287
     * the offset of the directory that follows.
2288
     */
2289
0
    if (!TIFFAdvanceDirectory(tif, &nextdir, NULL, &nextdirnum))
2290
0
        return (0);
2291
    /*
2292
     * Go back and patch the link field of the preceding
2293
     * directory to point to the offset of the directory
2294
     * that follows.
2295
     */
2296
0
    (void)TIFFSeekFile(tif, off, SEEK_SET);
2297
0
    if (!(tif->tif_flags & TIFF_BIGTIFF))
2298
0
    {
2299
0
        uint32_t nextdir32;
2300
0
        nextdir32 = (uint32_t)nextdir;
2301
0
        assert((uint64_t)nextdir32 == nextdir);
2302
0
        if (tif->tif_flags & TIFF_SWAB)
2303
0
            TIFFSwabLong(&nextdir32);
2304
0
        if (!WriteOK(tif, &nextdir32, sizeof(uint32_t)))
2305
0
        {
2306
0
            TIFFErrorExtR(tif, module, "Error writing directory link");
2307
0
            return (0);
2308
0
        }
2309
0
    }
2310
0
    else
2311
0
    {
2312
        /* Need local swap because nextdir has to be used unswapped below. */
2313
0
        uint64_t nextdir64 = nextdir;
2314
0
        if (tif->tif_flags & TIFF_SWAB)
2315
0
            TIFFSwabLong8(&nextdir64);
2316
0
        if (!WriteOK(tif, &nextdir64, sizeof(uint64_t)))
2317
0
        {
2318
0
            TIFFErrorExtR(tif, module, "Error writing directory link");
2319
0
            return (0);
2320
0
        }
2321
0
    }
2322
2323
    /* For dirn=1 (first directory) also update the libtiff internal
2324
     * base offset variables. */
2325
0
    if (dirn == 1)
2326
0
    {
2327
0
        if (!(tif->tif_flags & TIFF_BIGTIFF))
2328
0
            tif->tif_header.classic.tiff_diroff = (uint32_t)nextdir;
2329
0
        else
2330
0
            tif->tif_header.big.tiff_diroff = nextdir;
2331
0
    }
2332
2333
    /*
2334
     * Leave directory state setup safely.  We don't have
2335
     * facilities for doing inserting and removing directories,
2336
     * so it's safest to just invalidate everything.  This
2337
     * means that the caller can only append to the directory
2338
     * chain.
2339
     */
2340
0
    if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata)
2341
0
    {
2342
0
        _TIFFfreeExt(tif, tif->tif_rawdata);
2343
0
        tif->tif_rawdata = NULL;
2344
0
        tif->tif_rawcc = 0;
2345
0
        tif->tif_rawcp = NULL;
2346
0
        tif->tif_rawdataoff = 0;
2347
0
        tif->tif_rawdataloaded = 0;
2348
0
    }
2349
0
    tif->tif_flags &= ~(TIFF_BEENWRITING | TIFF_BUFFERSETUP | TIFF_POSTENCODE |
2350
0
                        TIFF_BUF4WRITE);
2351
0
    TIFFFreeDirectory(tif);
2352
0
    TIFFDefaultDirectory(tif);
2353
0
    tif->tif_diroff = 0;     /* force link on next write */
2354
0
    tif->tif_nextdiroff = 0; /* next write must be at end */
2355
0
    tif->tif_lastdiroff = 0; /* will be updated on next link */
2356
0
    tif->tif_curoff = 0;
2357
0
    tif->tif_row = (uint32_t)-1;
2358
0
    tif->tif_curstrip = (uint32_t)-1;
2359
0
    tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2360
0
    if (tif->tif_curdircount > 0)
2361
0
        tif->tif_curdircount--;
2362
0
    else
2363
0
        tif->tif_curdircount = TIFF_NON_EXISTENT_DIR_NUMBER;
2364
0
    _TIFFCleanupIFDOffsetAndNumberMaps(tif); /* invalidate IFD loop lists */
2365
0
    return (1);
2366
0
}