/src/gdal/frmts/gtiff/libtiff/tif_dirread.c
Line | Count | Source |
1 | | /* |
2 | | * Copyright (c) 1988-1997 Sam Leffler |
3 | | * Copyright (c) 1991-1997 Silicon Graphics, Inc. |
4 | | * |
5 | | * Permission to use, copy, modify, distribute, and sell this software and |
6 | | * its documentation for any purpose is hereby granted without fee, provided |
7 | | * that (i) the above copyright notices and this permission notice appear in |
8 | | * all copies of the software and related documentation, and (ii) the names of |
9 | | * Sam Leffler and Silicon Graphics may not be used in any advertising or |
10 | | * publicity relating to the software without the specific, prior written |
11 | | * permission of Sam Leffler and Silicon Graphics. |
12 | | * |
13 | | * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, |
14 | | * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY |
15 | | * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. |
16 | | * |
17 | | * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR |
18 | | * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, |
19 | | * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, |
20 | | * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF |
21 | | * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE |
22 | | * OF THIS SOFTWARE. |
23 | | */ |
24 | | |
25 | | /* |
26 | | * TIFF Library. |
27 | | * |
28 | | * Directory Read Support Routines. |
29 | | */ |
30 | | |
31 | | /* Suggested pending improvements: |
32 | | * - add a field 'field_info' to the TIFFDirEntry structure, and set that with |
33 | | * the pointer to the appropriate TIFFField structure early on in |
34 | | * TIFFReadDirectory, so as to eliminate current possibly repetitive lookup. |
35 | | */ |
36 | | |
37 | | #include "tiffconf.h" |
38 | | #include "tiffiop.h" |
39 | | #include <float.h> |
40 | | #include <limits.h> |
41 | | #include <stdlib.h> |
42 | | #include <string.h> |
43 | | |
44 | 106M | #define FAILED_FII ((uint32_t)-1) |
45 | | |
46 | | #ifdef HAVE_IEEEFP |
47 | | #define TIFFCvtIEEEFloatToNative(tif, n, fp) |
48 | | #define TIFFCvtIEEEDoubleToNative(tif, n, dp) |
49 | | #else |
50 | | /* If your machine does not support IEEE floating point then you will need to |
51 | | * add support to tif_machdep.c to convert between the native format and |
52 | | * IEEE format. */ |
53 | | extern void TIFFCvtIEEEFloatToNative(TIFF *, uint32_t, float *); |
54 | | extern void TIFFCvtIEEEDoubleToNative(TIFF *, uint32_t, double *); |
55 | | #endif |
56 | | |
57 | | enum TIFFReadDirEntryErr |
58 | | { |
59 | | TIFFReadDirEntryErrOk = 0, |
60 | | TIFFReadDirEntryErrCount = 1, |
61 | | TIFFReadDirEntryErrType = 2, |
62 | | TIFFReadDirEntryErrIo = 3, |
63 | | TIFFReadDirEntryErrRange = 4, |
64 | | TIFFReadDirEntryErrPsdif = 5, |
65 | | TIFFReadDirEntryErrSizesan = 6, |
66 | | TIFFReadDirEntryErrAlloc = 7, |
67 | | }; |
68 | | |
69 | | static enum TIFFReadDirEntryErr |
70 | | TIFFReadDirEntryByte(TIFF *tif, TIFFDirEntry *direntry, uint8_t *value); |
71 | | static enum TIFFReadDirEntryErr |
72 | | TIFFReadDirEntrySbyte(TIFF *tif, TIFFDirEntry *direntry, int8_t *value); |
73 | | static enum TIFFReadDirEntryErr |
74 | | TIFFReadDirEntryShort(TIFF *tif, TIFFDirEntry *direntry, uint16_t *value); |
75 | | static enum TIFFReadDirEntryErr |
76 | | TIFFReadDirEntrySshort(TIFF *tif, TIFFDirEntry *direntry, int16_t *value); |
77 | | static enum TIFFReadDirEntryErr |
78 | | TIFFReadDirEntryLong(TIFF *tif, TIFFDirEntry *direntry, uint32_t *value); |
79 | | static enum TIFFReadDirEntryErr |
80 | | TIFFReadDirEntrySlong(TIFF *tif, TIFFDirEntry *direntry, int32_t *value); |
81 | | static enum TIFFReadDirEntryErr |
82 | | TIFFReadDirEntryLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value); |
83 | | static enum TIFFReadDirEntryErr |
84 | | TIFFReadDirEntrySlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value); |
85 | | static enum TIFFReadDirEntryErr |
86 | | TIFFReadDirEntryFloat(TIFF *tif, TIFFDirEntry *direntry, float *value); |
87 | | static enum TIFFReadDirEntryErr |
88 | | TIFFReadDirEntryDouble(TIFF *tif, TIFFDirEntry *direntry, double *value); |
89 | | static enum TIFFReadDirEntryErr |
90 | | TIFFReadDirEntryIfd8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value); |
91 | | |
92 | | static enum TIFFReadDirEntryErr |
93 | | TIFFReadDirEntryArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t *count, |
94 | | uint32_t desttypesize, void **value); |
95 | | static enum TIFFReadDirEntryErr |
96 | | TIFFReadDirEntryByteArray(TIFF *tif, TIFFDirEntry *direntry, uint8_t **value); |
97 | | static enum TIFFReadDirEntryErr |
98 | | TIFFReadDirEntrySbyteArray(TIFF *tif, TIFFDirEntry *direntry, int8_t **value); |
99 | | static enum TIFFReadDirEntryErr |
100 | | TIFFReadDirEntryShortArray(TIFF *tif, TIFFDirEntry *direntry, uint16_t **value); |
101 | | static enum TIFFReadDirEntryErr |
102 | | TIFFReadDirEntrySshortArray(TIFF *tif, TIFFDirEntry *direntry, int16_t **value); |
103 | | static enum TIFFReadDirEntryErr |
104 | | TIFFReadDirEntryLongArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t **value); |
105 | | static enum TIFFReadDirEntryErr |
106 | | TIFFReadDirEntrySlongArray(TIFF *tif, TIFFDirEntry *direntry, int32_t **value); |
107 | | static enum TIFFReadDirEntryErr |
108 | | TIFFReadDirEntryLong8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value); |
109 | | static enum TIFFReadDirEntryErr |
110 | | TIFFReadDirEntrySlong8Array(TIFF *tif, TIFFDirEntry *direntry, int64_t **value); |
111 | | static enum TIFFReadDirEntryErr |
112 | | TIFFReadDirEntryFloatArray(TIFF *tif, TIFFDirEntry *direntry, float **value); |
113 | | static enum TIFFReadDirEntryErr |
114 | | TIFFReadDirEntryDoubleArray(TIFF *tif, TIFFDirEntry *direntry, double **value); |
115 | | static enum TIFFReadDirEntryErr |
116 | | TIFFReadDirEntryIfd8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value); |
117 | | |
118 | | static enum TIFFReadDirEntryErr |
119 | | TIFFReadDirEntryPersampleShort(TIFF *tif, TIFFDirEntry *direntry, |
120 | | uint16_t *value); |
121 | | |
122 | | static void TIFFReadDirEntryCheckedByte(TIFF *tif, TIFFDirEntry *direntry, |
123 | | uint8_t *value); |
124 | | static void TIFFReadDirEntryCheckedSbyte(TIFF *tif, TIFFDirEntry *direntry, |
125 | | int8_t *value); |
126 | | static void TIFFReadDirEntryCheckedShort(TIFF *tif, TIFFDirEntry *direntry, |
127 | | uint16_t *value); |
128 | | static void TIFFReadDirEntryCheckedSshort(TIFF *tif, TIFFDirEntry *direntry, |
129 | | int16_t *value); |
130 | | static void TIFFReadDirEntryCheckedLong(TIFF *tif, TIFFDirEntry *direntry, |
131 | | uint32_t *value); |
132 | | static void TIFFReadDirEntryCheckedSlong(TIFF *tif, TIFFDirEntry *direntry, |
133 | | int32_t *value); |
134 | | static enum TIFFReadDirEntryErr |
135 | | TIFFReadDirEntryCheckedLong8(TIFF *tif, TIFFDirEntry *direntry, |
136 | | uint64_t *value); |
137 | | static enum TIFFReadDirEntryErr |
138 | | TIFFReadDirEntryCheckedSlong8(TIFF *tif, TIFFDirEntry *direntry, |
139 | | int64_t *value); |
140 | | static enum TIFFReadDirEntryErr |
141 | | TIFFReadDirEntryCheckedRational(TIFF *tif, TIFFDirEntry *direntry, |
142 | | double *value); |
143 | | static enum TIFFReadDirEntryErr |
144 | | TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry, |
145 | | double *value); |
146 | | static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry, |
147 | | float *value); |
148 | | static enum TIFFReadDirEntryErr |
149 | | TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value); |
150 | | #if 0 |
151 | | static enum TIFFReadDirEntryErr |
152 | | TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry, |
153 | | TIFFRational_t *value); |
154 | | #endif |
155 | | static enum TIFFReadDirEntryErr |
156 | | TIFFReadDirEntryCheckRangeByteSbyte(int8_t value); |
157 | | static enum TIFFReadDirEntryErr |
158 | | TIFFReadDirEntryCheckRangeByteShort(uint16_t value); |
159 | | static enum TIFFReadDirEntryErr |
160 | | TIFFReadDirEntryCheckRangeByteSshort(int16_t value); |
161 | | static enum TIFFReadDirEntryErr |
162 | | TIFFReadDirEntryCheckRangeByteLong(uint32_t value); |
163 | | static enum TIFFReadDirEntryErr |
164 | | TIFFReadDirEntryCheckRangeByteSlong(int32_t value); |
165 | | static enum TIFFReadDirEntryErr |
166 | | TIFFReadDirEntryCheckRangeByteLong8(uint64_t value); |
167 | | static enum TIFFReadDirEntryErr |
168 | | TIFFReadDirEntryCheckRangeByteSlong8(int64_t value); |
169 | | |
170 | | static enum TIFFReadDirEntryErr |
171 | | TIFFReadDirEntryCheckRangeSbyteByte(uint8_t value); |
172 | | static enum TIFFReadDirEntryErr |
173 | | TIFFReadDirEntryCheckRangeSbyteShort(uint16_t value); |
174 | | static enum TIFFReadDirEntryErr |
175 | | TIFFReadDirEntryCheckRangeSbyteSshort(int16_t value); |
176 | | static enum TIFFReadDirEntryErr |
177 | | TIFFReadDirEntryCheckRangeSbyteLong(uint32_t value); |
178 | | static enum TIFFReadDirEntryErr |
179 | | TIFFReadDirEntryCheckRangeSbyteSlong(int32_t value); |
180 | | static enum TIFFReadDirEntryErr |
181 | | TIFFReadDirEntryCheckRangeSbyteLong8(uint64_t value); |
182 | | static enum TIFFReadDirEntryErr |
183 | | TIFFReadDirEntryCheckRangeSbyteSlong8(int64_t value); |
184 | | |
185 | | static enum TIFFReadDirEntryErr |
186 | | TIFFReadDirEntryCheckRangeShortSbyte(int8_t value); |
187 | | static enum TIFFReadDirEntryErr |
188 | | TIFFReadDirEntryCheckRangeShortSshort(int16_t value); |
189 | | static enum TIFFReadDirEntryErr |
190 | | TIFFReadDirEntryCheckRangeShortLong(uint32_t value); |
191 | | static enum TIFFReadDirEntryErr |
192 | | TIFFReadDirEntryCheckRangeShortSlong(int32_t value); |
193 | | static enum TIFFReadDirEntryErr |
194 | | TIFFReadDirEntryCheckRangeShortLong8(uint64_t value); |
195 | | static enum TIFFReadDirEntryErr |
196 | | TIFFReadDirEntryCheckRangeShortSlong8(int64_t value); |
197 | | |
198 | | static enum TIFFReadDirEntryErr |
199 | | TIFFReadDirEntryCheckRangeSshortShort(uint16_t value); |
200 | | static enum TIFFReadDirEntryErr |
201 | | TIFFReadDirEntryCheckRangeSshortLong(uint32_t value); |
202 | | static enum TIFFReadDirEntryErr |
203 | | TIFFReadDirEntryCheckRangeSshortSlong(int32_t value); |
204 | | static enum TIFFReadDirEntryErr |
205 | | TIFFReadDirEntryCheckRangeSshortLong8(uint64_t value); |
206 | | static enum TIFFReadDirEntryErr |
207 | | TIFFReadDirEntryCheckRangeSshortSlong8(int64_t value); |
208 | | |
209 | | static enum TIFFReadDirEntryErr |
210 | | TIFFReadDirEntryCheckRangeLongSbyte(int8_t value); |
211 | | static enum TIFFReadDirEntryErr |
212 | | TIFFReadDirEntryCheckRangeLongSshort(int16_t value); |
213 | | static enum TIFFReadDirEntryErr |
214 | | TIFFReadDirEntryCheckRangeLongSlong(int32_t value); |
215 | | static enum TIFFReadDirEntryErr |
216 | | TIFFReadDirEntryCheckRangeLongLong8(uint64_t value); |
217 | | static enum TIFFReadDirEntryErr |
218 | | TIFFReadDirEntryCheckRangeLongSlong8(int64_t value); |
219 | | |
220 | | static enum TIFFReadDirEntryErr |
221 | | TIFFReadDirEntryCheckRangeSlongLong(uint32_t value); |
222 | | static enum TIFFReadDirEntryErr |
223 | | TIFFReadDirEntryCheckRangeSlongLong8(uint64_t value); |
224 | | static enum TIFFReadDirEntryErr |
225 | | TIFFReadDirEntryCheckRangeSlongSlong8(int64_t value); |
226 | | |
227 | | static enum TIFFReadDirEntryErr |
228 | | TIFFReadDirEntryCheckRangeLong8Sbyte(int8_t value); |
229 | | static enum TIFFReadDirEntryErr |
230 | | TIFFReadDirEntryCheckRangeLong8Sshort(int16_t value); |
231 | | static enum TIFFReadDirEntryErr |
232 | | TIFFReadDirEntryCheckRangeLong8Slong(int32_t value); |
233 | | static enum TIFFReadDirEntryErr |
234 | | TIFFReadDirEntryCheckRangeLong8Slong8(int64_t value); |
235 | | |
236 | | static enum TIFFReadDirEntryErr |
237 | | TIFFReadDirEntryCheckRangeSlong8Long8(uint64_t value); |
238 | | |
239 | | static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF *tif, uint64_t offset, |
240 | | tmsize_t size, void *dest); |
241 | | static void TIFFReadDirEntryOutputErr(TIFF *tif, enum TIFFReadDirEntryErr err, |
242 | | const char *module, const char *tagname, |
243 | | int recover); |
244 | | |
245 | | static void TIFFReadDirectoryCheckOrder(TIFF *tif, TIFFDirEntry *dir, |
246 | | uint16_t dircount); |
247 | | static TIFFDirEntry *TIFFReadDirectoryFindEntry(TIFF *tif, TIFFDirEntry *dir, |
248 | | uint16_t dircount, |
249 | | uint16_t tagid); |
250 | | static void TIFFReadDirectoryFindFieldInfo(TIFF *tif, uint16_t tagid, |
251 | | uint32_t *fii); |
252 | | |
253 | | static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir, |
254 | | uint16_t dircount); |
255 | | static void MissingRequired(TIFF *, const char *); |
256 | | static int CheckDirCount(TIFF *, TIFFDirEntry *, uint32_t); |
257 | | static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff, |
258 | | TIFFDirEntry **pdir, uint64_t *nextdiroff); |
259 | | static int TIFFFetchNormalTag(TIFF *, TIFFDirEntry *, int recover); |
260 | | static int TIFFFetchStripThing(TIFF *tif, TIFFDirEntry *dir, uint32_t nstrips, |
261 | | uint64_t **lpp); |
262 | | static int TIFFFetchSubjectDistance(TIFF *, TIFFDirEntry *); |
263 | | static void ChopUpSingleUncompressedStrip(TIFF *); |
264 | | static void TryChopUpUncompressedBigTiff(TIFF *); |
265 | | static uint64_t TIFFReadUInt64(const uint8_t *value); |
266 | | static int _TIFFGetMaxColorChannels(uint16_t photometric); |
267 | | |
268 | | static int _TIFFFillStrilesInternal(TIFF *tif, int loadStripByteCount); |
269 | | |
270 | | typedef union _UInt64Aligned_t |
271 | | { |
272 | | double d; |
273 | | uint64_t l; |
274 | | uint32_t i[2]; |
275 | | uint16_t s[4]; |
276 | | uint8_t c[8]; |
277 | | } UInt64Aligned_t; |
278 | | |
279 | | /* |
280 | | Unaligned safe copy of a uint64_t value from an octet array. |
281 | | */ |
282 | | static uint64_t TIFFReadUInt64(const uint8_t *value) |
283 | 236k | { |
284 | 236k | UInt64Aligned_t result; |
285 | | |
286 | 236k | result.c[0] = value[0]; |
287 | 236k | result.c[1] = value[1]; |
288 | 236k | result.c[2] = value[2]; |
289 | 236k | result.c[3] = value[3]; |
290 | 236k | result.c[4] = value[4]; |
291 | 236k | result.c[5] = value[5]; |
292 | 236k | result.c[6] = value[6]; |
293 | 236k | result.c[7] = value[7]; |
294 | | |
295 | 236k | return result.l; |
296 | 236k | } |
297 | | |
298 | | static enum TIFFReadDirEntryErr |
299 | | TIFFReadDirEntryByte(TIFF *tif, TIFFDirEntry *direntry, uint8_t *value) |
300 | 16.9k | { |
301 | 16.9k | enum TIFFReadDirEntryErr err; |
302 | 16.9k | if (direntry->tdir_count != 1) |
303 | 3.92k | return (TIFFReadDirEntryErrCount); |
304 | 12.9k | switch (direntry->tdir_type) |
305 | 12.9k | { |
306 | 748 | case TIFF_BYTE: |
307 | 886 | case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with |
308 | | field_readcount==1 */ |
309 | 886 | TIFFReadDirEntryCheckedByte(tif, direntry, value); |
310 | 886 | return (TIFFReadDirEntryErrOk); |
311 | 403 | case TIFF_SBYTE: |
312 | 403 | { |
313 | 403 | int8_t m; |
314 | 403 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
315 | 403 | err = TIFFReadDirEntryCheckRangeByteSbyte(m); |
316 | 403 | if (err != TIFFReadDirEntryErrOk) |
317 | 195 | return (err); |
318 | 208 | *value = (uint8_t)m; |
319 | 208 | return (TIFFReadDirEntryErrOk); |
320 | 403 | } |
321 | 1.59k | case TIFF_SHORT: |
322 | 1.59k | { |
323 | 1.59k | uint16_t m; |
324 | 1.59k | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
325 | 1.59k | err = TIFFReadDirEntryCheckRangeByteShort(m); |
326 | 1.59k | if (err != TIFFReadDirEntryErrOk) |
327 | 799 | return (err); |
328 | 792 | *value = (uint8_t)m; |
329 | 792 | return (TIFFReadDirEntryErrOk); |
330 | 1.59k | } |
331 | 1.86k | case TIFF_SSHORT: |
332 | 1.86k | { |
333 | 1.86k | int16_t m; |
334 | 1.86k | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
335 | 1.86k | err = TIFFReadDirEntryCheckRangeByteSshort(m); |
336 | 1.86k | if (err != TIFFReadDirEntryErrOk) |
337 | 1.26k | return (err); |
338 | 596 | *value = (uint8_t)m; |
339 | 596 | return (TIFFReadDirEntryErrOk); |
340 | 1.86k | } |
341 | 1.66k | case TIFF_LONG: |
342 | 1.66k | { |
343 | 1.66k | uint32_t m; |
344 | 1.66k | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
345 | 1.66k | err = TIFFReadDirEntryCheckRangeByteLong(m); |
346 | 1.66k | if (err != TIFFReadDirEntryErrOk) |
347 | 1.16k | return (err); |
348 | 500 | *value = (uint8_t)m; |
349 | 500 | return (TIFFReadDirEntryErrOk); |
350 | 1.66k | } |
351 | 1.41k | case TIFF_SLONG: |
352 | 1.41k | { |
353 | 1.41k | int32_t m; |
354 | 1.41k | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
355 | 1.41k | err = TIFFReadDirEntryCheckRangeByteSlong(m); |
356 | 1.41k | if (err != TIFFReadDirEntryErrOk) |
357 | 950 | return (err); |
358 | 467 | *value = (uint8_t)m; |
359 | 467 | return (TIFFReadDirEntryErrOk); |
360 | 1.41k | } |
361 | 1.80k | case TIFF_LONG8: |
362 | 1.80k | { |
363 | 1.80k | uint64_t m; |
364 | 1.80k | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
365 | 1.80k | if (err != TIFFReadDirEntryErrOk) |
366 | 591 | return (err); |
367 | 1.21k | err = TIFFReadDirEntryCheckRangeByteLong8(m); |
368 | 1.21k | if (err != TIFFReadDirEntryErrOk) |
369 | 987 | return (err); |
370 | 231 | *value = (uint8_t)m; |
371 | 231 | return (TIFFReadDirEntryErrOk); |
372 | 1.21k | } |
373 | 2.63k | case TIFF_SLONG8: |
374 | 2.63k | { |
375 | 2.63k | int64_t m; |
376 | 2.63k | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
377 | 2.63k | if (err != TIFFReadDirEntryErrOk) |
378 | 942 | return (err); |
379 | 1.69k | err = TIFFReadDirEntryCheckRangeByteSlong8(m); |
380 | 1.69k | if (err != TIFFReadDirEntryErrOk) |
381 | 1.37k | return (err); |
382 | 322 | *value = (uint8_t)m; |
383 | 322 | return (TIFFReadDirEntryErrOk); |
384 | 1.69k | } |
385 | 724 | default: |
386 | 724 | return (TIFFReadDirEntryErrType); |
387 | 12.9k | } |
388 | 12.9k | } |
389 | | |
390 | | static enum TIFFReadDirEntryErr |
391 | | TIFFReadDirEntrySbyte(TIFF *tif, TIFFDirEntry *direntry, int8_t *value) |
392 | 0 | { |
393 | 0 | enum TIFFReadDirEntryErr err; |
394 | 0 | if (direntry->tdir_count != 1) |
395 | 0 | return (TIFFReadDirEntryErrCount); |
396 | 0 | switch (direntry->tdir_type) |
397 | 0 | { |
398 | 0 | case TIFF_BYTE: |
399 | 0 | case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with |
400 | | field_readcount==1 */ |
401 | 0 | { |
402 | 0 | uint8_t m; |
403 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
404 | 0 | err = TIFFReadDirEntryCheckRangeSbyteByte(m); |
405 | 0 | if (err != TIFFReadDirEntryErrOk) |
406 | 0 | return (err); |
407 | 0 | *value = (int8_t)m; |
408 | 0 | return (TIFFReadDirEntryErrOk); |
409 | 0 | } |
410 | 0 | case TIFF_SBYTE: |
411 | 0 | { |
412 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, value); |
413 | 0 | return (TIFFReadDirEntryErrOk); |
414 | 0 | } |
415 | 0 | case TIFF_SHORT: |
416 | 0 | { |
417 | 0 | uint16_t m; |
418 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
419 | 0 | err = TIFFReadDirEntryCheckRangeSbyteShort(m); |
420 | 0 | if (err != TIFFReadDirEntryErrOk) |
421 | 0 | return (err); |
422 | 0 | *value = (int8_t)m; |
423 | 0 | return (TIFFReadDirEntryErrOk); |
424 | 0 | } |
425 | 0 | case TIFF_SSHORT: |
426 | 0 | { |
427 | 0 | int16_t m; |
428 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
429 | 0 | err = TIFFReadDirEntryCheckRangeSbyteSshort(m); |
430 | 0 | if (err != TIFFReadDirEntryErrOk) |
431 | 0 | return (err); |
432 | 0 | *value = (int8_t)m; |
433 | 0 | return (TIFFReadDirEntryErrOk); |
434 | 0 | } |
435 | 0 | case TIFF_LONG: |
436 | 0 | { |
437 | 0 | uint32_t m; |
438 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
439 | 0 | err = TIFFReadDirEntryCheckRangeSbyteLong(m); |
440 | 0 | if (err != TIFFReadDirEntryErrOk) |
441 | 0 | return (err); |
442 | 0 | *value = (int8_t)m; |
443 | 0 | return (TIFFReadDirEntryErrOk); |
444 | 0 | } |
445 | 0 | case TIFF_SLONG: |
446 | 0 | { |
447 | 0 | int32_t m; |
448 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
449 | 0 | err = TIFFReadDirEntryCheckRangeSbyteSlong(m); |
450 | 0 | if (err != TIFFReadDirEntryErrOk) |
451 | 0 | return (err); |
452 | 0 | *value = (int8_t)m; |
453 | 0 | return (TIFFReadDirEntryErrOk); |
454 | 0 | } |
455 | 0 | case TIFF_LONG8: |
456 | 0 | { |
457 | 0 | uint64_t m; |
458 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
459 | 0 | if (err != TIFFReadDirEntryErrOk) |
460 | 0 | return (err); |
461 | 0 | err = TIFFReadDirEntryCheckRangeSbyteLong8(m); |
462 | 0 | if (err != TIFFReadDirEntryErrOk) |
463 | 0 | return (err); |
464 | 0 | *value = (int8_t)m; |
465 | 0 | return (TIFFReadDirEntryErrOk); |
466 | 0 | } |
467 | 0 | case TIFF_SLONG8: |
468 | 0 | { |
469 | 0 | int64_t m; |
470 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
471 | 0 | if (err != TIFFReadDirEntryErrOk) |
472 | 0 | return (err); |
473 | 0 | err = TIFFReadDirEntryCheckRangeSbyteSlong8(m); |
474 | 0 | if (err != TIFFReadDirEntryErrOk) |
475 | 0 | return (err); |
476 | 0 | *value = (int8_t)m; |
477 | 0 | return (TIFFReadDirEntryErrOk); |
478 | 0 | } |
479 | 0 | default: |
480 | 0 | return (TIFFReadDirEntryErrType); |
481 | 0 | } |
482 | 0 | } /*-- TIFFReadDirEntrySbyte() --*/ |
483 | | |
484 | | static enum TIFFReadDirEntryErr |
485 | | TIFFReadDirEntryShort(TIFF *tif, TIFFDirEntry *direntry, uint16_t *value) |
486 | 4.66M | { |
487 | 4.66M | enum TIFFReadDirEntryErr err; |
488 | 4.66M | if (direntry->tdir_count != 1) |
489 | 397k | return (TIFFReadDirEntryErrCount); |
490 | 4.27M | switch (direntry->tdir_type) |
491 | 4.27M | { |
492 | 35.3k | case TIFF_BYTE: |
493 | 35.3k | { |
494 | 35.3k | uint8_t m; |
495 | 35.3k | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
496 | 35.3k | *value = (uint16_t)m; |
497 | 35.3k | return (TIFFReadDirEntryErrOk); |
498 | 0 | } |
499 | 12.0k | case TIFF_SBYTE: |
500 | 12.0k | { |
501 | 12.0k | int8_t m; |
502 | 12.0k | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
503 | 12.0k | err = TIFFReadDirEntryCheckRangeShortSbyte(m); |
504 | 12.0k | if (err != TIFFReadDirEntryErrOk) |
505 | 620 | return (err); |
506 | 11.4k | *value = (uint16_t)m; |
507 | 11.4k | return (TIFFReadDirEntryErrOk); |
508 | 12.0k | } |
509 | 4.15M | case TIFF_SHORT: |
510 | 4.15M | TIFFReadDirEntryCheckedShort(tif, direntry, value); |
511 | 4.15M | return (TIFFReadDirEntryErrOk); |
512 | 17.8k | case TIFF_SSHORT: |
513 | 17.8k | { |
514 | 17.8k | int16_t m; |
515 | 17.8k | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
516 | 17.8k | err = TIFFReadDirEntryCheckRangeShortSshort(m); |
517 | 17.8k | if (err != TIFFReadDirEntryErrOk) |
518 | 1.12k | return (err); |
519 | 16.7k | *value = (uint16_t)m; |
520 | 16.7k | return (TIFFReadDirEntryErrOk); |
521 | 17.8k | } |
522 | 17.1k | case TIFF_LONG: |
523 | 17.1k | { |
524 | 17.1k | uint32_t m; |
525 | 17.1k | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
526 | 17.1k | err = TIFFReadDirEntryCheckRangeShortLong(m); |
527 | 17.1k | if (err != TIFFReadDirEntryErrOk) |
528 | 8.63k | return (err); |
529 | 8.54k | *value = (uint16_t)m; |
530 | 8.54k | return (TIFFReadDirEntryErrOk); |
531 | 17.1k | } |
532 | 8.05k | case TIFF_SLONG: |
533 | 8.05k | { |
534 | 8.05k | int32_t m; |
535 | 8.05k | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
536 | 8.05k | err = TIFFReadDirEntryCheckRangeShortSlong(m); |
537 | 8.05k | if (err != TIFFReadDirEntryErrOk) |
538 | 1.90k | return (err); |
539 | 6.15k | *value = (uint16_t)m; |
540 | 6.15k | return (TIFFReadDirEntryErrOk); |
541 | 8.05k | } |
542 | 1.92k | case TIFF_LONG8: |
543 | 1.92k | { |
544 | 1.92k | uint64_t m; |
545 | 1.92k | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
546 | 1.92k | if (err != TIFFReadDirEntryErrOk) |
547 | 642 | return (err); |
548 | 1.28k | err = TIFFReadDirEntryCheckRangeShortLong8(m); |
549 | 1.28k | if (err != TIFFReadDirEntryErrOk) |
550 | 774 | return (err); |
551 | 510 | *value = (uint16_t)m; |
552 | 510 | return (TIFFReadDirEntryErrOk); |
553 | 1.28k | } |
554 | 9.80k | case TIFF_SLONG8: |
555 | 9.80k | { |
556 | 9.80k | int64_t m; |
557 | 9.80k | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
558 | 9.80k | if (err != TIFFReadDirEntryErrOk) |
559 | 4.75k | return (err); |
560 | 5.05k | err = TIFFReadDirEntryCheckRangeShortSlong8(m); |
561 | 5.05k | if (err != TIFFReadDirEntryErrOk) |
562 | 4.12k | return (err); |
563 | 923 | *value = (uint16_t)m; |
564 | 923 | return (TIFFReadDirEntryErrOk); |
565 | 5.05k | } |
566 | 14.1k | default: |
567 | 14.1k | return (TIFFReadDirEntryErrType); |
568 | 4.27M | } |
569 | 4.27M | } /*-- TIFFReadDirEntryShort() --*/ |
570 | | |
571 | | static enum TIFFReadDirEntryErr |
572 | | TIFFReadDirEntrySshort(TIFF *tif, TIFFDirEntry *direntry, int16_t *value) |
573 | 0 | { |
574 | 0 | enum TIFFReadDirEntryErr err; |
575 | 0 | if (direntry->tdir_count != 1) |
576 | 0 | return (TIFFReadDirEntryErrCount); |
577 | 0 | switch (direntry->tdir_type) |
578 | 0 | { |
579 | 0 | case TIFF_BYTE: |
580 | 0 | { |
581 | 0 | uint8_t m; |
582 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
583 | 0 | *value = (int16_t)m; |
584 | 0 | return (TIFFReadDirEntryErrOk); |
585 | 0 | } |
586 | 0 | case TIFF_SBYTE: |
587 | 0 | { |
588 | 0 | int8_t m; |
589 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
590 | 0 | *value = (int16_t)m; |
591 | 0 | return (TIFFReadDirEntryErrOk); |
592 | 0 | } |
593 | 0 | case TIFF_SHORT: |
594 | 0 | { |
595 | 0 | uint16_t m; |
596 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
597 | 0 | err = TIFFReadDirEntryCheckRangeSshortShort(m); |
598 | 0 | if (err != TIFFReadDirEntryErrOk) |
599 | 0 | return (err); |
600 | 0 | *value = (int16_t)m; |
601 | 0 | return (TIFFReadDirEntryErrOk); |
602 | 0 | } |
603 | 0 | case TIFF_SSHORT: |
604 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, value); |
605 | 0 | return (TIFFReadDirEntryErrOk); |
606 | 0 | case TIFF_LONG: |
607 | 0 | { |
608 | 0 | uint32_t m; |
609 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
610 | 0 | err = TIFFReadDirEntryCheckRangeSshortLong(m); |
611 | 0 | if (err != TIFFReadDirEntryErrOk) |
612 | 0 | return (err); |
613 | 0 | *value = (int16_t)m; |
614 | 0 | return (TIFFReadDirEntryErrOk); |
615 | 0 | } |
616 | 0 | case TIFF_SLONG: |
617 | 0 | { |
618 | 0 | int32_t m; |
619 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
620 | 0 | err = TIFFReadDirEntryCheckRangeSshortSlong(m); |
621 | 0 | if (err != TIFFReadDirEntryErrOk) |
622 | 0 | return (err); |
623 | 0 | *value = (int16_t)m; |
624 | 0 | return (TIFFReadDirEntryErrOk); |
625 | 0 | } |
626 | 0 | case TIFF_LONG8: |
627 | 0 | { |
628 | 0 | uint64_t m; |
629 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
630 | 0 | if (err != TIFFReadDirEntryErrOk) |
631 | 0 | return (err); |
632 | 0 | err = TIFFReadDirEntryCheckRangeSshortLong8(m); |
633 | 0 | if (err != TIFFReadDirEntryErrOk) |
634 | 0 | return (err); |
635 | 0 | *value = (int16_t)m; |
636 | 0 | return (TIFFReadDirEntryErrOk); |
637 | 0 | } |
638 | 0 | case TIFF_SLONG8: |
639 | 0 | { |
640 | 0 | int64_t m; |
641 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
642 | 0 | if (err != TIFFReadDirEntryErrOk) |
643 | 0 | return (err); |
644 | 0 | err = TIFFReadDirEntryCheckRangeSshortSlong8(m); |
645 | 0 | if (err != TIFFReadDirEntryErrOk) |
646 | 0 | return (err); |
647 | 0 | *value = (int16_t)m; |
648 | 0 | return (TIFFReadDirEntryErrOk); |
649 | 0 | } |
650 | 0 | default: |
651 | 0 | return (TIFFReadDirEntryErrType); |
652 | 0 | } |
653 | 0 | } /*-- TIFFReadDirEntrySshort() --*/ |
654 | | |
655 | | static enum TIFFReadDirEntryErr |
656 | | TIFFReadDirEntryLong(TIFF *tif, TIFFDirEntry *direntry, uint32_t *value) |
657 | 3.91M | { |
658 | 3.91M | enum TIFFReadDirEntryErr err; |
659 | 3.91M | if (direntry->tdir_count != 1) |
660 | 28.2k | return (TIFFReadDirEntryErrCount); |
661 | 3.88M | switch (direntry->tdir_type) |
662 | 3.88M | { |
663 | 87.3k | case TIFF_BYTE: |
664 | 87.3k | { |
665 | 87.3k | uint8_t m; |
666 | 87.3k | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
667 | 87.3k | *value = (uint32_t)m; |
668 | 87.3k | return (TIFFReadDirEntryErrOk); |
669 | 0 | } |
670 | 21.7k | case TIFF_SBYTE: |
671 | 21.7k | { |
672 | 21.7k | int8_t m; |
673 | 21.7k | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
674 | 21.7k | err = TIFFReadDirEntryCheckRangeLongSbyte(m); |
675 | 21.7k | if (err != TIFFReadDirEntryErrOk) |
676 | 292 | return (err); |
677 | 21.4k | *value = (uint32_t)m; |
678 | 21.4k | return (TIFFReadDirEntryErrOk); |
679 | 21.7k | } |
680 | 3.61M | case TIFF_SHORT: |
681 | 3.61M | { |
682 | 3.61M | uint16_t m; |
683 | 3.61M | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
684 | 3.61M | *value = (uint32_t)m; |
685 | 3.61M | return (TIFFReadDirEntryErrOk); |
686 | 21.7k | } |
687 | 32.1k | case TIFF_SSHORT: |
688 | 32.1k | { |
689 | 32.1k | int16_t m; |
690 | 32.1k | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
691 | 32.1k | err = TIFFReadDirEntryCheckRangeLongSshort(m); |
692 | 32.1k | if (err != TIFFReadDirEntryErrOk) |
693 | 384 | return (err); |
694 | 31.7k | *value = (uint32_t)m; |
695 | 31.7k | return (TIFFReadDirEntryErrOk); |
696 | 32.1k | } |
697 | 83.5k | case TIFF_LONG: |
698 | 84.3k | case TIFF_IFD: |
699 | 84.3k | TIFFReadDirEntryCheckedLong(tif, direntry, value); |
700 | 84.3k | return (TIFFReadDirEntryErrOk); |
701 | 28.5k | case TIFF_SLONG: |
702 | 28.5k | { |
703 | 28.5k | int32_t m; |
704 | 28.5k | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
705 | 28.5k | err = TIFFReadDirEntryCheckRangeLongSlong(m); |
706 | 28.5k | if (err != TIFFReadDirEntryErrOk) |
707 | 460 | return (err); |
708 | 28.1k | *value = (uint32_t)m; |
709 | 28.1k | return (TIFFReadDirEntryErrOk); |
710 | 28.5k | } |
711 | 9.38k | case TIFF_LONG8: |
712 | 9.57k | case TIFF_IFD8: |
713 | 9.57k | { |
714 | 9.57k | uint64_t m; |
715 | 9.57k | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
716 | 9.57k | if (err != TIFFReadDirEntryErrOk) |
717 | 546 | return (err); |
718 | 9.02k | err = TIFFReadDirEntryCheckRangeLongLong8(m); |
719 | 9.02k | if (err != TIFFReadDirEntryErrOk) |
720 | 1.05k | return (err); |
721 | 7.97k | *value = (uint32_t)m; |
722 | 7.97k | return (TIFFReadDirEntryErrOk); |
723 | 9.02k | } |
724 | 3.37k | case TIFF_SLONG8: |
725 | 3.37k | { |
726 | 3.37k | int64_t m; |
727 | 3.37k | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
728 | 3.37k | if (err != TIFFReadDirEntryErrOk) |
729 | 513 | return (err); |
730 | 2.86k | err = TIFFReadDirEntryCheckRangeLongSlong8(m); |
731 | 2.86k | if (err != TIFFReadDirEntryErrOk) |
732 | 1.24k | return (err); |
733 | 1.61k | *value = (uint32_t)m; |
734 | 1.61k | return (TIFFReadDirEntryErrOk); |
735 | 2.86k | } |
736 | 3.70k | default: |
737 | 3.70k | return (TIFFReadDirEntryErrType); |
738 | 3.88M | } |
739 | 3.88M | } /*-- TIFFReadDirEntryLong() --*/ |
740 | | |
741 | | static enum TIFFReadDirEntryErr |
742 | | TIFFReadDirEntrySlong(TIFF *tif, TIFFDirEntry *direntry, int32_t *value) |
743 | 0 | { |
744 | 0 | enum TIFFReadDirEntryErr err; |
745 | 0 | if (direntry->tdir_count != 1) |
746 | 0 | return (TIFFReadDirEntryErrCount); |
747 | 0 | switch (direntry->tdir_type) |
748 | 0 | { |
749 | 0 | case TIFF_BYTE: |
750 | 0 | { |
751 | 0 | uint8_t m; |
752 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
753 | 0 | *value = (int32_t)m; |
754 | 0 | return (TIFFReadDirEntryErrOk); |
755 | 0 | } |
756 | 0 | case TIFF_SBYTE: |
757 | 0 | { |
758 | 0 | int8_t m; |
759 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
760 | 0 | *value = (int32_t)m; |
761 | 0 | return (TIFFReadDirEntryErrOk); |
762 | 0 | } |
763 | 0 | case TIFF_SHORT: |
764 | 0 | { |
765 | 0 | uint16_t m; |
766 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
767 | 0 | *value = (int32_t)m; |
768 | 0 | return (TIFFReadDirEntryErrOk); |
769 | 0 | } |
770 | 0 | case TIFF_SSHORT: |
771 | 0 | { |
772 | 0 | int16_t m; |
773 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
774 | 0 | *value = (int32_t)m; |
775 | 0 | return (TIFFReadDirEntryErrOk); |
776 | 0 | } |
777 | 0 | case TIFF_LONG: |
778 | 0 | { |
779 | 0 | uint32_t m; |
780 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
781 | 0 | err = TIFFReadDirEntryCheckRangeSlongLong(m); |
782 | 0 | if (err != TIFFReadDirEntryErrOk) |
783 | 0 | return (err); |
784 | 0 | *value = (int32_t)m; |
785 | 0 | return (TIFFReadDirEntryErrOk); |
786 | 0 | } |
787 | 0 | case TIFF_SLONG: |
788 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, value); |
789 | 0 | return (TIFFReadDirEntryErrOk); |
790 | 0 | case TIFF_LONG8: |
791 | 0 | { |
792 | 0 | uint64_t m; |
793 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
794 | 0 | if (err != TIFFReadDirEntryErrOk) |
795 | 0 | return (err); |
796 | 0 | err = TIFFReadDirEntryCheckRangeSlongLong8(m); |
797 | 0 | if (err != TIFFReadDirEntryErrOk) |
798 | 0 | return (err); |
799 | 0 | *value = (int32_t)m; |
800 | 0 | return (TIFFReadDirEntryErrOk); |
801 | 0 | } |
802 | 0 | case TIFF_SLONG8: |
803 | 0 | { |
804 | 0 | int64_t m; |
805 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
806 | 0 | if (err != TIFFReadDirEntryErrOk) |
807 | 0 | return (err); |
808 | 0 | err = TIFFReadDirEntryCheckRangeSlongSlong8(m); |
809 | 0 | if (err != TIFFReadDirEntryErrOk) |
810 | 0 | return (err); |
811 | 0 | *value = (int32_t)m; |
812 | 0 | return (TIFFReadDirEntryErrOk); |
813 | 0 | } |
814 | 0 | default: |
815 | 0 | return (TIFFReadDirEntryErrType); |
816 | 0 | } |
817 | 0 | } /*-- TIFFReadDirEntrySlong() --*/ |
818 | | |
819 | | static enum TIFFReadDirEntryErr |
820 | | TIFFReadDirEntryLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value) |
821 | 34.6k | { |
822 | 34.6k | enum TIFFReadDirEntryErr err; |
823 | 34.6k | if (direntry->tdir_count != 1) |
824 | 13.9k | return (TIFFReadDirEntryErrCount); |
825 | 20.7k | switch (direntry->tdir_type) |
826 | 20.7k | { |
827 | 1.14k | case TIFF_BYTE: |
828 | 1.14k | { |
829 | 1.14k | uint8_t m; |
830 | 1.14k | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
831 | 1.14k | *value = (uint64_t)m; |
832 | 1.14k | return (TIFFReadDirEntryErrOk); |
833 | 0 | } |
834 | 2.03k | case TIFF_SBYTE: |
835 | 2.03k | { |
836 | 2.03k | int8_t m; |
837 | 2.03k | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
838 | 2.03k | err = TIFFReadDirEntryCheckRangeLong8Sbyte(m); |
839 | 2.03k | if (err != TIFFReadDirEntryErrOk) |
840 | 475 | return (err); |
841 | 1.55k | *value = (uint64_t)m; |
842 | 1.55k | return (TIFFReadDirEntryErrOk); |
843 | 2.03k | } |
844 | 3.51k | case TIFF_SHORT: |
845 | 3.51k | { |
846 | 3.51k | uint16_t m; |
847 | 3.51k | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
848 | 3.51k | *value = (uint64_t)m; |
849 | 3.51k | return (TIFFReadDirEntryErrOk); |
850 | 2.03k | } |
851 | 1.13k | case TIFF_SSHORT: |
852 | 1.13k | { |
853 | 1.13k | int16_t m; |
854 | 1.13k | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
855 | 1.13k | err = TIFFReadDirEntryCheckRangeLong8Sshort(m); |
856 | 1.13k | if (err != TIFFReadDirEntryErrOk) |
857 | 334 | return (err); |
858 | 802 | *value = (uint64_t)m; |
859 | 802 | return (TIFFReadDirEntryErrOk); |
860 | 1.13k | } |
861 | 1.64k | case TIFF_LONG: |
862 | 2.15k | case TIFF_IFD: |
863 | 2.15k | { |
864 | 2.15k | uint32_t m; |
865 | 2.15k | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
866 | 2.15k | *value = (uint64_t)m; |
867 | 2.15k | return (TIFFReadDirEntryErrOk); |
868 | 1.64k | } |
869 | 2.92k | case TIFF_SLONG: |
870 | 2.92k | { |
871 | 2.92k | int32_t m; |
872 | 2.92k | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
873 | 2.92k | err = TIFFReadDirEntryCheckRangeLong8Slong(m); |
874 | 2.92k | if (err != TIFFReadDirEntryErrOk) |
875 | 643 | return (err); |
876 | 2.28k | *value = (uint64_t)m; |
877 | 2.28k | return (TIFFReadDirEntryErrOk); |
878 | 2.92k | } |
879 | 2.64k | case TIFF_LONG8: |
880 | 3.04k | case TIFF_IFD8: |
881 | 3.04k | err = TIFFReadDirEntryCheckedLong8(tif, direntry, value); |
882 | 3.04k | return (err); |
883 | 3.75k | case TIFF_SLONG8: |
884 | 3.75k | { |
885 | 3.75k | int64_t m; |
886 | 3.75k | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
887 | 3.75k | if (err != TIFFReadDirEntryErrOk) |
888 | 1.04k | return (err); |
889 | 2.71k | err = TIFFReadDirEntryCheckRangeLong8Slong8(m); |
890 | 2.71k | if (err != TIFFReadDirEntryErrOk) |
891 | 1.25k | return (err); |
892 | 1.45k | *value = (uint64_t)m; |
893 | 1.45k | return (TIFFReadDirEntryErrOk); |
894 | 2.71k | } |
895 | 987 | default: |
896 | 987 | return (TIFFReadDirEntryErrType); |
897 | 20.7k | } |
898 | 20.7k | } /*-- TIFFReadDirEntryLong8() --*/ |
899 | | |
900 | | static enum TIFFReadDirEntryErr |
901 | | TIFFReadDirEntrySlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value) |
902 | 0 | { |
903 | 0 | enum TIFFReadDirEntryErr err; |
904 | 0 | if (direntry->tdir_count != 1) |
905 | 0 | return (TIFFReadDirEntryErrCount); |
906 | 0 | switch (direntry->tdir_type) |
907 | 0 | { |
908 | 0 | case TIFF_BYTE: |
909 | 0 | { |
910 | 0 | uint8_t m; |
911 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
912 | 0 | *value = (int64_t)m; |
913 | 0 | return (TIFFReadDirEntryErrOk); |
914 | 0 | } |
915 | 0 | case TIFF_SBYTE: |
916 | 0 | { |
917 | 0 | int8_t m; |
918 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
919 | 0 | *value = (int64_t)m; |
920 | 0 | return (TIFFReadDirEntryErrOk); |
921 | 0 | } |
922 | 0 | case TIFF_SHORT: |
923 | 0 | { |
924 | 0 | uint16_t m; |
925 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
926 | 0 | *value = (int64_t)m; |
927 | 0 | return (TIFFReadDirEntryErrOk); |
928 | 0 | } |
929 | 0 | case TIFF_SSHORT: |
930 | 0 | { |
931 | 0 | int16_t m; |
932 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
933 | 0 | *value = (int64_t)m; |
934 | 0 | return (TIFFReadDirEntryErrOk); |
935 | 0 | } |
936 | 0 | case TIFF_LONG: |
937 | 0 | { |
938 | 0 | uint32_t m; |
939 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
940 | 0 | *value = (int64_t)m; |
941 | 0 | return (TIFFReadDirEntryErrOk); |
942 | 0 | } |
943 | 0 | case TIFF_SLONG: |
944 | 0 | { |
945 | 0 | int32_t m; |
946 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
947 | 0 | *value = (int64_t)m; |
948 | 0 | return (TIFFReadDirEntryErrOk); |
949 | 0 | } |
950 | 0 | case TIFF_LONG8: |
951 | 0 | { |
952 | 0 | uint64_t m; |
953 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
954 | 0 | if (err != TIFFReadDirEntryErrOk) |
955 | 0 | return (err); |
956 | 0 | err = TIFFReadDirEntryCheckRangeSlong8Long8(m); |
957 | 0 | if (err != TIFFReadDirEntryErrOk) |
958 | 0 | return (err); |
959 | 0 | *value = (int64_t)m; |
960 | 0 | return (TIFFReadDirEntryErrOk); |
961 | 0 | } |
962 | 0 | case TIFF_SLONG8: |
963 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, value); |
964 | 0 | return (err); |
965 | 0 | default: |
966 | 0 | return (TIFFReadDirEntryErrType); |
967 | 0 | } |
968 | 0 | } /*-- TIFFReadDirEntrySlong8() --*/ |
969 | | |
970 | | static enum TIFFReadDirEntryErr |
971 | | TIFFReadDirEntryFloat(TIFF *tif, TIFFDirEntry *direntry, float *value) |
972 | 126k | { |
973 | 126k | enum TIFFReadDirEntryErr err; |
974 | 126k | if (direntry->tdir_count != 1) |
975 | 44.2k | return (TIFFReadDirEntryErrCount); |
976 | 82.1k | switch (direntry->tdir_type) |
977 | 82.1k | { |
978 | 1.21k | case TIFF_BYTE: |
979 | 1.21k | { |
980 | 1.21k | uint8_t m; |
981 | 1.21k | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
982 | 1.21k | *value = (float)m; |
983 | 1.21k | return (TIFFReadDirEntryErrOk); |
984 | 0 | } |
985 | 1.13k | case TIFF_SBYTE: |
986 | 1.13k | { |
987 | 1.13k | int8_t m; |
988 | 1.13k | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
989 | 1.13k | *value = (float)m; |
990 | 1.13k | return (TIFFReadDirEntryErrOk); |
991 | 0 | } |
992 | 21.6k | case TIFF_SHORT: |
993 | 21.6k | { |
994 | 21.6k | uint16_t m; |
995 | 21.6k | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
996 | 21.6k | *value = (float)m; |
997 | 21.6k | return (TIFFReadDirEntryErrOk); |
998 | 0 | } |
999 | 10.7k | case TIFF_SSHORT: |
1000 | 10.7k | { |
1001 | 10.7k | int16_t m; |
1002 | 10.7k | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
1003 | 10.7k | *value = (float)m; |
1004 | 10.7k | return (TIFFReadDirEntryErrOk); |
1005 | 0 | } |
1006 | 5.83k | case TIFF_LONG: |
1007 | 5.83k | { |
1008 | 5.83k | uint32_t m; |
1009 | 5.83k | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
1010 | 5.83k | *value = (float)m; |
1011 | 5.83k | return (TIFFReadDirEntryErrOk); |
1012 | 0 | } |
1013 | 1.22k | case TIFF_SLONG: |
1014 | 1.22k | { |
1015 | 1.22k | int32_t m; |
1016 | 1.22k | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
1017 | 1.22k | *value = (float)m; |
1018 | 1.22k | return (TIFFReadDirEntryErrOk); |
1019 | 0 | } |
1020 | 1.67k | case TIFF_LONG8: |
1021 | 1.67k | { |
1022 | 1.67k | uint64_t m; |
1023 | 1.67k | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
1024 | 1.67k | if (err != TIFFReadDirEntryErrOk) |
1025 | 698 | return (err); |
1026 | 977 | *value = (float)m; |
1027 | 977 | return (TIFFReadDirEntryErrOk); |
1028 | 1.67k | } |
1029 | 1.30k | case TIFF_SLONG8: |
1030 | 1.30k | { |
1031 | 1.30k | int64_t m; |
1032 | 1.30k | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
1033 | 1.30k | if (err != TIFFReadDirEntryErrOk) |
1034 | 642 | return (err); |
1035 | 659 | *value = (float)m; |
1036 | 659 | return (TIFFReadDirEntryErrOk); |
1037 | 1.30k | } |
1038 | 21.4k | case TIFF_RATIONAL: |
1039 | 21.4k | { |
1040 | 21.4k | double m; |
1041 | 21.4k | err = TIFFReadDirEntryCheckedRational(tif, direntry, &m); |
1042 | 21.4k | if (err != TIFFReadDirEntryErrOk) |
1043 | 4.64k | return (err); |
1044 | 16.8k | *value = (float)m; |
1045 | 16.8k | return (TIFFReadDirEntryErrOk); |
1046 | 21.4k | } |
1047 | 6.21k | case TIFF_SRATIONAL: |
1048 | 6.21k | { |
1049 | 6.21k | double m; |
1050 | 6.21k | err = TIFFReadDirEntryCheckedSrational(tif, direntry, &m); |
1051 | 6.21k | if (err != TIFFReadDirEntryErrOk) |
1052 | 2.50k | return (err); |
1053 | 3.71k | *value = (float)m; |
1054 | 3.71k | return (TIFFReadDirEntryErrOk); |
1055 | 6.21k | } |
1056 | 1.45k | case TIFF_FLOAT: |
1057 | 1.45k | TIFFReadDirEntryCheckedFloat(tif, direntry, value); |
1058 | 1.45k | return (TIFFReadDirEntryErrOk); |
1059 | 3.07k | case TIFF_DOUBLE: |
1060 | 3.07k | { |
1061 | 3.07k | double m; |
1062 | 3.07k | err = TIFFReadDirEntryCheckedDouble(tif, direntry, &m); |
1063 | 3.07k | if (err != TIFFReadDirEntryErrOk) |
1064 | 712 | return (err); |
1065 | 2.36k | if ((m > (double)FLT_MAX) || (m < -(double)FLT_MAX)) |
1066 | 894 | return (TIFFReadDirEntryErrRange); |
1067 | 1.46k | *value = (float)m; |
1068 | 1.46k | return (TIFFReadDirEntryErrOk); |
1069 | 2.36k | } |
1070 | 5.19k | default: |
1071 | 5.19k | return (TIFFReadDirEntryErrType); |
1072 | 82.1k | } |
1073 | 82.1k | } |
1074 | | |
1075 | | static enum TIFFReadDirEntryErr |
1076 | | TIFFReadDirEntryDouble(TIFF *tif, TIFFDirEntry *direntry, double *value) |
1077 | 7.77k | { |
1078 | 7.77k | enum TIFFReadDirEntryErr err; |
1079 | 7.77k | if (direntry->tdir_count != 1) |
1080 | 895 | return (TIFFReadDirEntryErrCount); |
1081 | 6.87k | switch (direntry->tdir_type) |
1082 | 6.87k | { |
1083 | 408 | case TIFF_BYTE: |
1084 | 408 | { |
1085 | 408 | uint8_t m; |
1086 | 408 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
1087 | 408 | *value = (double)m; |
1088 | 408 | return (TIFFReadDirEntryErrOk); |
1089 | 0 | } |
1090 | 337 | case TIFF_SBYTE: |
1091 | 337 | { |
1092 | 337 | int8_t m; |
1093 | 337 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
1094 | 337 | *value = (double)m; |
1095 | 337 | return (TIFFReadDirEntryErrOk); |
1096 | 0 | } |
1097 | 788 | case TIFF_SHORT: |
1098 | 788 | { |
1099 | 788 | uint16_t m; |
1100 | 788 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
1101 | 788 | *value = (double)m; |
1102 | 788 | return (TIFFReadDirEntryErrOk); |
1103 | 0 | } |
1104 | 381 | case TIFF_SSHORT: |
1105 | 381 | { |
1106 | 381 | int16_t m; |
1107 | 381 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
1108 | 381 | *value = (double)m; |
1109 | 381 | return (TIFFReadDirEntryErrOk); |
1110 | 0 | } |
1111 | 106 | case TIFF_LONG: |
1112 | 106 | { |
1113 | 106 | uint32_t m; |
1114 | 106 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
1115 | 106 | *value = (double)m; |
1116 | 106 | return (TIFFReadDirEntryErrOk); |
1117 | 0 | } |
1118 | 407 | case TIFF_SLONG: |
1119 | 407 | { |
1120 | 407 | int32_t m; |
1121 | 407 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
1122 | 407 | *value = (double)m; |
1123 | 407 | return (TIFFReadDirEntryErrOk); |
1124 | 0 | } |
1125 | 1.29k | case TIFF_LONG8: |
1126 | 1.29k | { |
1127 | 1.29k | uint64_t m; |
1128 | 1.29k | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
1129 | 1.29k | if (err != TIFFReadDirEntryErrOk) |
1130 | 679 | return (err); |
1131 | 613 | *value = (double)m; |
1132 | 613 | return (TIFFReadDirEntryErrOk); |
1133 | 1.29k | } |
1134 | 1.13k | case TIFF_SLONG8: |
1135 | 1.13k | { |
1136 | 1.13k | int64_t m; |
1137 | 1.13k | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
1138 | 1.13k | if (err != TIFFReadDirEntryErrOk) |
1139 | 561 | return (err); |
1140 | 569 | *value = (double)m; |
1141 | 569 | return (TIFFReadDirEntryErrOk); |
1142 | 1.13k | } |
1143 | 479 | case TIFF_RATIONAL: |
1144 | 479 | err = TIFFReadDirEntryCheckedRational(tif, direntry, value); |
1145 | 479 | return (err); |
1146 | 362 | case TIFF_SRATIONAL: |
1147 | 362 | err = TIFFReadDirEntryCheckedSrational(tif, direntry, value); |
1148 | 362 | return (err); |
1149 | 152 | case TIFF_FLOAT: |
1150 | 152 | { |
1151 | 152 | float m; |
1152 | 152 | TIFFReadDirEntryCheckedFloat(tif, direntry, &m); |
1153 | 152 | *value = (double)m; |
1154 | 152 | return (TIFFReadDirEntryErrOk); |
1155 | 1.13k | } |
1156 | 414 | case TIFF_DOUBLE: |
1157 | 414 | err = TIFFReadDirEntryCheckedDouble(tif, direntry, value); |
1158 | 414 | return (err); |
1159 | 623 | default: |
1160 | 623 | return (TIFFReadDirEntryErrType); |
1161 | 6.87k | } |
1162 | 6.87k | } |
1163 | | |
1164 | | static enum TIFFReadDirEntryErr |
1165 | | TIFFReadDirEntryIfd8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value) |
1166 | 9.34k | { |
1167 | 9.34k | enum TIFFReadDirEntryErr err; |
1168 | 9.34k | if (direntry->tdir_count != 1) |
1169 | 5.55k | return (TIFFReadDirEntryErrCount); |
1170 | 3.79k | switch (direntry->tdir_type) |
1171 | 3.79k | { |
1172 | 367 | case TIFF_LONG: |
1173 | 1.04k | case TIFF_IFD: |
1174 | 1.04k | { |
1175 | 1.04k | uint32_t m; |
1176 | 1.04k | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
1177 | 1.04k | *value = (uint64_t)m; |
1178 | 1.04k | return (TIFFReadDirEntryErrOk); |
1179 | 367 | } |
1180 | 620 | case TIFF_LONG8: |
1181 | 890 | case TIFF_IFD8: |
1182 | 890 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, value); |
1183 | 890 | return (err); |
1184 | 1.85k | default: |
1185 | 1.85k | return (TIFFReadDirEntryErrType); |
1186 | 3.79k | } |
1187 | 3.79k | } |
1188 | | |
1189 | 1.81M | #define INITIAL_THRESHOLD (1024 * 1024) |
1190 | 938k | #define THRESHOLD_MULTIPLIER 10 |
1191 | | #define MAX_THRESHOLD \ |
1192 | 234k | (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * \ |
1193 | 234k | INITIAL_THRESHOLD) |
1194 | | |
1195 | | static enum TIFFReadDirEntryErr TIFFReadDirEntryDataAndRealloc(TIFF *tif, |
1196 | | uint64_t offset, |
1197 | | tmsize_t size, |
1198 | | void **pdest) |
1199 | 1.57M | { |
1200 | 1.57M | #if SIZEOF_SIZE_T == 8 |
1201 | 1.57M | tmsize_t threshold = INITIAL_THRESHOLD; |
1202 | 1.57M | #endif |
1203 | 1.57M | tmsize_t already_read = 0; |
1204 | | |
1205 | 1.57M | assert(!isMapped(tif)); |
1206 | | |
1207 | 1.57M | if (!SeekOK(tif, offset)) |
1208 | 104 | return (TIFFReadDirEntryErrIo); |
1209 | | |
1210 | | /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */ |
1211 | | /* so as to avoid allocating too much memory in case the file is too */ |
1212 | | /* short. We could ask for the file size, but this might be */ |
1213 | | /* expensive with some I/O layers (think of reading a gzipped file) */ |
1214 | | /* Restrict to 64 bit processes, so as to avoid reallocs() */ |
1215 | | /* on 32 bit processes where virtual memory is scarce. */ |
1216 | 2.62M | while (already_read < size) |
1217 | 1.57M | { |
1218 | 1.57M | void *new_dest; |
1219 | 1.57M | tmsize_t bytes_read; |
1220 | 1.57M | tmsize_t to_read = size - already_read; |
1221 | 1.57M | #if SIZEOF_SIZE_T == 8 |
1222 | 1.57M | if (to_read >= threshold && threshold < MAX_THRESHOLD) |
1223 | 234k | { |
1224 | 234k | to_read = threshold; |
1225 | 234k | threshold *= THRESHOLD_MULTIPLIER; |
1226 | 234k | } |
1227 | 1.57M | #endif |
1228 | | |
1229 | 1.57M | new_dest = |
1230 | 1.57M | (uint8_t *)_TIFFreallocExt(tif, *pdest, already_read + to_read); |
1231 | 1.57M | if (new_dest == NULL) |
1232 | 0 | { |
1233 | 0 | TIFFErrorExtR(tif, tif->tif_name, |
1234 | 0 | "Failed to allocate memory for %s " |
1235 | 0 | "(%" TIFF_SSIZE_FORMAT |
1236 | 0 | " elements of %" TIFF_SSIZE_FORMAT " bytes each)", |
1237 | 0 | "TIFFReadDirEntryArray", (tmsize_t)1, |
1238 | 0 | already_read + to_read); |
1239 | 0 | return TIFFReadDirEntryErrAlloc; |
1240 | 0 | } |
1241 | 1.57M | *pdest = new_dest; |
1242 | | |
1243 | 1.57M | bytes_read = TIFFReadFile(tif, (char *)*pdest + already_read, to_read); |
1244 | 1.57M | if (bytes_read < 0) |
1245 | 0 | return TIFFReadDirEntryErrIo; |
1246 | 1.57M | already_read += bytes_read; |
1247 | 1.57M | if (bytes_read != to_read) |
1248 | 522k | { |
1249 | 522k | return TIFFReadDirEntryErrIo; |
1250 | 522k | } |
1251 | 1.57M | } |
1252 | 1.05M | return TIFFReadDirEntryErrOk; |
1253 | 1.57M | } |
1254 | | |
1255 | | /* Caution: if raising that value, make sure int32 / uint32 overflows can't |
1256 | | * occur elsewhere */ |
1257 | 9.10M | #define MAX_SIZE_TAG_DATA 2147483647U |
1258 | | |
1259 | | static enum TIFFReadDirEntryErr |
1260 | | TIFFReadDirEntryArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry, |
1261 | | uint32_t *count, uint32_t desttypesize, |
1262 | | void **value, uint64_t maxcount) |
1263 | 4.88M | { |
1264 | 4.88M | int typesize; |
1265 | 4.88M | uint32_t datasize; |
1266 | 4.88M | void *data; |
1267 | 4.88M | uint64_t target_count64; |
1268 | 4.88M | int original_datasize_clamped; |
1269 | 4.88M | typesize = TIFFDataWidth((TIFFDataType)direntry->tdir_type); |
1270 | | |
1271 | 4.88M | target_count64 = |
1272 | 4.88M | (direntry->tdir_count > maxcount) ? maxcount : direntry->tdir_count; |
1273 | | |
1274 | 4.88M | if ((target_count64 == 0) || (typesize == 0)) |
1275 | 155k | { |
1276 | 155k | *value = 0; |
1277 | 155k | return (TIFFReadDirEntryErrOk); |
1278 | 155k | } |
1279 | 4.72M | (void)desttypesize; |
1280 | | |
1281 | | /* We just want to know if the original tag size is more than 4 bytes |
1282 | | * (classic TIFF) or 8 bytes (BigTIFF) |
1283 | | */ |
1284 | 4.72M | original_datasize_clamped = |
1285 | 4.72M | ((direntry->tdir_count > 10) ? 10 : (int)direntry->tdir_count) * |
1286 | 4.72M | typesize; |
1287 | | |
1288 | | /* |
1289 | | * As a sanity check, make sure we have no more than a 2GB tag array |
1290 | | * in either the current data type or the dest data type. This also |
1291 | | * avoids problems with overflow of tmsize_t on 32bit systems. |
1292 | | */ |
1293 | 4.72M | if ((uint64_t)(MAX_SIZE_TAG_DATA / (unsigned int)typesize) < target_count64) |
1294 | 345k | return (TIFFReadDirEntryErrSizesan); |
1295 | 4.38M | if ((uint64_t)(MAX_SIZE_TAG_DATA / desttypesize) < target_count64) |
1296 | 3.40k | return (TIFFReadDirEntryErrSizesan); |
1297 | | |
1298 | 4.37M | *count = (uint32_t)target_count64; |
1299 | 4.37M | datasize = (uint32_t)(*count) * (unsigned int)typesize; |
1300 | 4.37M | assert((tmsize_t)datasize > 0); |
1301 | | |
1302 | 4.37M | if (datasize > 100 * 1024 * 1024) |
1303 | 356k | { |
1304 | | /* Before allocating a huge amount of memory for corrupted files, check |
1305 | | * if size of requested memory is not greater than file size. |
1306 | | */ |
1307 | 356k | const uint64_t filesize = TIFFGetFileSize(tif); |
1308 | 356k | if (datasize > filesize) |
1309 | 356k | { |
1310 | 356k | TIFFWarningExtR(tif, "ReadDirEntryArray", |
1311 | 356k | "Requested memory size for tag %d (0x%x) %" PRIu32 |
1312 | 356k | " is greater than filesize %" PRIu64 |
1313 | 356k | ". Memory not allocated, tag not read", |
1314 | 356k | direntry->tdir_tag, direntry->tdir_tag, datasize, |
1315 | 356k | filesize); |
1316 | 356k | return (TIFFReadDirEntryErrAlloc); |
1317 | 356k | } |
1318 | 356k | } |
1319 | | |
1320 | 4.02M | if (isMapped(tif) && datasize > (uint64_t)tif->tif_size) |
1321 | 231k | return TIFFReadDirEntryErrIo; |
1322 | | |
1323 | 3.78M | if (!isMapped(tif) && (((tif->tif_flags & TIFF_BIGTIFF) && datasize > 8) || |
1324 | 3.18M | (!(tif->tif_flags & TIFF_BIGTIFF) && datasize > 4))) |
1325 | 1.51M | { |
1326 | 1.51M | data = NULL; |
1327 | 1.51M | } |
1328 | 2.27M | else |
1329 | 2.27M | { |
1330 | 2.27M | data = _TIFFCheckMalloc(tif, *count, typesize, "ReadDirEntryArray"); |
1331 | 2.27M | if (data == 0) |
1332 | 0 | return (TIFFReadDirEntryErrAlloc); |
1333 | 2.27M | } |
1334 | 3.78M | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
1335 | 3.78M | { |
1336 | | /* Only the condition on original_datasize_clamped. The second |
1337 | | * one is implied, but Coverity Scan cannot see it. */ |
1338 | 3.78M | if (original_datasize_clamped <= 4 && datasize <= 4) |
1339 | 1.88M | _TIFFmemcpy(data, &direntry->tdir_offset, datasize); |
1340 | 1.90M | else |
1341 | 1.90M | { |
1342 | 1.90M | enum TIFFReadDirEntryErr err; |
1343 | 1.90M | uint32_t offset = direntry->tdir_offset.toff_long; |
1344 | 1.90M | if (tif->tif_flags & TIFF_SWAB) |
1345 | 9.08k | TIFFSwabLong(&offset); |
1346 | 1.90M | if (isMapped(tif)) |
1347 | 326k | err = TIFFReadDirEntryData(tif, (uint64_t)offset, |
1348 | 326k | (tmsize_t)datasize, data); |
1349 | 1.57M | else |
1350 | 1.57M | err = TIFFReadDirEntryDataAndRealloc(tif, (uint64_t)offset, |
1351 | 1.57M | (tmsize_t)datasize, &data); |
1352 | 1.90M | if (err != TIFFReadDirEntryErrOk) |
1353 | 570k | { |
1354 | 570k | _TIFFfreeExt(tif, data); |
1355 | 570k | return (err); |
1356 | 570k | } |
1357 | 1.90M | } |
1358 | 3.78M | } |
1359 | 3.82k | else |
1360 | 3.82k | { |
1361 | | /* See above comment for the Classic TIFF case */ |
1362 | 3.82k | if (original_datasize_clamped <= 8 && datasize <= 8) |
1363 | 1.88k | _TIFFmemcpy(data, &direntry->tdir_offset, datasize); |
1364 | 1.93k | else |
1365 | 1.93k | { |
1366 | 1.93k | enum TIFFReadDirEntryErr err; |
1367 | 1.93k | uint64_t offset = direntry->tdir_offset.toff_long8; |
1368 | 1.93k | if (tif->tif_flags & TIFF_SWAB) |
1369 | 1.14k | TIFFSwabLong8(&offset); |
1370 | 1.93k | if (isMapped(tif)) |
1371 | 1.09k | err = TIFFReadDirEntryData(tif, (uint64_t)offset, |
1372 | 1.09k | (tmsize_t)datasize, data); |
1373 | 843 | else |
1374 | 843 | err = TIFFReadDirEntryDataAndRealloc(tif, (uint64_t)offset, |
1375 | 843 | (tmsize_t)datasize, &data); |
1376 | 1.93k | if (err != TIFFReadDirEntryErrOk) |
1377 | 458 | { |
1378 | 458 | _TIFFfreeExt(tif, data); |
1379 | 458 | return (err); |
1380 | 458 | } |
1381 | 1.93k | } |
1382 | 3.82k | } |
1383 | 3.21M | *value = data; |
1384 | 3.21M | return (TIFFReadDirEntryErrOk); |
1385 | 3.78M | } |
1386 | | |
1387 | | static enum TIFFReadDirEntryErr |
1388 | | TIFFReadDirEntryArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t *count, |
1389 | | uint32_t desttypesize, void **value) |
1390 | 3.44M | { |
1391 | 3.44M | return TIFFReadDirEntryArrayWithLimit(tif, direntry, count, desttypesize, |
1392 | 3.44M | value, ~((uint64_t)0)); |
1393 | 3.44M | } |
1394 | | |
1395 | | static enum TIFFReadDirEntryErr |
1396 | | TIFFReadDirEntryByteArray(TIFF *tif, TIFFDirEntry *direntry, uint8_t **value) |
1397 | 1.30M | { |
1398 | 1.30M | enum TIFFReadDirEntryErr err; |
1399 | 1.30M | uint32_t count; |
1400 | 1.30M | void *origdata; |
1401 | 1.30M | uint8_t *data; |
1402 | 1.30M | switch (direntry->tdir_type) |
1403 | 1.30M | { |
1404 | 395k | case TIFF_ASCII: |
1405 | 613k | case TIFF_UNDEFINED: |
1406 | 1.16M | case TIFF_BYTE: |
1407 | 1.17M | case TIFF_SBYTE: |
1408 | 1.20M | case TIFF_SHORT: |
1409 | 1.20M | case TIFF_SSHORT: |
1410 | 1.21M | case TIFF_LONG: |
1411 | 1.22M | case TIFF_SLONG: |
1412 | 1.22M | case TIFF_LONG8: |
1413 | 1.23M | case TIFF_SLONG8: |
1414 | 1.23M | break; |
1415 | 70.4k | default: |
1416 | 70.4k | return (TIFFReadDirEntryErrType); |
1417 | 1.30M | } |
1418 | 1.23M | err = TIFFReadDirEntryArray(tif, direntry, &count, 1, &origdata); |
1419 | 1.23M | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
1420 | 686k | { |
1421 | 686k | *value = 0; |
1422 | 686k | return (err); |
1423 | 686k | } |
1424 | 544k | switch (direntry->tdir_type) |
1425 | 544k | { |
1426 | 264k | case TIFF_ASCII: |
1427 | 453k | case TIFF_UNDEFINED: |
1428 | 495k | case TIFF_BYTE: |
1429 | 495k | *value = (uint8_t *)origdata; |
1430 | 495k | return (TIFFReadDirEntryErrOk); |
1431 | 2.74k | case TIFF_SBYTE: |
1432 | 2.74k | { |
1433 | 2.74k | int8_t *m; |
1434 | 2.74k | uint32_t n; |
1435 | 2.74k | m = (int8_t *)origdata; |
1436 | 17.6k | for (n = 0; n < count; n++) |
1437 | 16.2k | { |
1438 | 16.2k | err = TIFFReadDirEntryCheckRangeByteSbyte(*m); |
1439 | 16.2k | if (err != TIFFReadDirEntryErrOk) |
1440 | 1.34k | { |
1441 | 1.34k | _TIFFfreeExt(tif, origdata); |
1442 | 1.34k | return (err); |
1443 | 1.34k | } |
1444 | 14.8k | m++; |
1445 | 14.8k | } |
1446 | 1.40k | *value = (uint8_t *)origdata; |
1447 | 1.40k | return (TIFFReadDirEntryErrOk); |
1448 | 2.74k | } |
1449 | 46.9k | default: |
1450 | 46.9k | break; |
1451 | 544k | } |
1452 | 46.9k | data = (uint8_t *)_TIFFmallocExt(tif, count); |
1453 | 46.9k | if (data == 0) |
1454 | 0 | { |
1455 | 0 | _TIFFfreeExt(tif, origdata); |
1456 | 0 | return (TIFFReadDirEntryErrAlloc); |
1457 | 0 | } |
1458 | 46.9k | switch (direntry->tdir_type) |
1459 | 46.9k | { |
1460 | 21.3k | case TIFF_SHORT: |
1461 | 21.3k | { |
1462 | 21.3k | uint16_t *ma; |
1463 | 21.3k | uint8_t *mb; |
1464 | 21.3k | uint32_t n; |
1465 | 21.3k | ma = (uint16_t *)origdata; |
1466 | 21.3k | mb = data; |
1467 | 41.1k | for (n = 0; n < count; n++) |
1468 | 29.6k | { |
1469 | 29.6k | if (tif->tif_flags & TIFF_SWAB) |
1470 | 567 | TIFFSwabShort(ma); |
1471 | 29.6k | err = TIFFReadDirEntryCheckRangeByteShort(*ma); |
1472 | 29.6k | if (err != TIFFReadDirEntryErrOk) |
1473 | 9.88k | break; |
1474 | 19.7k | *mb++ = (uint8_t)(*ma++); |
1475 | 19.7k | } |
1476 | 21.3k | } |
1477 | 21.3k | break; |
1478 | 5.46k | case TIFF_SSHORT: |
1479 | 5.46k | { |
1480 | 5.46k | int16_t *ma; |
1481 | 5.46k | uint8_t *mb; |
1482 | 5.46k | uint32_t n; |
1483 | 5.46k | ma = (int16_t *)origdata; |
1484 | 5.46k | mb = data; |
1485 | 22.9k | for (n = 0; n < count; n++) |
1486 | 18.6k | { |
1487 | 18.6k | if (tif->tif_flags & TIFF_SWAB) |
1488 | 470 | TIFFSwabShort((uint16_t *)ma); |
1489 | 18.6k | err = TIFFReadDirEntryCheckRangeByteSshort(*ma); |
1490 | 18.6k | if (err != TIFFReadDirEntryErrOk) |
1491 | 1.14k | break; |
1492 | 17.5k | *mb++ = (uint8_t)(*ma++); |
1493 | 17.5k | } |
1494 | 5.46k | } |
1495 | 5.46k | break; |
1496 | 10.4k | case TIFF_LONG: |
1497 | 10.4k | { |
1498 | 10.4k | uint32_t *ma; |
1499 | 10.4k | uint8_t *mb; |
1500 | 10.4k | uint32_t n; |
1501 | 10.4k | ma = (uint32_t *)origdata; |
1502 | 10.4k | mb = data; |
1503 | 22.8k | for (n = 0; n < count; n++) |
1504 | 19.9k | { |
1505 | 19.9k | if (tif->tif_flags & TIFF_SWAB) |
1506 | 879 | TIFFSwabLong(ma); |
1507 | 19.9k | err = TIFFReadDirEntryCheckRangeByteLong(*ma); |
1508 | 19.9k | if (err != TIFFReadDirEntryErrOk) |
1509 | 7.45k | break; |
1510 | 12.4k | *mb++ = (uint8_t)(*ma++); |
1511 | 12.4k | } |
1512 | 10.4k | } |
1513 | 10.4k | break; |
1514 | 3.66k | case TIFF_SLONG: |
1515 | 3.66k | { |
1516 | 3.66k | int32_t *ma; |
1517 | 3.66k | uint8_t *mb; |
1518 | 3.66k | uint32_t n; |
1519 | 3.66k | ma = (int32_t *)origdata; |
1520 | 3.66k | mb = data; |
1521 | 21.0k | for (n = 0; n < count; n++) |
1522 | 19.9k | { |
1523 | 19.9k | if (tif->tif_flags & TIFF_SWAB) |
1524 | 617 | TIFFSwabLong((uint32_t *)ma); |
1525 | 19.9k | err = TIFFReadDirEntryCheckRangeByteSlong(*ma); |
1526 | 19.9k | if (err != TIFFReadDirEntryErrOk) |
1527 | 2.60k | break; |
1528 | 17.3k | *mb++ = (uint8_t)(*ma++); |
1529 | 17.3k | } |
1530 | 3.66k | } |
1531 | 3.66k | break; |
1532 | 2.34k | case TIFF_LONG8: |
1533 | 2.34k | { |
1534 | 2.34k | uint64_t *ma; |
1535 | 2.34k | uint8_t *mb; |
1536 | 2.34k | uint32_t n; |
1537 | 2.34k | ma = (uint64_t *)origdata; |
1538 | 2.34k | mb = data; |
1539 | 6.75k | for (n = 0; n < count; n++) |
1540 | 6.43k | { |
1541 | 6.43k | if (tif->tif_flags & TIFF_SWAB) |
1542 | 791 | TIFFSwabLong8(ma); |
1543 | 6.43k | err = TIFFReadDirEntryCheckRangeByteLong8(*ma); |
1544 | 6.43k | if (err != TIFFReadDirEntryErrOk) |
1545 | 2.02k | break; |
1546 | 4.41k | *mb++ = (uint8_t)(*ma++); |
1547 | 4.41k | } |
1548 | 2.34k | } |
1549 | 2.34k | break; |
1550 | 3.72k | case TIFF_SLONG8: |
1551 | 3.72k | { |
1552 | 3.72k | int64_t *ma; |
1553 | 3.72k | uint8_t *mb; |
1554 | 3.72k | uint32_t n; |
1555 | 3.72k | ma = (int64_t *)origdata; |
1556 | 3.72k | mb = data; |
1557 | 8.60k | for (n = 0; n < count; n++) |
1558 | 8.23k | { |
1559 | 8.23k | if (tif->tif_flags & TIFF_SWAB) |
1560 | 865 | TIFFSwabLong8((uint64_t *)ma); |
1561 | 8.23k | err = TIFFReadDirEntryCheckRangeByteSlong8(*ma); |
1562 | 8.23k | if (err != TIFFReadDirEntryErrOk) |
1563 | 3.35k | break; |
1564 | 4.87k | *mb++ = (uint8_t)(*ma++); |
1565 | 4.87k | } |
1566 | 3.72k | } |
1567 | 3.72k | break; |
1568 | 0 | default: |
1569 | 0 | break; |
1570 | 46.9k | } |
1571 | 46.9k | _TIFFfreeExt(tif, origdata); |
1572 | 46.9k | if (err != TIFFReadDirEntryErrOk) |
1573 | 26.4k | { |
1574 | 26.4k | _TIFFfreeExt(tif, data); |
1575 | 26.4k | return (err); |
1576 | 26.4k | } |
1577 | 20.4k | *value = data; |
1578 | 20.4k | return (TIFFReadDirEntryErrOk); |
1579 | 46.9k | } |
1580 | | |
1581 | | static enum TIFFReadDirEntryErr |
1582 | | TIFFReadDirEntrySbyteArray(TIFF *tif, TIFFDirEntry *direntry, int8_t **value) |
1583 | 73.1k | { |
1584 | 73.1k | enum TIFFReadDirEntryErr err; |
1585 | 73.1k | uint32_t count; |
1586 | 73.1k | void *origdata; |
1587 | 73.1k | int8_t *data; |
1588 | 73.1k | switch (direntry->tdir_type) |
1589 | 73.1k | { |
1590 | 0 | case TIFF_UNDEFINED: |
1591 | 0 | case TIFF_BYTE: |
1592 | 73.1k | case TIFF_SBYTE: |
1593 | 73.1k | case TIFF_SHORT: |
1594 | 73.1k | case TIFF_SSHORT: |
1595 | 73.1k | case TIFF_LONG: |
1596 | 73.1k | case TIFF_SLONG: |
1597 | 73.1k | case TIFF_LONG8: |
1598 | 73.1k | case TIFF_SLONG8: |
1599 | 73.1k | break; |
1600 | 0 | default: |
1601 | 0 | return (TIFFReadDirEntryErrType); |
1602 | 73.1k | } |
1603 | 73.1k | err = TIFFReadDirEntryArray(tif, direntry, &count, 1, &origdata); |
1604 | 73.1k | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
1605 | 49.9k | { |
1606 | 49.9k | *value = 0; |
1607 | 49.9k | return (err); |
1608 | 49.9k | } |
1609 | 23.2k | switch (direntry->tdir_type) |
1610 | 23.2k | { |
1611 | 0 | case TIFF_UNDEFINED: |
1612 | 0 | case TIFF_BYTE: |
1613 | 0 | { |
1614 | 0 | uint8_t *m; |
1615 | 0 | uint32_t n; |
1616 | 0 | m = (uint8_t *)origdata; |
1617 | 0 | for (n = 0; n < count; n++) |
1618 | 0 | { |
1619 | 0 | err = TIFFReadDirEntryCheckRangeSbyteByte(*m); |
1620 | 0 | if (err != TIFFReadDirEntryErrOk) |
1621 | 0 | { |
1622 | 0 | _TIFFfreeExt(tif, origdata); |
1623 | 0 | return (err); |
1624 | 0 | } |
1625 | 0 | m++; |
1626 | 0 | } |
1627 | 0 | *value = (int8_t *)origdata; |
1628 | 0 | return (TIFFReadDirEntryErrOk); |
1629 | 0 | } |
1630 | 23.2k | case TIFF_SBYTE: |
1631 | 23.2k | *value = (int8_t *)origdata; |
1632 | 23.2k | return (TIFFReadDirEntryErrOk); |
1633 | 0 | default: |
1634 | 0 | break; |
1635 | 23.2k | } |
1636 | 0 | data = (int8_t *)_TIFFmallocExt(tif, count); |
1637 | 0 | if (data == 0) |
1638 | 0 | { |
1639 | 0 | _TIFFfreeExt(tif, origdata); |
1640 | 0 | return (TIFFReadDirEntryErrAlloc); |
1641 | 0 | } |
1642 | 0 | switch (direntry->tdir_type) |
1643 | 0 | { |
1644 | 0 | case TIFF_SHORT: |
1645 | 0 | { |
1646 | 0 | uint16_t *ma; |
1647 | 0 | int8_t *mb; |
1648 | 0 | uint32_t n; |
1649 | 0 | ma = (uint16_t *)origdata; |
1650 | 0 | mb = data; |
1651 | 0 | for (n = 0; n < count; n++) |
1652 | 0 | { |
1653 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1654 | 0 | TIFFSwabShort(ma); |
1655 | 0 | err = TIFFReadDirEntryCheckRangeSbyteShort(*ma); |
1656 | 0 | if (err != TIFFReadDirEntryErrOk) |
1657 | 0 | break; |
1658 | 0 | *mb++ = (int8_t)(*ma++); |
1659 | 0 | } |
1660 | 0 | } |
1661 | 0 | break; |
1662 | 0 | case TIFF_SSHORT: |
1663 | 0 | { |
1664 | 0 | int16_t *ma; |
1665 | 0 | int8_t *mb; |
1666 | 0 | uint32_t n; |
1667 | 0 | ma = (int16_t *)origdata; |
1668 | 0 | mb = data; |
1669 | 0 | for (n = 0; n < count; n++) |
1670 | 0 | { |
1671 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1672 | 0 | TIFFSwabShort((uint16_t *)ma); |
1673 | 0 | err = TIFFReadDirEntryCheckRangeSbyteSshort(*ma); |
1674 | 0 | if (err != TIFFReadDirEntryErrOk) |
1675 | 0 | break; |
1676 | 0 | *mb++ = (int8_t)(*ma++); |
1677 | 0 | } |
1678 | 0 | } |
1679 | 0 | break; |
1680 | 0 | case TIFF_LONG: |
1681 | 0 | { |
1682 | 0 | uint32_t *ma; |
1683 | 0 | int8_t *mb; |
1684 | 0 | uint32_t n; |
1685 | 0 | ma = (uint32_t *)origdata; |
1686 | 0 | mb = data; |
1687 | 0 | for (n = 0; n < count; n++) |
1688 | 0 | { |
1689 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1690 | 0 | TIFFSwabLong(ma); |
1691 | 0 | err = TIFFReadDirEntryCheckRangeSbyteLong(*ma); |
1692 | 0 | if (err != TIFFReadDirEntryErrOk) |
1693 | 0 | break; |
1694 | 0 | *mb++ = (int8_t)(*ma++); |
1695 | 0 | } |
1696 | 0 | } |
1697 | 0 | break; |
1698 | 0 | case TIFF_SLONG: |
1699 | 0 | { |
1700 | 0 | int32_t *ma; |
1701 | 0 | int8_t *mb; |
1702 | 0 | uint32_t n; |
1703 | 0 | ma = (int32_t *)origdata; |
1704 | 0 | mb = data; |
1705 | 0 | for (n = 0; n < count; n++) |
1706 | 0 | { |
1707 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1708 | 0 | TIFFSwabLong((uint32_t *)ma); |
1709 | 0 | err = TIFFReadDirEntryCheckRangeSbyteSlong(*ma); |
1710 | 0 | if (err != TIFFReadDirEntryErrOk) |
1711 | 0 | break; |
1712 | 0 | *mb++ = (int8_t)(*ma++); |
1713 | 0 | } |
1714 | 0 | } |
1715 | 0 | break; |
1716 | 0 | case TIFF_LONG8: |
1717 | 0 | { |
1718 | 0 | uint64_t *ma; |
1719 | 0 | int8_t *mb; |
1720 | 0 | uint32_t n; |
1721 | 0 | ma = (uint64_t *)origdata; |
1722 | 0 | mb = data; |
1723 | 0 | for (n = 0; n < count; n++) |
1724 | 0 | { |
1725 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1726 | 0 | TIFFSwabLong8(ma); |
1727 | 0 | err = TIFFReadDirEntryCheckRangeSbyteLong8(*ma); |
1728 | 0 | if (err != TIFFReadDirEntryErrOk) |
1729 | 0 | break; |
1730 | 0 | *mb++ = (int8_t)(*ma++); |
1731 | 0 | } |
1732 | 0 | } |
1733 | 0 | break; |
1734 | 0 | case TIFF_SLONG8: |
1735 | 0 | { |
1736 | 0 | int64_t *ma; |
1737 | 0 | int8_t *mb; |
1738 | 0 | uint32_t n; |
1739 | 0 | ma = (int64_t *)origdata; |
1740 | 0 | mb = data; |
1741 | 0 | for (n = 0; n < count; n++) |
1742 | 0 | { |
1743 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1744 | 0 | TIFFSwabLong8((uint64_t *)ma); |
1745 | 0 | err = TIFFReadDirEntryCheckRangeSbyteSlong8(*ma); |
1746 | 0 | if (err != TIFFReadDirEntryErrOk) |
1747 | 0 | break; |
1748 | 0 | *mb++ = (int8_t)(*ma++); |
1749 | 0 | } |
1750 | 0 | } |
1751 | 0 | break; |
1752 | 0 | default: |
1753 | 0 | break; |
1754 | 0 | } |
1755 | 0 | _TIFFfreeExt(tif, origdata); |
1756 | 0 | if (err != TIFFReadDirEntryErrOk) |
1757 | 0 | { |
1758 | 0 | _TIFFfreeExt(tif, data); |
1759 | 0 | return (err); |
1760 | 0 | } |
1761 | 0 | *value = data; |
1762 | 0 | return (TIFFReadDirEntryErrOk); |
1763 | 0 | } |
1764 | | |
1765 | | static enum TIFFReadDirEntryErr |
1766 | | TIFFReadDirEntryShortArray(TIFF *tif, TIFFDirEntry *direntry, uint16_t **value) |
1767 | 1.13M | { |
1768 | 1.13M | enum TIFFReadDirEntryErr err; |
1769 | 1.13M | uint32_t count; |
1770 | 1.13M | void *origdata; |
1771 | 1.13M | uint16_t *data; |
1772 | 1.13M | switch (direntry->tdir_type) |
1773 | 1.13M | { |
1774 | 6.05k | case TIFF_BYTE: |
1775 | 8.03k | case TIFF_SBYTE: |
1776 | 1.11M | case TIFF_SHORT: |
1777 | 1.11M | case TIFF_SSHORT: |
1778 | 1.11M | case TIFF_LONG: |
1779 | 1.12M | case TIFF_SLONG: |
1780 | 1.12M | case TIFF_LONG8: |
1781 | 1.12M | case TIFF_SLONG8: |
1782 | 1.12M | break; |
1783 | 4.33k | default: |
1784 | 4.33k | return (TIFFReadDirEntryErrType); |
1785 | 1.13M | } |
1786 | 1.12M | err = TIFFReadDirEntryArray(tif, direntry, &count, 2, &origdata); |
1787 | 1.12M | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
1788 | 339k | { |
1789 | 339k | *value = 0; |
1790 | 339k | return (err); |
1791 | 339k | } |
1792 | 786k | switch (direntry->tdir_type) |
1793 | 786k | { |
1794 | 769k | case TIFF_SHORT: |
1795 | 769k | *value = (uint16_t *)origdata; |
1796 | 769k | if (tif->tif_flags & TIFF_SWAB) |
1797 | 2.24k | TIFFSwabArrayOfShort(*value, count); |
1798 | 769k | return (TIFFReadDirEntryErrOk); |
1799 | 1.91k | case TIFF_SSHORT: |
1800 | 1.91k | { |
1801 | 1.91k | int16_t *m; |
1802 | 1.91k | uint32_t n; |
1803 | 1.91k | m = (int16_t *)origdata; |
1804 | 29.2k | for (n = 0; n < count; n++) |
1805 | 27.8k | { |
1806 | 27.8k | if (tif->tif_flags & TIFF_SWAB) |
1807 | 596 | TIFFSwabShort((uint16_t *)m); |
1808 | 27.8k | err = TIFFReadDirEntryCheckRangeShortSshort(*m); |
1809 | 27.8k | if (err != TIFFReadDirEntryErrOk) |
1810 | 549 | { |
1811 | 549 | _TIFFfreeExt(tif, origdata); |
1812 | 549 | return (err); |
1813 | 549 | } |
1814 | 27.2k | m++; |
1815 | 27.2k | } |
1816 | 1.36k | *value = (uint16_t *)origdata; |
1817 | 1.36k | return (TIFFReadDirEntryErrOk); |
1818 | 1.91k | } |
1819 | 15.4k | default: |
1820 | 15.4k | break; |
1821 | 786k | } |
1822 | 15.4k | data = (uint16_t *)_TIFFmallocExt(tif, count * 2); |
1823 | 15.4k | if (data == 0) |
1824 | 0 | { |
1825 | 0 | _TIFFfreeExt(tif, origdata); |
1826 | 0 | return (TIFFReadDirEntryErrAlloc); |
1827 | 0 | } |
1828 | 15.4k | switch (direntry->tdir_type) |
1829 | 15.4k | { |
1830 | 5.12k | case TIFF_BYTE: |
1831 | 5.12k | { |
1832 | 5.12k | uint8_t *ma; |
1833 | 5.12k | uint16_t *mb; |
1834 | 5.12k | uint32_t n; |
1835 | 5.12k | ma = (uint8_t *)origdata; |
1836 | 5.12k | mb = data; |
1837 | 1.22M | for (n = 0; n < count; n++) |
1838 | 1.22M | *mb++ = (uint16_t)(*ma++); |
1839 | 5.12k | } |
1840 | 5.12k | break; |
1841 | 1.94k | case TIFF_SBYTE: |
1842 | 1.94k | { |
1843 | 1.94k | int8_t *ma; |
1844 | 1.94k | uint16_t *mb; |
1845 | 1.94k | uint32_t n; |
1846 | 1.94k | ma = (int8_t *)origdata; |
1847 | 1.94k | mb = data; |
1848 | 16.8k | for (n = 0; n < count; n++) |
1849 | 15.1k | { |
1850 | 15.1k | err = TIFFReadDirEntryCheckRangeShortSbyte(*ma); |
1851 | 15.1k | if (err != TIFFReadDirEntryErrOk) |
1852 | 246 | break; |
1853 | 14.8k | *mb++ = (uint16_t)(*ma++); |
1854 | 14.8k | } |
1855 | 1.94k | } |
1856 | 1.94k | break; |
1857 | 1.85k | case TIFF_LONG: |
1858 | 1.85k | { |
1859 | 1.85k | uint32_t *ma; |
1860 | 1.85k | uint16_t *mb; |
1861 | 1.85k | uint32_t n; |
1862 | 1.85k | ma = (uint32_t *)origdata; |
1863 | 1.85k | mb = data; |
1864 | 14.3k | for (n = 0; n < count; n++) |
1865 | 13.1k | { |
1866 | 13.1k | if (tif->tif_flags & TIFF_SWAB) |
1867 | 542 | TIFFSwabLong(ma); |
1868 | 13.1k | err = TIFFReadDirEntryCheckRangeShortLong(*ma); |
1869 | 13.1k | if (err != TIFFReadDirEntryErrOk) |
1870 | 673 | break; |
1871 | 12.4k | *mb++ = (uint16_t)(*ma++); |
1872 | 12.4k | } |
1873 | 1.85k | } |
1874 | 1.85k | break; |
1875 | 3.30k | case TIFF_SLONG: |
1876 | 3.30k | { |
1877 | 3.30k | int32_t *ma; |
1878 | 3.30k | uint16_t *mb; |
1879 | 3.30k | uint32_t n; |
1880 | 3.30k | ma = (int32_t *)origdata; |
1881 | 3.30k | mb = data; |
1882 | 7.87k | for (n = 0; n < count; n++) |
1883 | 6.43k | { |
1884 | 6.43k | if (tif->tif_flags & TIFF_SWAB) |
1885 | 265 | TIFFSwabLong((uint32_t *)ma); |
1886 | 6.43k | err = TIFFReadDirEntryCheckRangeShortSlong(*ma); |
1887 | 6.43k | if (err != TIFFReadDirEntryErrOk) |
1888 | 1.85k | break; |
1889 | 4.57k | *mb++ = (uint16_t)(*ma++); |
1890 | 4.57k | } |
1891 | 3.30k | } |
1892 | 3.30k | break; |
1893 | 1.07k | case TIFF_LONG8: |
1894 | 1.07k | { |
1895 | 1.07k | uint64_t *ma; |
1896 | 1.07k | uint16_t *mb; |
1897 | 1.07k | uint32_t n; |
1898 | 1.07k | ma = (uint64_t *)origdata; |
1899 | 1.07k | mb = data; |
1900 | 4.81k | for (n = 0; n < count; n++) |
1901 | 4.65k | { |
1902 | 4.65k | if (tif->tif_flags & TIFF_SWAB) |
1903 | 1.06k | TIFFSwabLong8(ma); |
1904 | 4.65k | err = TIFFReadDirEntryCheckRangeShortLong8(*ma); |
1905 | 4.65k | if (err != TIFFReadDirEntryErrOk) |
1906 | 924 | break; |
1907 | 3.73k | *mb++ = (uint16_t)(*ma++); |
1908 | 3.73k | } |
1909 | 1.07k | } |
1910 | 1.07k | break; |
1911 | 2.14k | case TIFF_SLONG8: |
1912 | 2.14k | { |
1913 | 2.14k | int64_t *ma; |
1914 | 2.14k | uint16_t *mb; |
1915 | 2.14k | uint32_t n; |
1916 | 2.14k | ma = (int64_t *)origdata; |
1917 | 2.14k | mb = data; |
1918 | 4.18k | for (n = 0; n < count; n++) |
1919 | 3.84k | { |
1920 | 3.84k | if (tif->tif_flags & TIFF_SWAB) |
1921 | 890 | TIFFSwabLong8((uint64_t *)ma); |
1922 | 3.84k | err = TIFFReadDirEntryCheckRangeShortSlong8(*ma); |
1923 | 3.84k | if (err != TIFFReadDirEntryErrOk) |
1924 | 1.81k | break; |
1925 | 2.03k | *mb++ = (uint16_t)(*ma++); |
1926 | 2.03k | } |
1927 | 2.14k | } |
1928 | 2.14k | break; |
1929 | 0 | default: |
1930 | 0 | break; |
1931 | 15.4k | } |
1932 | 15.4k | _TIFFfreeExt(tif, origdata); |
1933 | 15.4k | if (err != TIFFReadDirEntryErrOk) |
1934 | 5.50k | { |
1935 | 5.50k | _TIFFfreeExt(tif, data); |
1936 | 5.50k | return (err); |
1937 | 5.50k | } |
1938 | 9.94k | *value = data; |
1939 | 9.94k | return (TIFFReadDirEntryErrOk); |
1940 | 15.4k | } |
1941 | | |
1942 | | static enum TIFFReadDirEntryErr |
1943 | | TIFFReadDirEntrySshortArray(TIFF *tif, TIFFDirEntry *direntry, int16_t **value) |
1944 | 122k | { |
1945 | 122k | enum TIFFReadDirEntryErr err; |
1946 | 122k | uint32_t count; |
1947 | 122k | void *origdata; |
1948 | 122k | int16_t *data; |
1949 | 122k | switch (direntry->tdir_type) |
1950 | 122k | { |
1951 | 0 | case TIFF_BYTE: |
1952 | 0 | case TIFF_SBYTE: |
1953 | 0 | case TIFF_SHORT: |
1954 | 122k | case TIFF_SSHORT: |
1955 | 122k | case TIFF_LONG: |
1956 | 122k | case TIFF_SLONG: |
1957 | 122k | case TIFF_LONG8: |
1958 | 122k | case TIFF_SLONG8: |
1959 | 122k | break; |
1960 | 0 | default: |
1961 | 0 | return (TIFFReadDirEntryErrType); |
1962 | 122k | } |
1963 | 122k | err = TIFFReadDirEntryArray(tif, direntry, &count, 2, &origdata); |
1964 | 122k | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
1965 | 113k | { |
1966 | 113k | *value = 0; |
1967 | 113k | return (err); |
1968 | 113k | } |
1969 | 8.73k | switch (direntry->tdir_type) |
1970 | 8.73k | { |
1971 | 0 | case TIFF_SHORT: |
1972 | 0 | { |
1973 | 0 | uint16_t *m; |
1974 | 0 | uint32_t n; |
1975 | 0 | m = (uint16_t *)origdata; |
1976 | 0 | for (n = 0; n < count; n++) |
1977 | 0 | { |
1978 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1979 | 0 | TIFFSwabShort(m); |
1980 | 0 | err = TIFFReadDirEntryCheckRangeSshortShort(*m); |
1981 | 0 | if (err != TIFFReadDirEntryErrOk) |
1982 | 0 | { |
1983 | 0 | _TIFFfreeExt(tif, origdata); |
1984 | 0 | return (err); |
1985 | 0 | } |
1986 | 0 | m++; |
1987 | 0 | } |
1988 | 0 | *value = (int16_t *)origdata; |
1989 | 0 | return (TIFFReadDirEntryErrOk); |
1990 | 0 | } |
1991 | 8.73k | case TIFF_SSHORT: |
1992 | 8.73k | *value = (int16_t *)origdata; |
1993 | 8.73k | if (tif->tif_flags & TIFF_SWAB) |
1994 | 152 | TIFFSwabArrayOfShort((uint16_t *)(*value), count); |
1995 | 8.73k | return (TIFFReadDirEntryErrOk); |
1996 | 0 | default: |
1997 | 0 | break; |
1998 | 8.73k | } |
1999 | 0 | data = (int16_t *)_TIFFmallocExt(tif, count * 2); |
2000 | 0 | if (data == 0) |
2001 | 0 | { |
2002 | 0 | _TIFFfreeExt(tif, origdata); |
2003 | 0 | return (TIFFReadDirEntryErrAlloc); |
2004 | 0 | } |
2005 | 0 | switch (direntry->tdir_type) |
2006 | 0 | { |
2007 | 0 | case TIFF_BYTE: |
2008 | 0 | { |
2009 | 0 | uint8_t *ma; |
2010 | 0 | int16_t *mb; |
2011 | 0 | uint32_t n; |
2012 | 0 | ma = (uint8_t *)origdata; |
2013 | 0 | mb = data; |
2014 | 0 | for (n = 0; n < count; n++) |
2015 | 0 | *mb++ = (int16_t)(*ma++); |
2016 | 0 | } |
2017 | 0 | break; |
2018 | 0 | case TIFF_SBYTE: |
2019 | 0 | { |
2020 | 0 | int8_t *ma; |
2021 | 0 | int16_t *mb; |
2022 | 0 | uint32_t n; |
2023 | 0 | ma = (int8_t *)origdata; |
2024 | 0 | mb = data; |
2025 | 0 | for (n = 0; n < count; n++) |
2026 | 0 | *mb++ = (int16_t)(*ma++); |
2027 | 0 | } |
2028 | 0 | break; |
2029 | 0 | case TIFF_LONG: |
2030 | 0 | { |
2031 | 0 | uint32_t *ma; |
2032 | 0 | int16_t *mb; |
2033 | 0 | uint32_t n; |
2034 | 0 | ma = (uint32_t *)origdata; |
2035 | 0 | mb = data; |
2036 | 0 | for (n = 0; n < count; n++) |
2037 | 0 | { |
2038 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2039 | 0 | TIFFSwabLong(ma); |
2040 | 0 | err = TIFFReadDirEntryCheckRangeSshortLong(*ma); |
2041 | 0 | if (err != TIFFReadDirEntryErrOk) |
2042 | 0 | break; |
2043 | 0 | *mb++ = (int16_t)(*ma++); |
2044 | 0 | } |
2045 | 0 | } |
2046 | 0 | break; |
2047 | 0 | case TIFF_SLONG: |
2048 | 0 | { |
2049 | 0 | int32_t *ma; |
2050 | 0 | int16_t *mb; |
2051 | 0 | uint32_t n; |
2052 | 0 | ma = (int32_t *)origdata; |
2053 | 0 | mb = data; |
2054 | 0 | for (n = 0; n < count; n++) |
2055 | 0 | { |
2056 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2057 | 0 | TIFFSwabLong((uint32_t *)ma); |
2058 | 0 | err = TIFFReadDirEntryCheckRangeSshortSlong(*ma); |
2059 | 0 | if (err != TIFFReadDirEntryErrOk) |
2060 | 0 | break; |
2061 | 0 | *mb++ = (int16_t)(*ma++); |
2062 | 0 | } |
2063 | 0 | } |
2064 | 0 | break; |
2065 | 0 | case TIFF_LONG8: |
2066 | 0 | { |
2067 | 0 | uint64_t *ma; |
2068 | 0 | int16_t *mb; |
2069 | 0 | uint32_t n; |
2070 | 0 | ma = (uint64_t *)origdata; |
2071 | 0 | mb = data; |
2072 | 0 | for (n = 0; n < count; n++) |
2073 | 0 | { |
2074 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2075 | 0 | TIFFSwabLong8(ma); |
2076 | 0 | err = TIFFReadDirEntryCheckRangeSshortLong8(*ma); |
2077 | 0 | if (err != TIFFReadDirEntryErrOk) |
2078 | 0 | break; |
2079 | 0 | *mb++ = (int16_t)(*ma++); |
2080 | 0 | } |
2081 | 0 | } |
2082 | 0 | break; |
2083 | 0 | case TIFF_SLONG8: |
2084 | 0 | { |
2085 | 0 | int64_t *ma; |
2086 | 0 | int16_t *mb; |
2087 | 0 | uint32_t n; |
2088 | 0 | ma = (int64_t *)origdata; |
2089 | 0 | mb = data; |
2090 | 0 | for (n = 0; n < count; n++) |
2091 | 0 | { |
2092 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2093 | 0 | TIFFSwabLong8((uint64_t *)ma); |
2094 | 0 | err = TIFFReadDirEntryCheckRangeSshortSlong8(*ma); |
2095 | 0 | if (err != TIFFReadDirEntryErrOk) |
2096 | 0 | break; |
2097 | 0 | *mb++ = (int16_t)(*ma++); |
2098 | 0 | } |
2099 | 0 | } |
2100 | 0 | break; |
2101 | 0 | default: |
2102 | 0 | break; |
2103 | 0 | } |
2104 | 0 | _TIFFfreeExt(tif, origdata); |
2105 | 0 | if (err != TIFFReadDirEntryErrOk) |
2106 | 0 | { |
2107 | 0 | _TIFFfreeExt(tif, data); |
2108 | 0 | return (err); |
2109 | 0 | } |
2110 | 0 | *value = data; |
2111 | 0 | return (TIFFReadDirEntryErrOk); |
2112 | 0 | } |
2113 | | |
2114 | | static enum TIFFReadDirEntryErr |
2115 | | TIFFReadDirEntryLongArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t **value) |
2116 | 176k | { |
2117 | 176k | enum TIFFReadDirEntryErr err; |
2118 | 176k | uint32_t count; |
2119 | 176k | void *origdata; |
2120 | 176k | uint32_t *data; |
2121 | 176k | switch (direntry->tdir_type) |
2122 | 176k | { |
2123 | 1.27k | case TIFF_BYTE: |
2124 | 3.97k | case TIFF_SBYTE: |
2125 | 5.09k | case TIFF_SHORT: |
2126 | 6.91k | case TIFF_SSHORT: |
2127 | 163k | case TIFF_LONG: |
2128 | 165k | case TIFF_SLONG: |
2129 | 168k | case TIFF_LONG8: |
2130 | 173k | case TIFF_SLONG8: |
2131 | 173k | case TIFF_IFD: |
2132 | 173k | case TIFF_IFD8: |
2133 | 173k | break; |
2134 | 3.03k | default: |
2135 | 3.03k | return (TIFFReadDirEntryErrType); |
2136 | 176k | } |
2137 | 173k | err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata); |
2138 | 173k | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
2139 | 135k | { |
2140 | 135k | *value = 0; |
2141 | 135k | return (err); |
2142 | 135k | } |
2143 | 38.2k | switch (direntry->tdir_type) |
2144 | 38.2k | { |
2145 | 26.1k | case TIFF_LONG: |
2146 | 26.4k | case TIFF_IFD: |
2147 | 26.4k | *value = (uint32_t *)origdata; |
2148 | 26.4k | if (tif->tif_flags & TIFF_SWAB) |
2149 | 617 | TIFFSwabArrayOfLong(*value, count); |
2150 | 26.4k | return (TIFFReadDirEntryErrOk); |
2151 | 1.61k | case TIFF_SLONG: |
2152 | 1.61k | { |
2153 | 1.61k | int32_t *m; |
2154 | 1.61k | uint32_t n; |
2155 | 1.61k | m = (int32_t *)origdata; |
2156 | 12.2k | for (n = 0; n < count; n++) |
2157 | 11.5k | { |
2158 | 11.5k | if (tif->tif_flags & TIFF_SWAB) |
2159 | 639 | TIFFSwabLong((uint32_t *)m); |
2160 | 11.5k | err = TIFFReadDirEntryCheckRangeLongSlong(*m); |
2161 | 11.5k | if (err != TIFFReadDirEntryErrOk) |
2162 | 899 | { |
2163 | 899 | _TIFFfreeExt(tif, origdata); |
2164 | 899 | return (err); |
2165 | 899 | } |
2166 | 10.6k | m++; |
2167 | 10.6k | } |
2168 | 719 | *value = (uint32_t *)origdata; |
2169 | 719 | return (TIFFReadDirEntryErrOk); |
2170 | 1.61k | } |
2171 | 10.1k | default: |
2172 | 10.1k | break; |
2173 | 38.2k | } |
2174 | 10.1k | data = (uint32_t *)_TIFFmallocExt(tif, count * 4); |
2175 | 10.1k | if (data == 0) |
2176 | 0 | { |
2177 | 0 | _TIFFfreeExt(tif, origdata); |
2178 | 0 | return (TIFFReadDirEntryErrAlloc); |
2179 | 0 | } |
2180 | 10.1k | switch (direntry->tdir_type) |
2181 | 10.1k | { |
2182 | 698 | case TIFF_BYTE: |
2183 | 698 | { |
2184 | 698 | uint8_t *ma; |
2185 | 698 | uint32_t *mb; |
2186 | 698 | uint32_t n; |
2187 | 698 | ma = (uint8_t *)origdata; |
2188 | 698 | mb = data; |
2189 | 5.83k | for (n = 0; n < count; n++) |
2190 | 5.13k | *mb++ = (uint32_t)(*ma++); |
2191 | 698 | } |
2192 | 698 | break; |
2193 | 1.30k | case TIFF_SBYTE: |
2194 | 1.30k | { |
2195 | 1.30k | int8_t *ma; |
2196 | 1.30k | uint32_t *mb; |
2197 | 1.30k | uint32_t n; |
2198 | 1.30k | ma = (int8_t *)origdata; |
2199 | 1.30k | mb = data; |
2200 | 9.20k | for (n = 0; n < count; n++) |
2201 | 8.48k | { |
2202 | 8.48k | err = TIFFReadDirEntryCheckRangeLongSbyte(*ma); |
2203 | 8.48k | if (err != TIFFReadDirEntryErrOk) |
2204 | 591 | break; |
2205 | 7.89k | *mb++ = (uint32_t)(*ma++); |
2206 | 7.89k | } |
2207 | 1.30k | } |
2208 | 1.30k | break; |
2209 | 1.00k | case TIFF_SHORT: |
2210 | 1.00k | { |
2211 | 1.00k | uint16_t *ma; |
2212 | 1.00k | uint32_t *mb; |
2213 | 1.00k | uint32_t n; |
2214 | 1.00k | ma = (uint16_t *)origdata; |
2215 | 1.00k | mb = data; |
2216 | 111k | for (n = 0; n < count; n++) |
2217 | 110k | { |
2218 | 110k | if (tif->tif_flags & TIFF_SWAB) |
2219 | 806 | TIFFSwabShort(ma); |
2220 | 110k | *mb++ = (uint32_t)(*ma++); |
2221 | 110k | } |
2222 | 1.00k | } |
2223 | 1.00k | break; |
2224 | 1.52k | case TIFF_SSHORT: |
2225 | 1.52k | { |
2226 | 1.52k | int16_t *ma; |
2227 | 1.52k | uint32_t *mb; |
2228 | 1.52k | uint32_t n; |
2229 | 1.52k | ma = (int16_t *)origdata; |
2230 | 1.52k | mb = data; |
2231 | 9.43k | for (n = 0; n < count; n++) |
2232 | 8.67k | { |
2233 | 8.67k | if (tif->tif_flags & TIFF_SWAB) |
2234 | 619 | TIFFSwabShort((uint16_t *)ma); |
2235 | 8.67k | err = TIFFReadDirEntryCheckRangeLongSshort(*ma); |
2236 | 8.67k | if (err != TIFFReadDirEntryErrOk) |
2237 | 763 | break; |
2238 | 7.91k | *mb++ = (uint32_t)(*ma++); |
2239 | 7.91k | } |
2240 | 1.52k | } |
2241 | 1.52k | break; |
2242 | 1.68k | case TIFF_LONG8: |
2243 | 1.78k | case TIFF_IFD8: |
2244 | 1.78k | { |
2245 | 1.78k | uint64_t *ma; |
2246 | 1.78k | uint32_t *mb; |
2247 | 1.78k | uint32_t n; |
2248 | 1.78k | ma = (uint64_t *)origdata; |
2249 | 1.78k | mb = data; |
2250 | 116k | for (n = 0; n < count; n++) |
2251 | 116k | { |
2252 | 116k | if (tif->tif_flags & TIFF_SWAB) |
2253 | 913 | TIFFSwabLong8(ma); |
2254 | 116k | err = TIFFReadDirEntryCheckRangeLongLong8(*ma); |
2255 | 116k | if (err != TIFFReadDirEntryErrOk) |
2256 | 1.51k | break; |
2257 | 114k | *mb++ = (uint32_t)(*ma++); |
2258 | 114k | } |
2259 | 1.78k | } |
2260 | 1.78k | break; |
2261 | 3.84k | case TIFF_SLONG8: |
2262 | 3.84k | { |
2263 | 3.84k | int64_t *ma; |
2264 | 3.84k | uint32_t *mb; |
2265 | 3.84k | uint32_t n; |
2266 | 3.84k | ma = (int64_t *)origdata; |
2267 | 3.84k | mb = data; |
2268 | 1.87M | for (n = 0; n < count; n++) |
2269 | 1.87M | { |
2270 | 1.87M | if (tif->tif_flags & TIFF_SWAB) |
2271 | 11.9k | TIFFSwabLong8((uint64_t *)ma); |
2272 | 1.87M | err = TIFFReadDirEntryCheckRangeLongSlong8(*ma); |
2273 | 1.87M | if (err != TIFFReadDirEntryErrOk) |
2274 | 3.37k | break; |
2275 | 1.87M | *mb++ = (uint32_t)(*ma++); |
2276 | 1.87M | } |
2277 | 3.84k | } |
2278 | 3.84k | break; |
2279 | 0 | default: |
2280 | 0 | break; |
2281 | 10.1k | } |
2282 | 10.1k | _TIFFfreeExt(tif, origdata); |
2283 | 10.1k | if (err != TIFFReadDirEntryErrOk) |
2284 | 6.24k | { |
2285 | 6.24k | _TIFFfreeExt(tif, data); |
2286 | 6.24k | return (err); |
2287 | 6.24k | } |
2288 | 3.92k | *value = data; |
2289 | 3.92k | return (TIFFReadDirEntryErrOk); |
2290 | 10.1k | } |
2291 | | |
2292 | | static enum TIFFReadDirEntryErr |
2293 | | TIFFReadDirEntrySlongArray(TIFF *tif, TIFFDirEntry *direntry, int32_t **value) |
2294 | 41.0k | { |
2295 | 41.0k | enum TIFFReadDirEntryErr err; |
2296 | 41.0k | uint32_t count; |
2297 | 41.0k | void *origdata; |
2298 | 41.0k | int32_t *data; |
2299 | 41.0k | switch (direntry->tdir_type) |
2300 | 41.0k | { |
2301 | 0 | case TIFF_BYTE: |
2302 | 0 | case TIFF_SBYTE: |
2303 | 0 | case TIFF_SHORT: |
2304 | 0 | case TIFF_SSHORT: |
2305 | 0 | case TIFF_LONG: |
2306 | 41.0k | case TIFF_SLONG: |
2307 | 41.0k | case TIFF_LONG8: |
2308 | 41.0k | case TIFF_SLONG8: |
2309 | 41.0k | break; |
2310 | 0 | default: |
2311 | 0 | return (TIFFReadDirEntryErrType); |
2312 | 41.0k | } |
2313 | 41.0k | err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata); |
2314 | 41.0k | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
2315 | 26.1k | { |
2316 | 26.1k | *value = 0; |
2317 | 26.1k | return (err); |
2318 | 26.1k | } |
2319 | 14.8k | switch (direntry->tdir_type) |
2320 | 14.8k | { |
2321 | 0 | case TIFF_LONG: |
2322 | 0 | { |
2323 | 0 | uint32_t *m; |
2324 | 0 | uint32_t n; |
2325 | 0 | m = (uint32_t *)origdata; |
2326 | 0 | for (n = 0; n < count; n++) |
2327 | 0 | { |
2328 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2329 | 0 | TIFFSwabLong((uint32_t *)m); |
2330 | 0 | err = TIFFReadDirEntryCheckRangeSlongLong(*m); |
2331 | 0 | if (err != TIFFReadDirEntryErrOk) |
2332 | 0 | { |
2333 | 0 | _TIFFfreeExt(tif, origdata); |
2334 | 0 | return (err); |
2335 | 0 | } |
2336 | 0 | m++; |
2337 | 0 | } |
2338 | 0 | *value = (int32_t *)origdata; |
2339 | 0 | return (TIFFReadDirEntryErrOk); |
2340 | 0 | } |
2341 | 14.8k | case TIFF_SLONG: |
2342 | 14.8k | *value = (int32_t *)origdata; |
2343 | 14.8k | if (tif->tif_flags & TIFF_SWAB) |
2344 | 170 | TIFFSwabArrayOfLong((uint32_t *)(*value), count); |
2345 | 14.8k | return (TIFFReadDirEntryErrOk); |
2346 | 0 | default: |
2347 | 0 | break; |
2348 | 14.8k | } |
2349 | 0 | data = (int32_t *)_TIFFmallocExt(tif, count * 4); |
2350 | 0 | if (data == 0) |
2351 | 0 | { |
2352 | 0 | _TIFFfreeExt(tif, origdata); |
2353 | 0 | return (TIFFReadDirEntryErrAlloc); |
2354 | 0 | } |
2355 | 0 | switch (direntry->tdir_type) |
2356 | 0 | { |
2357 | 0 | case TIFF_BYTE: |
2358 | 0 | { |
2359 | 0 | uint8_t *ma; |
2360 | 0 | int32_t *mb; |
2361 | 0 | uint32_t n; |
2362 | 0 | ma = (uint8_t *)origdata; |
2363 | 0 | mb = data; |
2364 | 0 | for (n = 0; n < count; n++) |
2365 | 0 | *mb++ = (int32_t)(*ma++); |
2366 | 0 | } |
2367 | 0 | break; |
2368 | 0 | case TIFF_SBYTE: |
2369 | 0 | { |
2370 | 0 | int8_t *ma; |
2371 | 0 | int32_t *mb; |
2372 | 0 | uint32_t n; |
2373 | 0 | ma = (int8_t *)origdata; |
2374 | 0 | mb = data; |
2375 | 0 | for (n = 0; n < count; n++) |
2376 | 0 | *mb++ = (int32_t)(*ma++); |
2377 | 0 | } |
2378 | 0 | break; |
2379 | 0 | case TIFF_SHORT: |
2380 | 0 | { |
2381 | 0 | uint16_t *ma; |
2382 | 0 | int32_t *mb; |
2383 | 0 | uint32_t n; |
2384 | 0 | ma = (uint16_t *)origdata; |
2385 | 0 | mb = data; |
2386 | 0 | for (n = 0; n < count; n++) |
2387 | 0 | { |
2388 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2389 | 0 | TIFFSwabShort(ma); |
2390 | 0 | *mb++ = (int32_t)(*ma++); |
2391 | 0 | } |
2392 | 0 | } |
2393 | 0 | break; |
2394 | 0 | case TIFF_SSHORT: |
2395 | 0 | { |
2396 | 0 | int16_t *ma; |
2397 | 0 | int32_t *mb; |
2398 | 0 | uint32_t n; |
2399 | 0 | ma = (int16_t *)origdata; |
2400 | 0 | mb = data; |
2401 | 0 | for (n = 0; n < count; n++) |
2402 | 0 | { |
2403 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2404 | 0 | TIFFSwabShort((uint16_t *)ma); |
2405 | 0 | *mb++ = (int32_t)(*ma++); |
2406 | 0 | } |
2407 | 0 | } |
2408 | 0 | break; |
2409 | 0 | case TIFF_LONG8: |
2410 | 0 | { |
2411 | 0 | uint64_t *ma; |
2412 | 0 | int32_t *mb; |
2413 | 0 | uint32_t n; |
2414 | 0 | ma = (uint64_t *)origdata; |
2415 | 0 | mb = data; |
2416 | 0 | for (n = 0; n < count; n++) |
2417 | 0 | { |
2418 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2419 | 0 | TIFFSwabLong8(ma); |
2420 | 0 | err = TIFFReadDirEntryCheckRangeSlongLong8(*ma); |
2421 | 0 | if (err != TIFFReadDirEntryErrOk) |
2422 | 0 | break; |
2423 | 0 | *mb++ = (int32_t)(*ma++); |
2424 | 0 | } |
2425 | 0 | } |
2426 | 0 | break; |
2427 | 0 | case TIFF_SLONG8: |
2428 | 0 | { |
2429 | 0 | int64_t *ma; |
2430 | 0 | int32_t *mb; |
2431 | 0 | uint32_t n; |
2432 | 0 | ma = (int64_t *)origdata; |
2433 | 0 | mb = data; |
2434 | 0 | for (n = 0; n < count; n++) |
2435 | 0 | { |
2436 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2437 | 0 | TIFFSwabLong8((uint64_t *)ma); |
2438 | 0 | err = TIFFReadDirEntryCheckRangeSlongSlong8(*ma); |
2439 | 0 | if (err != TIFFReadDirEntryErrOk) |
2440 | 0 | break; |
2441 | 0 | *mb++ = (int32_t)(*ma++); |
2442 | 0 | } |
2443 | 0 | } |
2444 | 0 | break; |
2445 | 0 | default: |
2446 | 0 | break; |
2447 | 0 | } |
2448 | 0 | _TIFFfreeExt(tif, origdata); |
2449 | 0 | if (err != TIFFReadDirEntryErrOk) |
2450 | 0 | { |
2451 | 0 | _TIFFfreeExt(tif, data); |
2452 | 0 | return (err); |
2453 | 0 | } |
2454 | 0 | *value = data; |
2455 | 0 | return (TIFFReadDirEntryErrOk); |
2456 | 0 | } |
2457 | | |
2458 | | static enum TIFFReadDirEntryErr |
2459 | | TIFFReadDirEntryLong8ArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry, |
2460 | | uint64_t **value, uint64_t maxcount) |
2461 | 1.44M | { |
2462 | 1.44M | enum TIFFReadDirEntryErr err; |
2463 | 1.44M | uint32_t count; |
2464 | 1.44M | void *origdata; |
2465 | 1.44M | uint64_t *data; |
2466 | 1.44M | switch (direntry->tdir_type) |
2467 | 1.44M | { |
2468 | 19.2k | case TIFF_BYTE: |
2469 | 33.5k | case TIFF_SBYTE: |
2470 | 70.7k | case TIFF_SHORT: |
2471 | 74.7k | case TIFF_SSHORT: |
2472 | 1.37M | case TIFF_LONG: |
2473 | 1.37M | case TIFF_SLONG: |
2474 | 1.42M | case TIFF_LONG8: |
2475 | 1.43M | case TIFF_SLONG8: |
2476 | 1.43M | case TIFF_IFD: |
2477 | 1.43M | case TIFF_IFD8: |
2478 | 1.43M | break; |
2479 | 7.86k | default: |
2480 | 7.86k | return (TIFFReadDirEntryErrType); |
2481 | 1.44M | } |
2482 | 1.43M | err = TIFFReadDirEntryArrayWithLimit(tif, direntry, &count, 8, &origdata, |
2483 | 1.43M | maxcount); |
2484 | 1.43M | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
2485 | 44.6k | { |
2486 | 44.6k | *value = 0; |
2487 | 44.6k | return (err); |
2488 | 44.6k | } |
2489 | 1.39M | switch (direntry->tdir_type) |
2490 | 1.39M | { |
2491 | 13.7k | case TIFF_LONG8: |
2492 | 14.0k | case TIFF_IFD8: |
2493 | 14.0k | *value = (uint64_t *)origdata; |
2494 | 14.0k | if (tif->tif_flags & TIFF_SWAB) |
2495 | 230 | TIFFSwabArrayOfLong8(*value, count); |
2496 | 14.0k | return (TIFFReadDirEntryErrOk); |
2497 | 6.79k | case TIFF_SLONG8: |
2498 | 6.79k | { |
2499 | 6.79k | int64_t *m; |
2500 | 6.79k | uint32_t n; |
2501 | 6.79k | m = (int64_t *)origdata; |
2502 | 14.5k | for (n = 0; n < count; n++) |
2503 | 8.37k | { |
2504 | 8.37k | if (tif->tif_flags & TIFF_SWAB) |
2505 | 169 | TIFFSwabLong8((uint64_t *)m); |
2506 | 8.37k | err = TIFFReadDirEntryCheckRangeLong8Slong8(*m); |
2507 | 8.37k | if (err != TIFFReadDirEntryErrOk) |
2508 | 641 | { |
2509 | 641 | _TIFFfreeExt(tif, origdata); |
2510 | 641 | return (err); |
2511 | 641 | } |
2512 | 7.72k | m++; |
2513 | 7.72k | } |
2514 | 6.15k | *value = (uint64_t *)origdata; |
2515 | 6.15k | return (TIFFReadDirEntryErrOk); |
2516 | 6.79k | } |
2517 | 1.37M | default: |
2518 | 1.37M | break; |
2519 | 1.39M | } |
2520 | 1.37M | data = (uint64_t *)_TIFFmallocExt(tif, count * 8); |
2521 | 1.37M | if (data == 0) |
2522 | 0 | { |
2523 | 0 | _TIFFfreeExt(tif, origdata); |
2524 | 0 | return (TIFFReadDirEntryErrAlloc); |
2525 | 0 | } |
2526 | 1.37M | switch (direntry->tdir_type) |
2527 | 1.37M | { |
2528 | 18.6k | case TIFF_BYTE: |
2529 | 18.6k | { |
2530 | 18.6k | uint8_t *ma; |
2531 | 18.6k | uint64_t *mb; |
2532 | 18.6k | uint32_t n; |
2533 | 18.6k | ma = (uint8_t *)origdata; |
2534 | 18.6k | mb = data; |
2535 | 75.7k | for (n = 0; n < count; n++) |
2536 | 57.1k | *mb++ = (uint64_t)(*ma++); |
2537 | 18.6k | } |
2538 | 18.6k | break; |
2539 | 14.0k | case TIFF_SBYTE: |
2540 | 14.0k | { |
2541 | 14.0k | int8_t *ma; |
2542 | 14.0k | uint64_t *mb; |
2543 | 14.0k | uint32_t n; |
2544 | 14.0k | ma = (int8_t *)origdata; |
2545 | 14.0k | mb = data; |
2546 | 29.6k | for (n = 0; n < count; n++) |
2547 | 15.9k | { |
2548 | 15.9k | err = TIFFReadDirEntryCheckRangeLong8Sbyte(*ma); |
2549 | 15.9k | if (err != TIFFReadDirEntryErrOk) |
2550 | 361 | break; |
2551 | 15.5k | *mb++ = (uint64_t)(*ma++); |
2552 | 15.5k | } |
2553 | 14.0k | } |
2554 | 14.0k | break; |
2555 | 35.7k | case TIFF_SHORT: |
2556 | 35.7k | { |
2557 | 35.7k | uint16_t *ma; |
2558 | 35.7k | uint64_t *mb; |
2559 | 35.7k | uint32_t n; |
2560 | 35.7k | ma = (uint16_t *)origdata; |
2561 | 35.7k | mb = data; |
2562 | 385k | for (n = 0; n < count; n++) |
2563 | 350k | { |
2564 | 350k | if (tif->tif_flags & TIFF_SWAB) |
2565 | 266 | TIFFSwabShort(ma); |
2566 | 350k | *mb++ = (uint64_t)(*ma++); |
2567 | 350k | } |
2568 | 35.7k | } |
2569 | 35.7k | break; |
2570 | 3.71k | case TIFF_SSHORT: |
2571 | 3.71k | { |
2572 | 3.71k | int16_t *ma; |
2573 | 3.71k | uint64_t *mb; |
2574 | 3.71k | uint32_t n; |
2575 | 3.71k | ma = (int16_t *)origdata; |
2576 | 3.71k | mb = data; |
2577 | 7.67k | for (n = 0; n < count; n++) |
2578 | 4.34k | { |
2579 | 4.34k | if (tif->tif_flags & TIFF_SWAB) |
2580 | 118 | TIFFSwabShort((uint16_t *)ma); |
2581 | 4.34k | err = TIFFReadDirEntryCheckRangeLong8Sshort(*ma); |
2582 | 4.34k | if (err != TIFFReadDirEntryErrOk) |
2583 | 380 | break; |
2584 | 3.96k | *mb++ = (uint64_t)(*ma++); |
2585 | 3.96k | } |
2586 | 3.71k | } |
2587 | 3.71k | break; |
2588 | 1.29M | case TIFF_LONG: |
2589 | 1.29M | case TIFF_IFD: |
2590 | 1.29M | { |
2591 | 1.29M | uint32_t *ma; |
2592 | 1.29M | uint64_t *mb; |
2593 | 1.29M | uint32_t n; |
2594 | 1.29M | ma = (uint32_t *)origdata; |
2595 | 1.29M | mb = data; |
2596 | 2.65M | for (n = 0; n < count; n++) |
2597 | 1.36M | { |
2598 | 1.36M | if (tif->tif_flags & TIFF_SWAB) |
2599 | 3.00k | TIFFSwabLong(ma); |
2600 | 1.36M | *mb++ = (uint64_t)(*ma++); |
2601 | 1.36M | } |
2602 | 1.29M | } |
2603 | 1.29M | break; |
2604 | 5.18k | case TIFF_SLONG: |
2605 | 5.18k | { |
2606 | 5.18k | int32_t *ma; |
2607 | 5.18k | uint64_t *mb; |
2608 | 5.18k | uint32_t n; |
2609 | 5.18k | ma = (int32_t *)origdata; |
2610 | 5.18k | mb = data; |
2611 | 12.1k | for (n = 0; n < count; n++) |
2612 | 7.52k | { |
2613 | 7.52k | if (tif->tif_flags & TIFF_SWAB) |
2614 | 272 | TIFFSwabLong((uint32_t *)ma); |
2615 | 7.52k | err = TIFFReadDirEntryCheckRangeLong8Slong(*ma); |
2616 | 7.52k | if (err != TIFFReadDirEntryErrOk) |
2617 | 554 | break; |
2618 | 6.97k | *mb++ = (uint64_t)(*ma++); |
2619 | 6.97k | } |
2620 | 5.18k | } |
2621 | 5.18k | break; |
2622 | 0 | default: |
2623 | 0 | break; |
2624 | 1.37M | } |
2625 | 1.37M | _TIFFfreeExt(tif, origdata); |
2626 | 1.37M | if (err != TIFFReadDirEntryErrOk) |
2627 | 1.29k | { |
2628 | 1.29k | _TIFFfreeExt(tif, data); |
2629 | 1.29k | return (err); |
2630 | 1.29k | } |
2631 | 1.37M | *value = data; |
2632 | 1.37M | return (TIFFReadDirEntryErrOk); |
2633 | 1.37M | } |
2634 | | |
2635 | | static enum TIFFReadDirEntryErr |
2636 | | TIFFReadDirEntryLong8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value) |
2637 | 60.4k | { |
2638 | 60.4k | return TIFFReadDirEntryLong8ArrayWithLimit(tif, direntry, value, |
2639 | 60.4k | ~((uint64_t)0)); |
2640 | 60.4k | } |
2641 | | |
2642 | | static enum TIFFReadDirEntryErr |
2643 | | TIFFReadDirEntrySlong8Array(TIFF *tif, TIFFDirEntry *direntry, int64_t **value) |
2644 | 26.5k | { |
2645 | 26.5k | enum TIFFReadDirEntryErr err; |
2646 | 26.5k | uint32_t count; |
2647 | 26.5k | void *origdata; |
2648 | 26.5k | int64_t *data; |
2649 | 26.5k | switch (direntry->tdir_type) |
2650 | 26.5k | { |
2651 | 0 | case TIFF_BYTE: |
2652 | 0 | case TIFF_SBYTE: |
2653 | 0 | case TIFF_SHORT: |
2654 | 0 | case TIFF_SSHORT: |
2655 | 0 | case TIFF_LONG: |
2656 | 0 | case TIFF_SLONG: |
2657 | 0 | case TIFF_LONG8: |
2658 | 26.5k | case TIFF_SLONG8: |
2659 | 26.5k | break; |
2660 | 0 | default: |
2661 | 0 | return (TIFFReadDirEntryErrType); |
2662 | 26.5k | } |
2663 | 26.5k | err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata); |
2664 | 26.5k | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
2665 | 21.5k | { |
2666 | 21.5k | *value = 0; |
2667 | 21.5k | return (err); |
2668 | 21.5k | } |
2669 | 4.99k | switch (direntry->tdir_type) |
2670 | 4.99k | { |
2671 | 0 | case TIFF_LONG8: |
2672 | 0 | { |
2673 | 0 | uint64_t *m; |
2674 | 0 | uint32_t n; |
2675 | 0 | m = (uint64_t *)origdata; |
2676 | 0 | for (n = 0; n < count; n++) |
2677 | 0 | { |
2678 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2679 | 0 | TIFFSwabLong8(m); |
2680 | 0 | err = TIFFReadDirEntryCheckRangeSlong8Long8(*m); |
2681 | 0 | if (err != TIFFReadDirEntryErrOk) |
2682 | 0 | { |
2683 | 0 | _TIFFfreeExt(tif, origdata); |
2684 | 0 | return (err); |
2685 | 0 | } |
2686 | 0 | m++; |
2687 | 0 | } |
2688 | 0 | *value = (int64_t *)origdata; |
2689 | 0 | return (TIFFReadDirEntryErrOk); |
2690 | 0 | } |
2691 | 4.99k | case TIFF_SLONG8: |
2692 | 4.99k | *value = (int64_t *)origdata; |
2693 | 4.99k | if (tif->tif_flags & TIFF_SWAB) |
2694 | 199 | TIFFSwabArrayOfLong8((uint64_t *)(*value), count); |
2695 | 4.99k | return (TIFFReadDirEntryErrOk); |
2696 | 0 | default: |
2697 | 0 | break; |
2698 | 4.99k | } |
2699 | 0 | data = (int64_t *)_TIFFmallocExt(tif, count * 8); |
2700 | 0 | if (data == 0) |
2701 | 0 | { |
2702 | 0 | _TIFFfreeExt(tif, origdata); |
2703 | 0 | return (TIFFReadDirEntryErrAlloc); |
2704 | 0 | } |
2705 | 0 | switch (direntry->tdir_type) |
2706 | 0 | { |
2707 | 0 | case TIFF_BYTE: |
2708 | 0 | { |
2709 | 0 | uint8_t *ma; |
2710 | 0 | int64_t *mb; |
2711 | 0 | uint32_t n; |
2712 | 0 | ma = (uint8_t *)origdata; |
2713 | 0 | mb = data; |
2714 | 0 | for (n = 0; n < count; n++) |
2715 | 0 | *mb++ = (int64_t)(*ma++); |
2716 | 0 | } |
2717 | 0 | break; |
2718 | 0 | case TIFF_SBYTE: |
2719 | 0 | { |
2720 | 0 | int8_t *ma; |
2721 | 0 | int64_t *mb; |
2722 | 0 | uint32_t n; |
2723 | 0 | ma = (int8_t *)origdata; |
2724 | 0 | mb = data; |
2725 | 0 | for (n = 0; n < count; n++) |
2726 | 0 | *mb++ = (int64_t)(*ma++); |
2727 | 0 | } |
2728 | 0 | break; |
2729 | 0 | case TIFF_SHORT: |
2730 | 0 | { |
2731 | 0 | uint16_t *ma; |
2732 | 0 | int64_t *mb; |
2733 | 0 | uint32_t n; |
2734 | 0 | ma = (uint16_t *)origdata; |
2735 | 0 | mb = data; |
2736 | 0 | for (n = 0; n < count; n++) |
2737 | 0 | { |
2738 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2739 | 0 | TIFFSwabShort(ma); |
2740 | 0 | *mb++ = (int64_t)(*ma++); |
2741 | 0 | } |
2742 | 0 | } |
2743 | 0 | break; |
2744 | 0 | case TIFF_SSHORT: |
2745 | 0 | { |
2746 | 0 | int16_t *ma; |
2747 | 0 | int64_t *mb; |
2748 | 0 | uint32_t n; |
2749 | 0 | ma = (int16_t *)origdata; |
2750 | 0 | mb = data; |
2751 | 0 | for (n = 0; n < count; n++) |
2752 | 0 | { |
2753 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2754 | 0 | TIFFSwabShort((uint16_t *)ma); |
2755 | 0 | *mb++ = (int64_t)(*ma++); |
2756 | 0 | } |
2757 | 0 | } |
2758 | 0 | break; |
2759 | 0 | case TIFF_LONG: |
2760 | 0 | { |
2761 | 0 | uint32_t *ma; |
2762 | 0 | int64_t *mb; |
2763 | 0 | uint32_t n; |
2764 | 0 | ma = (uint32_t *)origdata; |
2765 | 0 | mb = data; |
2766 | 0 | for (n = 0; n < count; n++) |
2767 | 0 | { |
2768 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2769 | 0 | TIFFSwabLong(ma); |
2770 | 0 | *mb++ = (int64_t)(*ma++); |
2771 | 0 | } |
2772 | 0 | } |
2773 | 0 | break; |
2774 | 0 | case TIFF_SLONG: |
2775 | 0 | { |
2776 | 0 | int32_t *ma; |
2777 | 0 | int64_t *mb; |
2778 | 0 | uint32_t n; |
2779 | 0 | ma = (int32_t *)origdata; |
2780 | 0 | mb = data; |
2781 | 0 | for (n = 0; n < count; n++) |
2782 | 0 | { |
2783 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2784 | 0 | TIFFSwabLong((uint32_t *)ma); |
2785 | 0 | *mb++ = (int64_t)(*ma++); |
2786 | 0 | } |
2787 | 0 | } |
2788 | 0 | break; |
2789 | 0 | default: |
2790 | 0 | break; |
2791 | 0 | } |
2792 | 0 | _TIFFfreeExt(tif, origdata); |
2793 | 0 | *value = data; |
2794 | 0 | return (TIFFReadDirEntryErrOk); |
2795 | 0 | } |
2796 | | |
2797 | | static enum TIFFReadDirEntryErr |
2798 | | TIFFReadDirEntryFloatArray(TIFF *tif, TIFFDirEntry *direntry, float **value) |
2799 | 156k | { |
2800 | 156k | enum TIFFReadDirEntryErr err; |
2801 | 156k | uint32_t count; |
2802 | 156k | void *origdata; |
2803 | 156k | float *data; |
2804 | 156k | switch (direntry->tdir_type) |
2805 | 156k | { |
2806 | 1.52k | case TIFF_BYTE: |
2807 | 2.18k | case TIFF_SBYTE: |
2808 | 4.40k | case TIFF_SHORT: |
2809 | 6.18k | case TIFF_SSHORT: |
2810 | 7.52k | case TIFF_LONG: |
2811 | 8.44k | case TIFF_SLONG: |
2812 | 9.26k | case TIFF_LONG8: |
2813 | 10.4k | case TIFF_SLONG8: |
2814 | 65.6k | case TIFF_RATIONAL: |
2815 | 105k | case TIFF_SRATIONAL: |
2816 | 153k | case TIFF_FLOAT: |
2817 | 155k | case TIFF_DOUBLE: |
2818 | 155k | break; |
2819 | 1.42k | default: |
2820 | 1.42k | return (TIFFReadDirEntryErrType); |
2821 | 156k | } |
2822 | 155k | err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata); |
2823 | 155k | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
2824 | 89.7k | { |
2825 | 89.7k | *value = 0; |
2826 | 89.7k | return (err); |
2827 | 89.7k | } |
2828 | 65.7k | switch (direntry->tdir_type) |
2829 | 65.7k | { |
2830 | 29.2k | case TIFF_FLOAT: |
2831 | 29.2k | if (tif->tif_flags & TIFF_SWAB) |
2832 | 86 | TIFFSwabArrayOfLong((uint32_t *)origdata, count); |
2833 | 29.2k | TIFFCvtIEEEFloatToNative(tif, count, (float *)origdata); |
2834 | 29.2k | *value = (float *)origdata; |
2835 | 29.2k | return (TIFFReadDirEntryErrOk); |
2836 | 36.4k | default: |
2837 | 36.4k | break; |
2838 | 65.7k | } |
2839 | 36.4k | data = |
2840 | 36.4k | (float *)_TIFFmallocExt(tif, (tmsize_t)((size_t)count * sizeof(float))); |
2841 | 36.4k | if (data == 0) |
2842 | 0 | { |
2843 | 0 | _TIFFfreeExt(tif, origdata); |
2844 | 0 | return (TIFFReadDirEntryErrAlloc); |
2845 | 0 | } |
2846 | 36.4k | switch (direntry->tdir_type) |
2847 | 36.4k | { |
2848 | 1.01k | case TIFF_BYTE: |
2849 | 1.01k | { |
2850 | 1.01k | uint8_t *ma; |
2851 | 1.01k | float *mb; |
2852 | 1.01k | uint32_t n; |
2853 | 1.01k | ma = (uint8_t *)origdata; |
2854 | 1.01k | mb = data; |
2855 | 42.4k | for (n = 0; n < count; n++) |
2856 | 41.4k | *mb++ = (float)(*ma++); |
2857 | 1.01k | } |
2858 | 1.01k | break; |
2859 | 465 | case TIFF_SBYTE: |
2860 | 465 | { |
2861 | 465 | int8_t *ma; |
2862 | 465 | float *mb; |
2863 | 465 | uint32_t n; |
2864 | 465 | ma = (int8_t *)origdata; |
2865 | 465 | mb = data; |
2866 | 12.2k | for (n = 0; n < count; n++) |
2867 | 11.7k | *mb++ = (float)(*ma++); |
2868 | 465 | } |
2869 | 465 | break; |
2870 | 1.46k | case TIFF_SHORT: |
2871 | 1.46k | { |
2872 | 1.46k | uint16_t *ma; |
2873 | 1.46k | float *mb; |
2874 | 1.46k | uint32_t n; |
2875 | 1.46k | ma = (uint16_t *)origdata; |
2876 | 1.46k | mb = data; |
2877 | 143k | for (n = 0; n < count; n++) |
2878 | 142k | { |
2879 | 142k | if (tif->tif_flags & TIFF_SWAB) |
2880 | 66.0k | TIFFSwabShort(ma); |
2881 | 142k | *mb++ = (float)(*ma++); |
2882 | 142k | } |
2883 | 1.46k | } |
2884 | 1.46k | break; |
2885 | 1.67k | case TIFF_SSHORT: |
2886 | 1.67k | { |
2887 | 1.67k | int16_t *ma; |
2888 | 1.67k | float *mb; |
2889 | 1.67k | uint32_t n; |
2890 | 1.67k | ma = (int16_t *)origdata; |
2891 | 1.67k | mb = data; |
2892 | 400k | for (n = 0; n < count; n++) |
2893 | 398k | { |
2894 | 398k | if (tif->tif_flags & TIFF_SWAB) |
2895 | 557 | TIFFSwabShort((uint16_t *)ma); |
2896 | 398k | *mb++ = (float)(*ma++); |
2897 | 398k | } |
2898 | 1.67k | } |
2899 | 1.67k | break; |
2900 | 1.09k | case TIFF_LONG: |
2901 | 1.09k | { |
2902 | 1.09k | uint32_t *ma; |
2903 | 1.09k | float *mb; |
2904 | 1.09k | uint32_t n; |
2905 | 1.09k | ma = (uint32_t *)origdata; |
2906 | 1.09k | mb = data; |
2907 | 78.6k | for (n = 0; n < count; n++) |
2908 | 77.5k | { |
2909 | 77.5k | if (tif->tif_flags & TIFF_SWAB) |
2910 | 756 | TIFFSwabLong(ma); |
2911 | 77.5k | *mb++ = (float)(*ma++); |
2912 | 77.5k | } |
2913 | 1.09k | } |
2914 | 1.09k | break; |
2915 | 715 | case TIFF_SLONG: |
2916 | 715 | { |
2917 | 715 | int32_t *ma; |
2918 | 715 | float *mb; |
2919 | 715 | uint32_t n; |
2920 | 715 | ma = (int32_t *)origdata; |
2921 | 715 | mb = data; |
2922 | 500k | for (n = 0; n < count; n++) |
2923 | 500k | { |
2924 | 500k | if (tif->tif_flags & TIFF_SWAB) |
2925 | 869 | TIFFSwabLong((uint32_t *)ma); |
2926 | 500k | *mb++ = (float)(*ma++); |
2927 | 500k | } |
2928 | 715 | } |
2929 | 715 | break; |
2930 | 740 | case TIFF_LONG8: |
2931 | 740 | { |
2932 | 740 | uint64_t *ma; |
2933 | 740 | float *mb; |
2934 | 740 | uint32_t n; |
2935 | 740 | ma = (uint64_t *)origdata; |
2936 | 740 | mb = data; |
2937 | 7.65k | for (n = 0; n < count; n++) |
2938 | 6.91k | { |
2939 | 6.91k | if (tif->tif_flags & TIFF_SWAB) |
2940 | 489 | TIFFSwabLong8(ma); |
2941 | 6.91k | *mb++ = (float)(*ma++); |
2942 | 6.91k | } |
2943 | 740 | } |
2944 | 740 | break; |
2945 | 762 | case TIFF_SLONG8: |
2946 | 762 | { |
2947 | 762 | int64_t *ma; |
2948 | 762 | float *mb; |
2949 | 762 | uint32_t n; |
2950 | 762 | ma = (int64_t *)origdata; |
2951 | 762 | mb = data; |
2952 | 69.9k | for (n = 0; n < count; n++) |
2953 | 69.2k | { |
2954 | 69.2k | if (tif->tif_flags & TIFF_SWAB) |
2955 | 66.0k | TIFFSwabLong8((uint64_t *)ma); |
2956 | 69.2k | *mb++ = (float)(*ma++); |
2957 | 69.2k | } |
2958 | 762 | } |
2959 | 762 | break; |
2960 | 21.6k | case TIFF_RATIONAL: |
2961 | 21.6k | { |
2962 | 21.6k | uint32_t *ma; |
2963 | 21.6k | uint32_t maa; |
2964 | 21.6k | uint32_t mab; |
2965 | 21.6k | float *mb; |
2966 | 21.6k | uint32_t n; |
2967 | 21.6k | ma = (uint32_t *)origdata; |
2968 | 21.6k | mb = data; |
2969 | 772k | for (n = 0; n < count; n++) |
2970 | 751k | { |
2971 | 751k | if (tif->tif_flags & TIFF_SWAB) |
2972 | 11.7k | TIFFSwabLong(ma); |
2973 | 751k | maa = *ma++; |
2974 | 751k | if (tif->tif_flags & TIFF_SWAB) |
2975 | 11.7k | TIFFSwabLong(ma); |
2976 | 751k | mab = *ma++; |
2977 | 751k | if (mab == 0) |
2978 | 97.3k | *mb++ = 0.0; |
2979 | 653k | else |
2980 | 653k | *mb++ = (float)maa / (float)mab; |
2981 | 751k | } |
2982 | 21.6k | } |
2983 | 21.6k | break; |
2984 | 5.26k | case TIFF_SRATIONAL: |
2985 | 5.26k | { |
2986 | 5.26k | uint32_t *ma; |
2987 | 5.26k | int32_t maa; |
2988 | 5.26k | uint32_t mab; |
2989 | 5.26k | float *mb; |
2990 | 5.26k | uint32_t n; |
2991 | 5.26k | ma = (uint32_t *)origdata; |
2992 | 5.26k | mb = data; |
2993 | 289k | for (n = 0; n < count; n++) |
2994 | 283k | { |
2995 | 283k | if (tif->tif_flags & TIFF_SWAB) |
2996 | 9.67k | TIFFSwabLong(ma); |
2997 | 283k | maa = *(int32_t *)ma; |
2998 | 283k | ma++; |
2999 | 283k | if (tif->tif_flags & TIFF_SWAB) |
3000 | 9.67k | TIFFSwabLong(ma); |
3001 | 283k | mab = *ma++; |
3002 | 283k | if (mab == 0) |
3003 | 39.1k | *mb++ = 0.0; |
3004 | 244k | else |
3005 | 244k | *mb++ = (float)maa / (float)mab; |
3006 | 283k | } |
3007 | 5.26k | } |
3008 | 5.26k | break; |
3009 | 1.62k | case TIFF_DOUBLE: |
3010 | 1.62k | { |
3011 | 1.62k | double *ma; |
3012 | 1.62k | float *mb; |
3013 | 1.62k | uint32_t n; |
3014 | 1.62k | if (tif->tif_flags & TIFF_SWAB) |
3015 | 19 | TIFFSwabArrayOfLong8((uint64_t *)origdata, count); |
3016 | 1.62k | TIFFCvtIEEEDoubleToNative(tif, count, (double *)origdata); |
3017 | 1.62k | ma = (double *)origdata; |
3018 | 1.62k | mb = data; |
3019 | 179k | for (n = 0; n < count; n++) |
3020 | 178k | { |
3021 | 178k | double val = *ma++; |
3022 | 178k | if (val > (double)FLT_MAX) |
3023 | 35.5k | val = (double)FLT_MAX; |
3024 | 142k | else if (val < -(double)FLT_MAX) |
3025 | 23.0k | val = -(double)FLT_MAX; |
3026 | 178k | *mb++ = (float)val; |
3027 | 178k | } |
3028 | 1.62k | } |
3029 | 1.62k | break; |
3030 | 0 | default: |
3031 | 0 | break; |
3032 | 36.4k | } |
3033 | 36.4k | _TIFFfreeExt(tif, origdata); |
3034 | 36.4k | *value = data; |
3035 | 36.4k | return (TIFFReadDirEntryErrOk); |
3036 | 36.4k | } |
3037 | | |
3038 | | static enum TIFFReadDirEntryErr |
3039 | | TIFFReadDirEntryDoubleArray(TIFF *tif, TIFFDirEntry *direntry, double **value) |
3040 | 255k | { |
3041 | 255k | enum TIFFReadDirEntryErr err; |
3042 | 255k | uint32_t count; |
3043 | 255k | void *origdata; |
3044 | 255k | double *data; |
3045 | 255k | switch (direntry->tdir_type) |
3046 | 255k | { |
3047 | 6.84k | case TIFF_BYTE: |
3048 | 7.92k | case TIFF_SBYTE: |
3049 | 13.9k | case TIFF_SHORT: |
3050 | 18.0k | case TIFF_SSHORT: |
3051 | 19.4k | case TIFF_LONG: |
3052 | 21.8k | case TIFF_SLONG: |
3053 | 22.6k | case TIFF_LONG8: |
3054 | 23.8k | case TIFF_SLONG8: |
3055 | 25.5k | case TIFF_RATIONAL: |
3056 | 27.8k | case TIFF_SRATIONAL: |
3057 | 29.5k | case TIFF_FLOAT: |
3058 | 241k | case TIFF_DOUBLE: |
3059 | 241k | break; |
3060 | 14.1k | default: |
3061 | 14.1k | return (TIFFReadDirEntryErrType); |
3062 | 255k | } |
3063 | 241k | err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata); |
3064 | 241k | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
3065 | 110k | { |
3066 | 110k | *value = 0; |
3067 | 110k | return (err); |
3068 | 110k | } |
3069 | 130k | switch (direntry->tdir_type) |
3070 | 130k | { |
3071 | 105k | case TIFF_DOUBLE: |
3072 | 105k | if (tif->tif_flags & TIFF_SWAB) |
3073 | 146 | TIFFSwabArrayOfLong8((uint64_t *)origdata, count); |
3074 | 105k | TIFFCvtIEEEDoubleToNative(tif, count, (double *)origdata); |
3075 | 105k | *value = (double *)origdata; |
3076 | 105k | return (TIFFReadDirEntryErrOk); |
3077 | 24.9k | default: |
3078 | 24.9k | break; |
3079 | 130k | } |
3080 | 24.9k | data = (double *)_TIFFmallocExt(tif, |
3081 | 24.9k | (tmsize_t)((size_t)count * sizeof(double))); |
3082 | 24.9k | if (data == 0) |
3083 | 0 | { |
3084 | 0 | _TIFFfreeExt(tif, origdata); |
3085 | 0 | return (TIFFReadDirEntryErrAlloc); |
3086 | 0 | } |
3087 | 24.9k | switch (direntry->tdir_type) |
3088 | 24.9k | { |
3089 | 5.85k | case TIFF_BYTE: |
3090 | 5.85k | { |
3091 | 5.85k | uint8_t *ma; |
3092 | 5.85k | double *mb; |
3093 | 5.85k | uint32_t n; |
3094 | 5.85k | ma = (uint8_t *)origdata; |
3095 | 5.85k | mb = data; |
3096 | 449k | for (n = 0; n < count; n++) |
3097 | 443k | *mb++ = (double)(*ma++); |
3098 | 5.85k | } |
3099 | 5.85k | break; |
3100 | 1.00k | case TIFF_SBYTE: |
3101 | 1.00k | { |
3102 | 1.00k | int8_t *ma; |
3103 | 1.00k | double *mb; |
3104 | 1.00k | uint32_t n; |
3105 | 1.00k | ma = (int8_t *)origdata; |
3106 | 1.00k | mb = data; |
3107 | 36.4k | for (n = 0; n < count; n++) |
3108 | 35.4k | *mb++ = (double)(*ma++); |
3109 | 1.00k | } |
3110 | 1.00k | break; |
3111 | 5.75k | case TIFF_SHORT: |
3112 | 5.75k | { |
3113 | 5.75k | uint16_t *ma; |
3114 | 5.75k | double *mb; |
3115 | 5.75k | uint32_t n; |
3116 | 5.75k | ma = (uint16_t *)origdata; |
3117 | 5.75k | mb = data; |
3118 | 35.6k | for (n = 0; n < count; n++) |
3119 | 29.8k | { |
3120 | 29.8k | if (tif->tif_flags & TIFF_SWAB) |
3121 | 595 | TIFFSwabShort(ma); |
3122 | 29.8k | *mb++ = (double)(*ma++); |
3123 | 29.8k | } |
3124 | 5.75k | } |
3125 | 5.75k | break; |
3126 | 3.64k | case TIFF_SSHORT: |
3127 | 3.64k | { |
3128 | 3.64k | int16_t *ma; |
3129 | 3.64k | double *mb; |
3130 | 3.64k | uint32_t n; |
3131 | 3.64k | ma = (int16_t *)origdata; |
3132 | 3.64k | mb = data; |
3133 | 45.0k | for (n = 0; n < count; n++) |
3134 | 41.3k | { |
3135 | 41.3k | if (tif->tif_flags & TIFF_SWAB) |
3136 | 461 | TIFFSwabShort((uint16_t *)ma); |
3137 | 41.3k | *mb++ = (double)(*ma++); |
3138 | 41.3k | } |
3139 | 3.64k | } |
3140 | 3.64k | break; |
3141 | 1.28k | case TIFF_LONG: |
3142 | 1.28k | { |
3143 | 1.28k | uint32_t *ma; |
3144 | 1.28k | double *mb; |
3145 | 1.28k | uint32_t n; |
3146 | 1.28k | ma = (uint32_t *)origdata; |
3147 | 1.28k | mb = data; |
3148 | 29.3k | for (n = 0; n < count; n++) |
3149 | 28.0k | { |
3150 | 28.0k | if (tif->tif_flags & TIFF_SWAB) |
3151 | 277 | TIFFSwabLong(ma); |
3152 | 28.0k | *mb++ = (double)(*ma++); |
3153 | 28.0k | } |
3154 | 1.28k | } |
3155 | 1.28k | break; |
3156 | 1.29k | case TIFF_SLONG: |
3157 | 1.29k | { |
3158 | 1.29k | int32_t *ma; |
3159 | 1.29k | double *mb; |
3160 | 1.29k | uint32_t n; |
3161 | 1.29k | ma = (int32_t *)origdata; |
3162 | 1.29k | mb = data; |
3163 | 31.0k | for (n = 0; n < count; n++) |
3164 | 29.7k | { |
3165 | 29.7k | if (tif->tif_flags & TIFF_SWAB) |
3166 | 173 | TIFFSwabLong((uint32_t *)ma); |
3167 | 29.7k | *mb++ = (double)(*ma++); |
3168 | 29.7k | } |
3169 | 1.29k | } |
3170 | 1.29k | break; |
3171 | 757 | case TIFF_LONG8: |
3172 | 757 | { |
3173 | 757 | uint64_t *ma; |
3174 | 757 | double *mb; |
3175 | 757 | uint32_t n; |
3176 | 757 | ma = (uint64_t *)origdata; |
3177 | 757 | mb = data; |
3178 | 13.2k | for (n = 0; n < count; n++) |
3179 | 12.4k | { |
3180 | 12.4k | if (tif->tif_flags & TIFF_SWAB) |
3181 | 211 | TIFFSwabLong8(ma); |
3182 | 12.4k | *mb++ = (double)(*ma++); |
3183 | 12.4k | } |
3184 | 757 | } |
3185 | 757 | break; |
3186 | 1.14k | case TIFF_SLONG8: |
3187 | 1.14k | { |
3188 | 1.14k | int64_t *ma; |
3189 | 1.14k | double *mb; |
3190 | 1.14k | uint32_t n; |
3191 | 1.14k | ma = (int64_t *)origdata; |
3192 | 1.14k | mb = data; |
3193 | 32.6k | for (n = 0; n < count; n++) |
3194 | 31.5k | { |
3195 | 31.5k | if (tif->tif_flags & TIFF_SWAB) |
3196 | 178 | TIFFSwabLong8((uint64_t *)ma); |
3197 | 31.5k | *mb++ = (double)(*ma++); |
3198 | 31.5k | } |
3199 | 1.14k | } |
3200 | 1.14k | break; |
3201 | 1.25k | case TIFF_RATIONAL: |
3202 | 1.25k | { |
3203 | 1.25k | uint32_t *ma; |
3204 | 1.25k | uint32_t maa; |
3205 | 1.25k | uint32_t mab; |
3206 | 1.25k | double *mb; |
3207 | 1.25k | uint32_t n; |
3208 | 1.25k | ma = (uint32_t *)origdata; |
3209 | 1.25k | mb = data; |
3210 | 511k | for (n = 0; n < count; n++) |
3211 | 509k | { |
3212 | 509k | if (tif->tif_flags & TIFF_SWAB) |
3213 | 1.12k | TIFFSwabLong(ma); |
3214 | 509k | maa = *ma++; |
3215 | 509k | if (tif->tif_flags & TIFF_SWAB) |
3216 | 1.12k | TIFFSwabLong(ma); |
3217 | 509k | mab = *ma++; |
3218 | 509k | if (mab == 0) |
3219 | 303k | *mb++ = 0.0; |
3220 | 206k | else |
3221 | 206k | *mb++ = (double)maa / (double)mab; |
3222 | 509k | } |
3223 | 1.25k | } |
3224 | 1.25k | break; |
3225 | 2.22k | case TIFF_SRATIONAL: |
3226 | 2.22k | { |
3227 | 2.22k | uint32_t *ma; |
3228 | 2.22k | int32_t maa; |
3229 | 2.22k | uint32_t mab; |
3230 | 2.22k | double *mb; |
3231 | 2.22k | uint32_t n; |
3232 | 2.22k | ma = (uint32_t *)origdata; |
3233 | 2.22k | mb = data; |
3234 | 101k | for (n = 0; n < count; n++) |
3235 | 99.2k | { |
3236 | 99.2k | if (tif->tif_flags & TIFF_SWAB) |
3237 | 189 | TIFFSwabLong(ma); |
3238 | 99.2k | maa = *(int32_t *)ma; |
3239 | 99.2k | ma++; |
3240 | 99.2k | if (tif->tif_flags & TIFF_SWAB) |
3241 | 189 | TIFFSwabLong(ma); |
3242 | 99.2k | mab = *ma++; |
3243 | 99.2k | if (mab == 0) |
3244 | 6.98k | *mb++ = 0.0; |
3245 | 92.3k | else |
3246 | 92.3k | *mb++ = (double)maa / (double)mab; |
3247 | 99.2k | } |
3248 | 2.22k | } |
3249 | 2.22k | break; |
3250 | 700 | case TIFF_FLOAT: |
3251 | 700 | { |
3252 | 700 | float *ma; |
3253 | 700 | double *mb; |
3254 | 700 | uint32_t n; |
3255 | 700 | if (tif->tif_flags & TIFF_SWAB) |
3256 | 40 | TIFFSwabArrayOfLong((uint32_t *)origdata, count); |
3257 | 700 | TIFFCvtIEEEFloatToNative(tif, count, (float *)origdata); |
3258 | 700 | ma = (float *)origdata; |
3259 | 700 | mb = data; |
3260 | 14.5k | for (n = 0; n < count; n++) |
3261 | 13.8k | *mb++ = (double)(*ma++); |
3262 | 700 | } |
3263 | 700 | break; |
3264 | 0 | default: |
3265 | 0 | break; |
3266 | 24.9k | } |
3267 | 24.9k | _TIFFfreeExt(tif, origdata); |
3268 | 24.9k | *value = data; |
3269 | 24.9k | return (TIFFReadDirEntryErrOk); |
3270 | 24.9k | } |
3271 | | |
3272 | | static enum TIFFReadDirEntryErr |
3273 | | TIFFReadDirEntryIfd8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value) |
3274 | 253k | { |
3275 | 253k | enum TIFFReadDirEntryErr err; |
3276 | 253k | uint32_t count; |
3277 | 253k | void *origdata; |
3278 | 253k | uint64_t *data; |
3279 | 253k | switch (direntry->tdir_type) |
3280 | 253k | { |
3281 | 195k | case TIFF_LONG: |
3282 | 203k | case TIFF_LONG8: |
3283 | 230k | case TIFF_IFD: |
3284 | 251k | case TIFF_IFD8: |
3285 | 251k | break; |
3286 | 2.28k | default: |
3287 | 2.28k | return (TIFFReadDirEntryErrType); |
3288 | 253k | } |
3289 | 251k | err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata); |
3290 | 251k | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
3291 | 43.8k | { |
3292 | 43.8k | *value = 0; |
3293 | 43.8k | return (err); |
3294 | 43.8k | } |
3295 | 207k | switch (direntry->tdir_type) |
3296 | 207k | { |
3297 | 7.00k | case TIFF_LONG8: |
3298 | 11.0k | case TIFF_IFD8: |
3299 | 11.0k | *value = (uint64_t *)origdata; |
3300 | 11.0k | if (tif->tif_flags & TIFF_SWAB) |
3301 | 195 | TIFFSwabArrayOfLong8(*value, count); |
3302 | 11.0k | return (TIFFReadDirEntryErrOk); |
3303 | 196k | default: |
3304 | 196k | break; |
3305 | 207k | } |
3306 | 196k | data = (uint64_t *)_TIFFmallocExt(tif, count * 8); |
3307 | 196k | if (data == 0) |
3308 | 0 | { |
3309 | 0 | _TIFFfreeExt(tif, origdata); |
3310 | 0 | return (TIFFReadDirEntryErrAlloc); |
3311 | 0 | } |
3312 | 196k | switch (direntry->tdir_type) |
3313 | 196k | { |
3314 | 188k | case TIFF_LONG: |
3315 | 196k | case TIFF_IFD: |
3316 | 196k | { |
3317 | 196k | uint32_t *ma; |
3318 | 196k | uint64_t *mb; |
3319 | 196k | uint32_t n; |
3320 | 196k | ma = (uint32_t *)origdata; |
3321 | 196k | mb = data; |
3322 | 34.2M | for (n = 0; n < count; n++) |
3323 | 34.0M | { |
3324 | 34.0M | if (tif->tif_flags & TIFF_SWAB) |
3325 | 30.2k | TIFFSwabLong(ma); |
3326 | 34.0M | *mb++ = (uint64_t)(*ma++); |
3327 | 34.0M | } |
3328 | 196k | } |
3329 | 196k | break; |
3330 | 0 | default: |
3331 | 0 | break; |
3332 | 196k | } |
3333 | 196k | _TIFFfreeExt(tif, origdata); |
3334 | 196k | *value = data; |
3335 | 196k | return (TIFFReadDirEntryErrOk); |
3336 | 196k | } |
3337 | | |
3338 | | static enum TIFFReadDirEntryErr |
3339 | | TIFFReadDirEntryPersampleShort(TIFF *tif, TIFFDirEntry *direntry, |
3340 | | uint16_t *value) |
3341 | 188k | { |
3342 | 188k | enum TIFFReadDirEntryErr err; |
3343 | 188k | uint16_t *m; |
3344 | 188k | uint16_t *na; |
3345 | 188k | uint16_t nb; |
3346 | 188k | if (direntry->tdir_count != (uint64_t)tif->tif_dir.td_samplesperpixel) |
3347 | 21.0k | { |
3348 | 21.0k | const TIFFField *fip = TIFFFieldWithTag(tif, direntry->tdir_tag); |
3349 | 21.0k | if (direntry->tdir_count == 0) |
3350 | 124 | { |
3351 | 124 | return TIFFReadDirEntryErrCount; |
3352 | 124 | } |
3353 | 20.9k | else if (direntry->tdir_count < |
3354 | 20.9k | (uint64_t)tif->tif_dir.td_samplesperpixel) |
3355 | 1.81k | { |
3356 | 1.81k | TIFFWarningExtR( |
3357 | 1.81k | tif, "TIFFReadDirEntryPersampleShort", |
3358 | 1.81k | "Tag %s entry count is %" PRIu64 |
3359 | 1.81k | " , whereas it should be SamplesPerPixel=%d. Assuming that " |
3360 | 1.81k | "missing entries are all at the value of the first one", |
3361 | 1.81k | fip ? fip->field_name : "unknown tagname", direntry->tdir_count, |
3362 | 1.81k | tif->tif_dir.td_samplesperpixel); |
3363 | 1.81k | } |
3364 | 19.1k | else |
3365 | 19.1k | { |
3366 | 19.1k | TIFFWarningExtR(tif, "TIFFReadDirEntryPersampleShort", |
3367 | 19.1k | "Tag %s entry count is %" PRIu64 |
3368 | 19.1k | " , whereas it should be SamplesPerPixel=%d. " |
3369 | 19.1k | "Ignoring extra entries", |
3370 | 19.1k | fip ? fip->field_name : "unknown tagname", |
3371 | 19.1k | direntry->tdir_count, |
3372 | 19.1k | tif->tif_dir.td_samplesperpixel); |
3373 | 19.1k | } |
3374 | 21.0k | } |
3375 | 188k | err = TIFFReadDirEntryShortArray(tif, direntry, &m); |
3376 | 188k | if (err != TIFFReadDirEntryErrOk || m == NULL) |
3377 | 3.96k | return (err); |
3378 | 184k | na = m; |
3379 | 184k | nb = tif->tif_dir.td_samplesperpixel; |
3380 | 184k | if (direntry->tdir_count < nb) |
3381 | 1.81k | nb = (uint16_t)direntry->tdir_count; |
3382 | 184k | *value = *na++; |
3383 | 184k | nb--; |
3384 | 2.19M | while (nb > 0) |
3385 | 2.00M | { |
3386 | 2.00M | if (*na++ != *value) |
3387 | 205 | { |
3388 | 205 | err = TIFFReadDirEntryErrPsdif; |
3389 | 205 | break; |
3390 | 205 | } |
3391 | 2.00M | nb--; |
3392 | 2.00M | } |
3393 | 184k | _TIFFfreeExt(tif, m); |
3394 | 184k | return (err); |
3395 | 188k | } |
3396 | | |
3397 | | static void TIFFReadDirEntryCheckedByte(TIFF *tif, TIFFDirEntry *direntry, |
3398 | | uint8_t *value) |
3399 | 126k | { |
3400 | 126k | (void)tif; |
3401 | 126k | *value = *(uint8_t *)(&direntry->tdir_offset); |
3402 | 126k | } |
3403 | | |
3404 | | static void TIFFReadDirEntryCheckedSbyte(TIFF *tif, TIFFDirEntry *direntry, |
3405 | | int8_t *value) |
3406 | 37.7k | { |
3407 | 37.7k | (void)tif; |
3408 | 37.7k | *value = *(int8_t *)(&direntry->tdir_offset); |
3409 | 37.7k | } |
3410 | | |
3411 | | static void TIFFReadDirEntryCheckedShort(TIFF *tif, TIFFDirEntry *direntry, |
3412 | | uint16_t *value) |
3413 | 7.79M | { |
3414 | 7.79M | *value = direntry->tdir_offset.toff_short; |
3415 | | /* *value=*(uint16_t*)(&direntry->tdir_offset); */ |
3416 | 7.79M | if (tif->tif_flags & TIFF_SWAB) |
3417 | 13.9k | TIFFSwabShort(value); |
3418 | 7.79M | } |
3419 | | |
3420 | | static void TIFFReadDirEntryCheckedSshort(TIFF *tif, TIFFDirEntry *direntry, |
3421 | | int16_t *value) |
3422 | 64.1k | { |
3423 | 64.1k | *value = *(int16_t *)(&direntry->tdir_offset); |
3424 | 64.1k | if (tif->tif_flags & TIFF_SWAB) |
3425 | 533 | TIFFSwabShort((uint16_t *)value); |
3426 | 64.1k | } |
3427 | | |
3428 | | static void TIFFReadDirEntryCheckedLong(TIFF *tif, TIFFDirEntry *direntry, |
3429 | | uint32_t *value) |
3430 | 112k | { |
3431 | 112k | *value = *(uint32_t *)(&direntry->tdir_offset); |
3432 | 112k | if (tif->tif_flags & TIFF_SWAB) |
3433 | 3.90k | TIFFSwabLong(value); |
3434 | 112k | } |
3435 | | |
3436 | | static void TIFFReadDirEntryCheckedSlong(TIFF *tif, TIFFDirEntry *direntry, |
3437 | | int32_t *value) |
3438 | 42.5k | { |
3439 | 42.5k | *value = *(int32_t *)(&direntry->tdir_offset); |
3440 | 42.5k | if (tif->tif_flags & TIFF_SWAB) |
3441 | 707 | TIFFSwabLong((uint32_t *)value); |
3442 | 42.5k | } |
3443 | | |
3444 | | static enum TIFFReadDirEntryErr |
3445 | | TIFFReadDirEntryCheckedLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value) |
3446 | 20.2k | { |
3447 | 20.2k | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
3448 | 19.7k | { |
3449 | 19.7k | enum TIFFReadDirEntryErr err; |
3450 | 19.7k | uint32_t offset = direntry->tdir_offset.toff_long; |
3451 | 19.7k | if (tif->tif_flags & TIFF_SWAB) |
3452 | 249 | TIFFSwabLong(&offset); |
3453 | 19.7k | err = TIFFReadDirEntryData(tif, offset, 8, value); |
3454 | 19.7k | if (err != TIFFReadDirEntryErrOk) |
3455 | 3.49k | return (err); |
3456 | 19.7k | } |
3457 | 416 | else |
3458 | 416 | *value = direntry->tdir_offset.toff_long8; |
3459 | 16.7k | if (tif->tif_flags & TIFF_SWAB) |
3460 | 221 | TIFFSwabLong8(value); |
3461 | 16.7k | return (TIFFReadDirEntryErrOk); |
3462 | 20.2k | } |
3463 | | |
3464 | | static enum TIFFReadDirEntryErr |
3465 | | TIFFReadDirEntryCheckedSlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value) |
3466 | 22.0k | { |
3467 | 22.0k | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
3468 | 20.7k | { |
3469 | 20.7k | enum TIFFReadDirEntryErr err; |
3470 | 20.7k | uint32_t offset = direntry->tdir_offset.toff_long; |
3471 | 20.7k | if (tif->tif_flags & TIFF_SWAB) |
3472 | 271 | TIFFSwabLong(&offset); |
3473 | 20.7k | err = TIFFReadDirEntryData(tif, offset, 8, value); |
3474 | 20.7k | if (err != TIFFReadDirEntryErrOk) |
3475 | 8.45k | return (err); |
3476 | 20.7k | } |
3477 | 1.21k | else |
3478 | 1.21k | *value = *(int64_t *)(&direntry->tdir_offset); |
3479 | 13.5k | if (tif->tif_flags & TIFF_SWAB) |
3480 | 226 | TIFFSwabLong8((uint64_t *)value); |
3481 | 13.5k | return (TIFFReadDirEntryErrOk); |
3482 | 22.0k | } |
3483 | | |
3484 | | static enum TIFFReadDirEntryErr |
3485 | | TIFFReadDirEntryCheckedRational(TIFF *tif, TIFFDirEntry *direntry, |
3486 | | double *value) |
3487 | 21.9k | { |
3488 | 21.9k | UInt64Aligned_t m; |
3489 | | |
3490 | 21.9k | assert(sizeof(double) == 8); |
3491 | 21.9k | assert(sizeof(uint64_t) == 8); |
3492 | 21.9k | assert(sizeof(uint32_t) == 4); |
3493 | 21.9k | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
3494 | 21.9k | { |
3495 | 21.9k | enum TIFFReadDirEntryErr err; |
3496 | 21.9k | uint32_t offset = direntry->tdir_offset.toff_long; |
3497 | 21.9k | if (tif->tif_flags & TIFF_SWAB) |
3498 | 662 | TIFFSwabLong(&offset); |
3499 | 21.9k | err = TIFFReadDirEntryData(tif, offset, 8, m.i); |
3500 | 21.9k | if (err != TIFFReadDirEntryErrOk) |
3501 | 4.87k | return (err); |
3502 | 21.9k | } |
3503 | 18 | else |
3504 | 18 | m.l = direntry->tdir_offset.toff_long8; |
3505 | 17.0k | if (tif->tif_flags & TIFF_SWAB) |
3506 | 471 | TIFFSwabArrayOfLong(m.i, 2); |
3507 | | /* Not completely sure what we should do when m.i[1]==0, but some */ |
3508 | | /* sanitizers do not like division by 0.0: */ |
3509 | | /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */ |
3510 | 17.0k | if (m.i[0] == 0 || m.i[1] == 0) |
3511 | 2.65k | *value = 0.0; |
3512 | 14.4k | else |
3513 | 14.4k | *value = (double)m.i[0] / (double)m.i[1]; |
3514 | 17.0k | return (TIFFReadDirEntryErrOk); |
3515 | 21.9k | } |
3516 | | |
3517 | | static enum TIFFReadDirEntryErr |
3518 | | TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry, |
3519 | | double *value) |
3520 | 6.58k | { |
3521 | 6.58k | UInt64Aligned_t m; |
3522 | 6.58k | assert(sizeof(double) == 8); |
3523 | 6.58k | assert(sizeof(uint64_t) == 8); |
3524 | 6.58k | assert(sizeof(int32_t) == 4); |
3525 | 6.58k | assert(sizeof(uint32_t) == 4); |
3526 | 6.58k | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
3527 | 6.57k | { |
3528 | 6.57k | enum TIFFReadDirEntryErr err; |
3529 | 6.57k | uint32_t offset = direntry->tdir_offset.toff_long; |
3530 | 6.57k | if (tif->tif_flags & TIFF_SWAB) |
3531 | 61 | TIFFSwabLong(&offset); |
3532 | 6.57k | err = TIFFReadDirEntryData(tif, offset, 8, m.i); |
3533 | 6.57k | if (err != TIFFReadDirEntryErrOk) |
3534 | 2.60k | return (err); |
3535 | 6.57k | } |
3536 | 7 | else |
3537 | 7 | m.l = direntry->tdir_offset.toff_long8; |
3538 | 3.97k | if (tif->tif_flags & TIFF_SWAB) |
3539 | 49 | TIFFSwabArrayOfLong(m.i, 2); |
3540 | | /* Not completely sure what we should do when m.i[1]==0, but some */ |
3541 | | /* sanitizers do not like division by 0.0: */ |
3542 | | /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */ |
3543 | 3.97k | if ((int32_t)m.i[0] == 0 || m.i[1] == 0) |
3544 | 1.78k | *value = 0.0; |
3545 | 2.18k | else |
3546 | 2.18k | *value = (double)((int32_t)m.i[0]) / (double)m.i[1]; |
3547 | 3.97k | return (TIFFReadDirEntryErrOk); |
3548 | 6.58k | } |
3549 | | |
3550 | | #if 0 |
3551 | | static enum TIFFReadDirEntryErr |
3552 | | TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry, |
3553 | | TIFFRational_t *value) |
3554 | | { /*--: SetGetRATIONAL_directly:_CustomTag: Read rational (and signed rationals) |
3555 | | directly --*/ |
3556 | | UInt64Aligned_t m; |
3557 | | |
3558 | | assert(sizeof(double) == 8); |
3559 | | assert(sizeof(uint64_t) == 8); |
3560 | | assert(sizeof(uint32_t) == 4); |
3561 | | |
3562 | | if (direntry->tdir_count != 1) |
3563 | | return (TIFFReadDirEntryErrCount); |
3564 | | |
3565 | | if (direntry->tdir_type != TIFF_RATIONAL && |
3566 | | direntry->tdir_type != TIFF_SRATIONAL) |
3567 | | return (TIFFReadDirEntryErrType); |
3568 | | |
3569 | | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
3570 | | { |
3571 | | enum TIFFReadDirEntryErr err; |
3572 | | uint32_t offset = direntry->tdir_offset.toff_long; |
3573 | | if (tif->tif_flags & TIFF_SWAB) |
3574 | | TIFFSwabLong(&offset); |
3575 | | err = TIFFReadDirEntryData(tif, offset, 8, m.i); |
3576 | | if (err != TIFFReadDirEntryErrOk) |
3577 | | return (err); |
3578 | | } |
3579 | | else |
3580 | | { |
3581 | | m.l = direntry->tdir_offset.toff_long8; |
3582 | | } |
3583 | | |
3584 | | if (tif->tif_flags & TIFF_SWAB) |
3585 | | TIFFSwabArrayOfLong(m.i, 2); |
3586 | | |
3587 | | value->uNum = m.i[0]; |
3588 | | value->uDenom = m.i[1]; |
3589 | | return (TIFFReadDirEntryErrOk); |
3590 | | } /*-- TIFFReadDirEntryCheckedRationalDirect() --*/ |
3591 | | #endif |
3592 | | |
3593 | | static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry, |
3594 | | float *value) |
3595 | 1.60k | { |
3596 | 1.60k | union |
3597 | 1.60k | { |
3598 | 1.60k | float f; |
3599 | 1.60k | uint32_t i; |
3600 | 1.60k | } float_union; |
3601 | 1.60k | assert(sizeof(float) == 4); |
3602 | 1.60k | assert(sizeof(uint32_t) == 4); |
3603 | 1.60k | assert(sizeof(float_union) == 4); |
3604 | 1.60k | float_union.i = *(uint32_t *)(&direntry->tdir_offset); |
3605 | 1.60k | *value = float_union.f; |
3606 | 1.60k | if (tif->tif_flags & TIFF_SWAB) |
3607 | 114 | TIFFSwabLong((uint32_t *)value); |
3608 | 1.60k | } |
3609 | | |
3610 | | static enum TIFFReadDirEntryErr |
3611 | | TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value) |
3612 | 3.48k | { |
3613 | 3.48k | assert(sizeof(double) == 8); |
3614 | 3.48k | assert(sizeof(uint64_t) == 8); |
3615 | 3.48k | assert(sizeof(UInt64Aligned_t) == 8); |
3616 | 3.48k | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
3617 | 3.45k | { |
3618 | 3.45k | enum TIFFReadDirEntryErr err; |
3619 | 3.45k | uint32_t offset = direntry->tdir_offset.toff_long; |
3620 | 3.45k | if (tif->tif_flags & TIFF_SWAB) |
3621 | 41 | TIFFSwabLong(&offset); |
3622 | 3.45k | err = TIFFReadDirEntryData(tif, offset, 8, value); |
3623 | 3.45k | if (err != TIFFReadDirEntryErrOk) |
3624 | 886 | return (err); |
3625 | 3.45k | } |
3626 | 36 | else |
3627 | 36 | { |
3628 | 36 | UInt64Aligned_t uint64_union; |
3629 | 36 | uint64_union.l = direntry->tdir_offset.toff_long8; |
3630 | 36 | *value = uint64_union.d; |
3631 | 36 | } |
3632 | 2.60k | if (tif->tif_flags & TIFF_SWAB) |
3633 | 55 | TIFFSwabLong8((uint64_t *)value); |
3634 | 2.60k | return (TIFFReadDirEntryErrOk); |
3635 | 3.48k | } |
3636 | | |
3637 | | static enum TIFFReadDirEntryErr |
3638 | | TIFFReadDirEntryCheckRangeByteSbyte(int8_t value) |
3639 | 16.6k | { |
3640 | 16.6k | if (value < 0) |
3641 | 1.53k | return (TIFFReadDirEntryErrRange); |
3642 | 15.0k | else |
3643 | 15.0k | return (TIFFReadDirEntryErrOk); |
3644 | 16.6k | } |
3645 | | |
3646 | | static enum TIFFReadDirEntryErr |
3647 | | TIFFReadDirEntryCheckRangeByteShort(uint16_t value) |
3648 | 31.2k | { |
3649 | 31.2k | if (value > 0xFF) |
3650 | 10.6k | return (TIFFReadDirEntryErrRange); |
3651 | 20.5k | else |
3652 | 20.5k | return (TIFFReadDirEntryErrOk); |
3653 | 31.2k | } |
3654 | | |
3655 | | static enum TIFFReadDirEntryErr |
3656 | | TIFFReadDirEntryCheckRangeByteSshort(int16_t value) |
3657 | 20.5k | { |
3658 | 20.5k | if ((value < 0) || (value > 0xFF)) |
3659 | 2.41k | return (TIFFReadDirEntryErrRange); |
3660 | 18.1k | else |
3661 | 18.1k | return (TIFFReadDirEntryErrOk); |
3662 | 20.5k | } |
3663 | | |
3664 | | static enum TIFFReadDirEntryErr |
3665 | | TIFFReadDirEntryCheckRangeByteLong(uint32_t value) |
3666 | 21.5k | { |
3667 | 21.5k | if (value > 0xFF) |
3668 | 8.61k | return (TIFFReadDirEntryErrRange); |
3669 | 12.9k | else |
3670 | 12.9k | return (TIFFReadDirEntryErrOk); |
3671 | 21.5k | } |
3672 | | |
3673 | | static enum TIFFReadDirEntryErr |
3674 | | TIFFReadDirEntryCheckRangeByteSlong(int32_t value) |
3675 | 21.4k | { |
3676 | 21.4k | if ((value < 0) || (value > 0xFF)) |
3677 | 3.55k | return (TIFFReadDirEntryErrRange); |
3678 | 17.8k | else |
3679 | 17.8k | return (TIFFReadDirEntryErrOk); |
3680 | 21.4k | } |
3681 | | |
3682 | | static enum TIFFReadDirEntryErr |
3683 | | TIFFReadDirEntryCheckRangeByteLong8(uint64_t value) |
3684 | 7.65k | { |
3685 | 7.65k | if (value > 0xFF) |
3686 | 3.00k | return (TIFFReadDirEntryErrRange); |
3687 | 4.64k | else |
3688 | 4.64k | return (TIFFReadDirEntryErrOk); |
3689 | 7.65k | } |
3690 | | |
3691 | | static enum TIFFReadDirEntryErr |
3692 | | TIFFReadDirEntryCheckRangeByteSlong8(int64_t value) |
3693 | 9.92k | { |
3694 | 9.92k | if ((value < 0) || (value > 0xFF)) |
3695 | 4.72k | return (TIFFReadDirEntryErrRange); |
3696 | 5.19k | else |
3697 | 5.19k | return (TIFFReadDirEntryErrOk); |
3698 | 9.92k | } |
3699 | | |
3700 | | static enum TIFFReadDirEntryErr |
3701 | | TIFFReadDirEntryCheckRangeSbyteByte(uint8_t value) |
3702 | 0 | { |
3703 | 0 | if (value > 0x7F) |
3704 | 0 | return (TIFFReadDirEntryErrRange); |
3705 | 0 | else |
3706 | 0 | return (TIFFReadDirEntryErrOk); |
3707 | 0 | } |
3708 | | |
3709 | | static enum TIFFReadDirEntryErr |
3710 | | TIFFReadDirEntryCheckRangeSbyteShort(uint16_t value) |
3711 | 0 | { |
3712 | 0 | if (value > 0x7F) |
3713 | 0 | return (TIFFReadDirEntryErrRange); |
3714 | 0 | else |
3715 | 0 | return (TIFFReadDirEntryErrOk); |
3716 | 0 | } |
3717 | | |
3718 | | static enum TIFFReadDirEntryErr |
3719 | | TIFFReadDirEntryCheckRangeSbyteSshort(int16_t value) |
3720 | 0 | { |
3721 | 0 | if ((value < -0x80) || (value > 0x7F)) |
3722 | 0 | return (TIFFReadDirEntryErrRange); |
3723 | 0 | else |
3724 | 0 | return (TIFFReadDirEntryErrOk); |
3725 | 0 | } |
3726 | | |
3727 | | static enum TIFFReadDirEntryErr |
3728 | | TIFFReadDirEntryCheckRangeSbyteLong(uint32_t value) |
3729 | 0 | { |
3730 | 0 | if (value > 0x7F) |
3731 | 0 | return (TIFFReadDirEntryErrRange); |
3732 | 0 | else |
3733 | 0 | return (TIFFReadDirEntryErrOk); |
3734 | 0 | } |
3735 | | |
3736 | | static enum TIFFReadDirEntryErr |
3737 | | TIFFReadDirEntryCheckRangeSbyteSlong(int32_t value) |
3738 | 0 | { |
3739 | 0 | if ((value < -0x80) || (value > 0x7F)) |
3740 | 0 | return (TIFFReadDirEntryErrRange); |
3741 | 0 | else |
3742 | 0 | return (TIFFReadDirEntryErrOk); |
3743 | 0 | } |
3744 | | |
3745 | | static enum TIFFReadDirEntryErr |
3746 | | TIFFReadDirEntryCheckRangeSbyteLong8(uint64_t value) |
3747 | 0 | { |
3748 | 0 | if (value > 0x7F) |
3749 | 0 | return (TIFFReadDirEntryErrRange); |
3750 | 0 | else |
3751 | 0 | return (TIFFReadDirEntryErrOk); |
3752 | 0 | } |
3753 | | |
3754 | | static enum TIFFReadDirEntryErr |
3755 | | TIFFReadDirEntryCheckRangeSbyteSlong8(int64_t value) |
3756 | 0 | { |
3757 | 0 | if ((value < -0x80) || (value > 0x7F)) |
3758 | 0 | return (TIFFReadDirEntryErrRange); |
3759 | 0 | else |
3760 | 0 | return (TIFFReadDirEntryErrOk); |
3761 | 0 | } |
3762 | | |
3763 | | static enum TIFFReadDirEntryErr |
3764 | | TIFFReadDirEntryCheckRangeShortSbyte(int8_t value) |
3765 | 27.2k | { |
3766 | 27.2k | if (value < 0) |
3767 | 866 | return (TIFFReadDirEntryErrRange); |
3768 | 26.3k | else |
3769 | 26.3k | return (TIFFReadDirEntryErrOk); |
3770 | 27.2k | } |
3771 | | |
3772 | | static enum TIFFReadDirEntryErr |
3773 | | TIFFReadDirEntryCheckRangeShortSshort(int16_t value) |
3774 | 45.7k | { |
3775 | 45.7k | if (value < 0) |
3776 | 1.67k | return (TIFFReadDirEntryErrRange); |
3777 | 44.0k | else |
3778 | 44.0k | return (TIFFReadDirEntryErrOk); |
3779 | 45.7k | } |
3780 | | |
3781 | | static enum TIFFReadDirEntryErr |
3782 | | TIFFReadDirEntryCheckRangeShortLong(uint32_t value) |
3783 | 30.3k | { |
3784 | 30.3k | if (value > 0xFFFF) |
3785 | 9.30k | return (TIFFReadDirEntryErrRange); |
3786 | 21.0k | else |
3787 | 21.0k | return (TIFFReadDirEntryErrOk); |
3788 | 30.3k | } |
3789 | | |
3790 | | static enum TIFFReadDirEntryErr |
3791 | | TIFFReadDirEntryCheckRangeShortSlong(int32_t value) |
3792 | 14.4k | { |
3793 | 14.4k | if ((value < 0) || (value > 0xFFFF)) |
3794 | 3.75k | return (TIFFReadDirEntryErrRange); |
3795 | 10.7k | else |
3796 | 10.7k | return (TIFFReadDirEntryErrOk); |
3797 | 14.4k | } |
3798 | | |
3799 | | static enum TIFFReadDirEntryErr |
3800 | | TIFFReadDirEntryCheckRangeShortLong8(uint64_t value) |
3801 | 5.94k | { |
3802 | 5.94k | if (value > 0xFFFF) |
3803 | 1.69k | return (TIFFReadDirEntryErrRange); |
3804 | 4.24k | else |
3805 | 4.24k | return (TIFFReadDirEntryErrOk); |
3806 | 5.94k | } |
3807 | | |
3808 | | static enum TIFFReadDirEntryErr |
3809 | | TIFFReadDirEntryCheckRangeShortSlong8(int64_t value) |
3810 | 8.89k | { |
3811 | 8.89k | if ((value < 0) || (value > 0xFFFF)) |
3812 | 5.94k | return (TIFFReadDirEntryErrRange); |
3813 | 2.95k | else |
3814 | 2.95k | return (TIFFReadDirEntryErrOk); |
3815 | 8.89k | } |
3816 | | |
3817 | | static enum TIFFReadDirEntryErr |
3818 | | TIFFReadDirEntryCheckRangeSshortShort(uint16_t value) |
3819 | 0 | { |
3820 | 0 | if (value > 0x7FFF) |
3821 | 0 | return (TIFFReadDirEntryErrRange); |
3822 | 0 | else |
3823 | 0 | return (TIFFReadDirEntryErrOk); |
3824 | 0 | } |
3825 | | |
3826 | | static enum TIFFReadDirEntryErr |
3827 | | TIFFReadDirEntryCheckRangeSshortLong(uint32_t value) |
3828 | 0 | { |
3829 | 0 | if (value > 0x7FFF) |
3830 | 0 | return (TIFFReadDirEntryErrRange); |
3831 | 0 | else |
3832 | 0 | return (TIFFReadDirEntryErrOk); |
3833 | 0 | } |
3834 | | |
3835 | | static enum TIFFReadDirEntryErr |
3836 | | TIFFReadDirEntryCheckRangeSshortSlong(int32_t value) |
3837 | 0 | { |
3838 | 0 | if ((value < -0x8000) || (value > 0x7FFF)) |
3839 | 0 | return (TIFFReadDirEntryErrRange); |
3840 | 0 | else |
3841 | 0 | return (TIFFReadDirEntryErrOk); |
3842 | 0 | } |
3843 | | |
3844 | | static enum TIFFReadDirEntryErr |
3845 | | TIFFReadDirEntryCheckRangeSshortLong8(uint64_t value) |
3846 | 0 | { |
3847 | 0 | if (value > 0x7FFF) |
3848 | 0 | return (TIFFReadDirEntryErrRange); |
3849 | 0 | else |
3850 | 0 | return (TIFFReadDirEntryErrOk); |
3851 | 0 | } |
3852 | | |
3853 | | static enum TIFFReadDirEntryErr |
3854 | | TIFFReadDirEntryCheckRangeSshortSlong8(int64_t value) |
3855 | 0 | { |
3856 | 0 | if ((value < -0x8000) || (value > 0x7FFF)) |
3857 | 0 | return (TIFFReadDirEntryErrRange); |
3858 | 0 | else |
3859 | 0 | return (TIFFReadDirEntryErrOk); |
3860 | 0 | } |
3861 | | |
3862 | | static enum TIFFReadDirEntryErr |
3863 | | TIFFReadDirEntryCheckRangeLongSbyte(int8_t value) |
3864 | 30.2k | { |
3865 | 30.2k | if (value < 0) |
3866 | 883 | return (TIFFReadDirEntryErrRange); |
3867 | 29.3k | else |
3868 | 29.3k | return (TIFFReadDirEntryErrOk); |
3869 | 30.2k | } |
3870 | | |
3871 | | static enum TIFFReadDirEntryErr |
3872 | | TIFFReadDirEntryCheckRangeLongSshort(int16_t value) |
3873 | 40.8k | { |
3874 | 40.8k | if (value < 0) |
3875 | 1.14k | return (TIFFReadDirEntryErrRange); |
3876 | 39.6k | else |
3877 | 39.6k | return (TIFFReadDirEntryErrOk); |
3878 | 40.8k | } |
3879 | | |
3880 | | static enum TIFFReadDirEntryErr |
3881 | | TIFFReadDirEntryCheckRangeLongSlong(int32_t value) |
3882 | 40.0k | { |
3883 | 40.0k | if (value < 0) |
3884 | 1.35k | return (TIFFReadDirEntryErrRange); |
3885 | 38.7k | else |
3886 | 38.7k | return (TIFFReadDirEntryErrOk); |
3887 | 40.0k | } |
3888 | | |
3889 | | static enum TIFFReadDirEntryErr |
3890 | | TIFFReadDirEntryCheckRangeLongLong8(uint64_t value) |
3891 | 125k | { |
3892 | 125k | if (value > UINT32_MAX) |
3893 | 2.56k | return (TIFFReadDirEntryErrRange); |
3894 | 122k | else |
3895 | 122k | return (TIFFReadDirEntryErrOk); |
3896 | 125k | } |
3897 | | |
3898 | | static enum TIFFReadDirEntryErr |
3899 | | TIFFReadDirEntryCheckRangeLongSlong8(int64_t value) |
3900 | 1.88M | { |
3901 | 1.88M | if ((value < 0) || (value > (int64_t)UINT32_MAX)) |
3902 | 4.62k | return (TIFFReadDirEntryErrRange); |
3903 | 1.87M | else |
3904 | 1.87M | return (TIFFReadDirEntryErrOk); |
3905 | 1.88M | } |
3906 | | |
3907 | | static enum TIFFReadDirEntryErr |
3908 | | TIFFReadDirEntryCheckRangeSlongLong(uint32_t value) |
3909 | 0 | { |
3910 | 0 | if (value > 0x7FFFFFFFUL) |
3911 | 0 | return (TIFFReadDirEntryErrRange); |
3912 | 0 | else |
3913 | 0 | return (TIFFReadDirEntryErrOk); |
3914 | 0 | } |
3915 | | |
3916 | | /* Check that the 8-byte unsigned value can fit in a 4-byte unsigned range */ |
3917 | | static enum TIFFReadDirEntryErr |
3918 | | TIFFReadDirEntryCheckRangeSlongLong8(uint64_t value) |
3919 | 0 | { |
3920 | 0 | if (value > 0x7FFFFFFF) |
3921 | 0 | return (TIFFReadDirEntryErrRange); |
3922 | 0 | else |
3923 | 0 | return (TIFFReadDirEntryErrOk); |
3924 | 0 | } |
3925 | | |
3926 | | /* Check that the 8-byte signed value can fit in a 4-byte signed range */ |
3927 | | static enum TIFFReadDirEntryErr |
3928 | | TIFFReadDirEntryCheckRangeSlongSlong8(int64_t value) |
3929 | 0 | { |
3930 | 0 | if ((value < 0 - ((int64_t)0x7FFFFFFF + 1)) || (value > 0x7FFFFFFF)) |
3931 | 0 | return (TIFFReadDirEntryErrRange); |
3932 | 0 | else |
3933 | 0 | return (TIFFReadDirEntryErrOk); |
3934 | 0 | } |
3935 | | |
3936 | | static enum TIFFReadDirEntryErr |
3937 | | TIFFReadDirEntryCheckRangeLong8Sbyte(int8_t value) |
3938 | 17.9k | { |
3939 | 17.9k | if (value < 0) |
3940 | 836 | return (TIFFReadDirEntryErrRange); |
3941 | 17.1k | else |
3942 | 17.1k | return (TIFFReadDirEntryErrOk); |
3943 | 17.9k | } |
3944 | | |
3945 | | static enum TIFFReadDirEntryErr |
3946 | | TIFFReadDirEntryCheckRangeLong8Sshort(int16_t value) |
3947 | 5.48k | { |
3948 | 5.48k | if (value < 0) |
3949 | 714 | return (TIFFReadDirEntryErrRange); |
3950 | 4.76k | else |
3951 | 4.76k | return (TIFFReadDirEntryErrOk); |
3952 | 5.48k | } |
3953 | | |
3954 | | static enum TIFFReadDirEntryErr |
3955 | | TIFFReadDirEntryCheckRangeLong8Slong(int32_t value) |
3956 | 10.4k | { |
3957 | 10.4k | if (value < 0) |
3958 | 1.19k | return (TIFFReadDirEntryErrRange); |
3959 | 9.25k | else |
3960 | 9.25k | return (TIFFReadDirEntryErrOk); |
3961 | 10.4k | } |
3962 | | |
3963 | | static enum TIFFReadDirEntryErr |
3964 | | TIFFReadDirEntryCheckRangeLong8Slong8(int64_t value) |
3965 | 11.0k | { |
3966 | 11.0k | if (value < 0) |
3967 | 1.89k | return (TIFFReadDirEntryErrRange); |
3968 | 9.18k | else |
3969 | 9.18k | return (TIFFReadDirEntryErrOk); |
3970 | 11.0k | } |
3971 | | |
3972 | | static enum TIFFReadDirEntryErr |
3973 | | TIFFReadDirEntryCheckRangeSlong8Long8(uint64_t value) |
3974 | 0 | { |
3975 | 0 | if (value > INT64_MAX) |
3976 | 0 | return (TIFFReadDirEntryErrRange); |
3977 | 0 | else |
3978 | 0 | return (TIFFReadDirEntryErrOk); |
3979 | 0 | } |
3980 | | |
3981 | | static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF *tif, uint64_t offset, |
3982 | | tmsize_t size, void *dest) |
3983 | 400k | { |
3984 | 400k | assert(size > 0); |
3985 | 400k | if (!isMapped(tif)) |
3986 | 42.8k | { |
3987 | 42.8k | if (!SeekOK(tif, offset)) |
3988 | 0 | return (TIFFReadDirEntryErrIo); |
3989 | 42.8k | if (!ReadOK(tif, dest, size)) |
3990 | 7.84k | return (TIFFReadDirEntryErrIo); |
3991 | 42.8k | } |
3992 | 357k | else |
3993 | 357k | { |
3994 | 357k | size_t ma, mb; |
3995 | 357k | ma = (size_t)offset; |
3996 | 357k | if ((uint64_t)ma != offset || ma > (~(size_t)0) - (size_t)size) |
3997 | 8 | { |
3998 | 8 | return TIFFReadDirEntryErrIo; |
3999 | 8 | } |
4000 | 357k | mb = (uint64_t)ma + (uint64_t)size; |
4001 | 357k | if (mb > (uint64_t)tif->tif_size) |
4002 | 60.5k | return (TIFFReadDirEntryErrIo); |
4003 | 296k | _TIFFmemcpy(dest, tif->tif_base + ma, size); |
4004 | 296k | } |
4005 | 331k | return (TIFFReadDirEntryErrOk); |
4006 | 400k | } |
4007 | | |
4008 | | static void TIFFReadDirEntryOutputErr(TIFF *tif, enum TIFFReadDirEntryErr err, |
4009 | | const char *module, const char *tagname, |
4010 | | int recover) |
4011 | 2.14M | { |
4012 | 2.14M | if (!recover) |
4013 | 20.5k | { |
4014 | 20.5k | switch (err) |
4015 | 20.5k | { |
4016 | 4.26k | case TIFFReadDirEntryErrCount: |
4017 | 4.26k | TIFFErrorExtR(tif, module, "Incorrect count for \"%s\"", |
4018 | 4.26k | tagname); |
4019 | 4.26k | break; |
4020 | 7.45k | case TIFFReadDirEntryErrType: |
4021 | 7.45k | TIFFErrorExtR(tif, module, "Incompatible type for \"%s\"", |
4022 | 7.45k | tagname); |
4023 | 7.45k | break; |
4024 | 3.04k | case TIFFReadDirEntryErrIo: |
4025 | 3.04k | TIFFErrorExtR(tif, module, "IO error during reading of \"%s\"", |
4026 | 3.04k | tagname); |
4027 | 3.04k | break; |
4028 | 3.79k | case TIFFReadDirEntryErrRange: |
4029 | 3.79k | TIFFErrorExtR(tif, module, "Incorrect value for \"%s\"", |
4030 | 3.79k | tagname); |
4031 | 3.79k | break; |
4032 | 205 | case TIFFReadDirEntryErrPsdif: |
4033 | 205 | TIFFErrorExtR( |
4034 | 205 | tif, module, |
4035 | 205 | "Cannot handle different values per sample for \"%s\"", |
4036 | 205 | tagname); |
4037 | 205 | break; |
4038 | 1.52k | case TIFFReadDirEntryErrSizesan: |
4039 | 1.52k | TIFFErrorExtR(tif, module, |
4040 | 1.52k | "Sanity check on size of \"%s\" value failed", |
4041 | 1.52k | tagname); |
4042 | 1.52k | break; |
4043 | 228 | case TIFFReadDirEntryErrAlloc: |
4044 | 228 | TIFFErrorExtR(tif, module, "Out of memory reading of \"%s\"", |
4045 | 228 | tagname); |
4046 | 228 | break; |
4047 | 0 | case TIFFReadDirEntryErrOk: |
4048 | 0 | default: |
4049 | 0 | assert(0); /* we should never get here */ |
4050 | 0 | break; |
4051 | 20.5k | } |
4052 | 20.5k | } |
4053 | 2.12M | else |
4054 | 2.12M | { |
4055 | 2.12M | switch (err) |
4056 | 2.12M | { |
4057 | 405k | case TIFFReadDirEntryErrCount: |
4058 | 405k | TIFFWarningExtR(tif, module, |
4059 | 405k | "Incorrect count for \"%s\"; tag ignored", |
4060 | 405k | tagname); |
4061 | 405k | break; |
4062 | 123k | case TIFFReadDirEntryErrType: |
4063 | 123k | TIFFWarningExtR(tif, module, |
4064 | 123k | "Incompatible type for \"%s\"; tag ignored", |
4065 | 123k | tagname); |
4066 | 123k | break; |
4067 | 820k | case TIFFReadDirEntryErrIo: |
4068 | 820k | TIFFWarningExtR( |
4069 | 820k | tif, module, |
4070 | 820k | "IO error during reading of \"%s\"; tag ignored", tagname); |
4071 | 820k | break; |
4072 | 70.1k | case TIFFReadDirEntryErrRange: |
4073 | 70.1k | TIFFWarningExtR(tif, module, |
4074 | 70.1k | "Incorrect value for \"%s\"; tag ignored", |
4075 | 70.1k | tagname); |
4076 | 70.1k | break; |
4077 | 0 | case TIFFReadDirEntryErrPsdif: |
4078 | 0 | TIFFWarningExtR(tif, module, |
4079 | 0 | "Cannot handle different values per sample for " |
4080 | 0 | "\"%s\"; tag ignored", |
4081 | 0 | tagname); |
4082 | 0 | break; |
4083 | 347k | case TIFFReadDirEntryErrSizesan: |
4084 | 347k | TIFFWarningExtR( |
4085 | 347k | tif, module, |
4086 | 347k | "Sanity check on size of \"%s\" value failed; tag ignored", |
4087 | 347k | tagname); |
4088 | 347k | break; |
4089 | 356k | case TIFFReadDirEntryErrAlloc: |
4090 | 356k | TIFFWarningExtR(tif, module, |
4091 | 356k | "Out of memory reading of \"%s\"; tag ignored", |
4092 | 356k | tagname); |
4093 | 356k | break; |
4094 | 0 | case TIFFReadDirEntryErrOk: |
4095 | 0 | default: |
4096 | 0 | assert(0); /* we should never get here */ |
4097 | 0 | break; |
4098 | 2.12M | } |
4099 | 2.12M | } |
4100 | 2.14M | } |
4101 | | |
4102 | | /* |
4103 | | * Return the maximum number of color channels specified for a given photometric |
4104 | | * type. 0 is returned if photometric type isn't supported or no default value |
4105 | | * is defined by the specification. |
4106 | | */ |
4107 | | static int _TIFFGetMaxColorChannels(uint16_t photometric) |
4108 | 1.26M | { |
4109 | 1.26M | switch (photometric) |
4110 | 1.26M | { |
4111 | 3.27k | case PHOTOMETRIC_PALETTE: |
4112 | 544k | case PHOTOMETRIC_MINISWHITE: |
4113 | 1.07M | case PHOTOMETRIC_MINISBLACK: |
4114 | 1.07M | return 1; |
4115 | 110k | case PHOTOMETRIC_YCBCR: |
4116 | 136k | case PHOTOMETRIC_RGB: |
4117 | 146k | case PHOTOMETRIC_CIELAB: |
4118 | 155k | case PHOTOMETRIC_LOGLUV: |
4119 | 156k | case PHOTOMETRIC_ITULAB: |
4120 | 158k | case PHOTOMETRIC_ICCLAB: |
4121 | 158k | return 3; |
4122 | 13.4k | case PHOTOMETRIC_SEPARATED: |
4123 | 14.1k | case PHOTOMETRIC_MASK: |
4124 | 14.1k | return 4; |
4125 | 3.74k | case PHOTOMETRIC_LOGL: |
4126 | 3.75k | case PHOTOMETRIC_CFA: |
4127 | 12.3k | default: |
4128 | 12.3k | return 0; |
4129 | 1.26M | } |
4130 | 1.26M | } |
4131 | | |
4132 | | static int ByteCountLooksBad(TIFF *tif) |
4133 | 851k | { |
4134 | | /* |
4135 | | * Assume we have wrong StripByteCount value (in case |
4136 | | * of single strip) in following cases: |
4137 | | * - it is equal to zero along with StripOffset; |
4138 | | * - it is larger than file itself (in case of uncompressed |
4139 | | * image); |
4140 | | * - it is smaller than the size of the bytes per row |
4141 | | * multiplied on the number of rows. The last case should |
4142 | | * not be checked in the case of writing new image, |
4143 | | * because we may do not know the exact strip size |
4144 | | * until the whole image will be written and directory |
4145 | | * dumped out. |
4146 | | */ |
4147 | 851k | uint64_t bytecount = TIFFGetStrileByteCount(tif, 0); |
4148 | 851k | uint64_t offset = TIFFGetStrileOffset(tif, 0); |
4149 | 851k | uint64_t filesize; |
4150 | | |
4151 | 851k | if (offset == 0) |
4152 | 767k | return 0; |
4153 | 84.4k | if (bytecount == 0) |
4154 | 17.2k | return 1; |
4155 | 67.1k | if (tif->tif_dir.td_compression != COMPRESSION_NONE) |
4156 | 10.8k | return 0; |
4157 | 56.3k | filesize = TIFFGetFileSize(tif); |
4158 | 56.3k | if (offset <= filesize && bytecount > filesize - offset) |
4159 | 30.0k | return 1; |
4160 | 26.2k | if (tif->tif_mode == O_RDONLY) |
4161 | 26.2k | { |
4162 | 26.2k | uint64_t scanlinesize = TIFFScanlineSize64(tif); |
4163 | 26.2k | if (tif->tif_dir.td_imagelength > 0 && |
4164 | 25.7k | scanlinesize > UINT64_MAX / tif->tif_dir.td_imagelength) |
4165 | 25 | { |
4166 | 25 | return 1; |
4167 | 25 | } |
4168 | 26.2k | if (bytecount < scanlinesize * tif->tif_dir.td_imagelength) |
4169 | 6.76k | return 1; |
4170 | 26.2k | } |
4171 | 19.4k | return 0; |
4172 | 26.2k | } |
4173 | | |
4174 | | /* |
4175 | | * To evaluate the IFD data size when reading, save the offset and data size of |
4176 | | * all data that does not fit into the IFD entries themselves. |
4177 | | */ |
4178 | | static bool EvaluateIFDdatasizeReading(TIFF *tif, TIFFDirEntry *dp) |
4179 | 5.62M | { |
4180 | 5.62M | const uint64_t data_width = |
4181 | 5.62M | (uint64_t)TIFFDataWidth((TIFFDataType)dp->tdir_type); |
4182 | 5.62M | if (data_width != 0 && dp->tdir_count > UINT64_MAX / data_width) |
4183 | 31 | { |
4184 | 31 | TIFFErrorExtR(tif, "EvaluateIFDdatasizeReading", |
4185 | 31 | "Too large IFD data size"); |
4186 | 31 | return false; |
4187 | 31 | } |
4188 | 5.62M | const uint64_t datalength = dp->tdir_count * data_width; |
4189 | 5.62M | if (datalength > ((tif->tif_flags & TIFF_BIGTIFF) ? 0x8U : 0x4U)) |
4190 | 2.03M | { |
4191 | 2.03M | if (tif->tif_dir.td_dirdatasize_read > UINT64_MAX - datalength) |
4192 | 98 | { |
4193 | 98 | TIFFErrorExtR(tif, "EvaluateIFDdatasizeReading", |
4194 | 98 | "Too large IFD data size"); |
4195 | 98 | return false; |
4196 | 98 | } |
4197 | 2.03M | tif->tif_dir.td_dirdatasize_read += datalength; |
4198 | 2.03M | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
4199 | 2.03M | { |
4200 | | /* The offset of TIFFDirEntry are not swapped when read in. That has |
4201 | | * to be done when used. */ |
4202 | 2.03M | uint32_t offset = dp->tdir_offset.toff_long; |
4203 | 2.03M | if (tif->tif_flags & TIFF_SWAB) |
4204 | 6.85k | TIFFSwabLong(&offset); |
4205 | 2.03M | tif->tif_dir |
4206 | 2.03M | .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets] |
4207 | 2.03M | .offset = (uint64_t)offset; |
4208 | 2.03M | } |
4209 | 2.32k | else |
4210 | 2.32k | { |
4211 | 2.32k | tif->tif_dir |
4212 | 2.32k | .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets] |
4213 | 2.32k | .offset = dp->tdir_offset.toff_long8; |
4214 | 2.32k | if (tif->tif_flags & TIFF_SWAB) |
4215 | 1.10k | TIFFSwabLong8( |
4216 | 1.10k | &tif->tif_dir |
4217 | 1.10k | .td_dirdatasize_offsets[tif->tif_dir |
4218 | 1.10k | .td_dirdatasize_Noffsets] |
4219 | 1.10k | .offset); |
4220 | 2.32k | } |
4221 | 2.03M | tif->tif_dir |
4222 | 2.03M | .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets] |
4223 | 2.03M | .length = datalength; |
4224 | 2.03M | tif->tif_dir.td_dirdatasize_Noffsets++; |
4225 | 2.03M | } |
4226 | 5.62M | return true; |
4227 | 5.62M | } |
4228 | | |
4229 | | /* |
4230 | | * Compare function for qsort() sorting TIFFEntryOffsetAndLength array entries. |
4231 | | */ |
4232 | | static int cmpTIFFEntryOffsetAndLength(const void *a, const void *b) |
4233 | 177k | { |
4234 | 177k | const TIFFEntryOffsetAndLength *ta = (const TIFFEntryOffsetAndLength *)a; |
4235 | 177k | const TIFFEntryOffsetAndLength *tb = (const TIFFEntryOffsetAndLength *)b; |
4236 | | /* Compare offsets */ |
4237 | 177k | if (ta->offset > tb->offset) |
4238 | 33.1k | return 1; |
4239 | 144k | else if (ta->offset < tb->offset) |
4240 | 144k | return -1; |
4241 | 0 | else |
4242 | 0 | return 0; |
4243 | 177k | } |
4244 | | |
4245 | | /* |
4246 | | * Determine the IFD data size after reading an IFD from the file that can be |
4247 | | * overwritten and saving it in tif_dir.td_dirdatasize_read. This data size |
4248 | | * includes the IFD entries themselves as well as the data that does not fit |
4249 | | * directly into the IFD entries but is located directly after the IFD entries |
4250 | | * in the file. |
4251 | | */ |
4252 | | static void CalcFinalIFDdatasizeReading(TIFF *tif, uint16_t dircount) |
4253 | 1.27M | { |
4254 | | /* IFD data size is only needed if file-writing is enabled. |
4255 | | * This also avoids the seek() to EOF to determine the file size, which |
4256 | | * causes the stdin-streaming-friendly mode of libtiff for GDAL to fail. */ |
4257 | 1.27M | if (tif->tif_mode == O_RDONLY) |
4258 | 739k | return; |
4259 | | |
4260 | | /* Sort TIFFEntryOffsetAndLength array in ascending order. */ |
4261 | 532k | qsort(tif->tif_dir.td_dirdatasize_offsets, |
4262 | 532k | tif->tif_dir.td_dirdatasize_Noffsets, |
4263 | 532k | sizeof(TIFFEntryOffsetAndLength), cmpTIFFEntryOffsetAndLength); |
4264 | | |
4265 | | /* Get offset of end of IFD entry space. */ |
4266 | 532k | uint64_t IFDendoffset; |
4267 | 532k | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
4268 | 532k | IFDendoffset = tif->tif_diroff + 2 + (uint64_t)dircount * 12 + 4; |
4269 | 0 | else |
4270 | 0 | IFDendoffset = tif->tif_diroff + 8 + (uint64_t)dircount * 20 + 8; |
4271 | | |
4272 | | /* Check which offsets are right behind IFD entries. However, LibTIFF |
4273 | | * increments the writing address for every external data to an even offset. |
4274 | | * Thus gaps of 1 byte can occur. */ |
4275 | 532k | uint64_t size = 0; |
4276 | 532k | uint64_t offset; |
4277 | 532k | uint32_t i; |
4278 | 899k | for (i = 0; i < tif->tif_dir.td_dirdatasize_Noffsets; i++) |
4279 | 366k | { |
4280 | 366k | offset = tif->tif_dir.td_dirdatasize_offsets[i].offset; |
4281 | 366k | if (offset == IFDendoffset) |
4282 | 365k | { |
4283 | 365k | size += tif->tif_dir.td_dirdatasize_offsets[i].length; |
4284 | 365k | IFDendoffset += tif->tif_dir.td_dirdatasize_offsets[i].length; |
4285 | 365k | } |
4286 | 1.21k | else if (offset == IFDendoffset + 1) |
4287 | 1.18k | { |
4288 | | /* Add gap byte after previous IFD data set. */ |
4289 | 1.18k | size += tif->tif_dir.td_dirdatasize_offsets[i].length + 1; |
4290 | 1.18k | IFDendoffset += tif->tif_dir.td_dirdatasize_offsets[i].length; |
4291 | 1.18k | } |
4292 | 28 | else |
4293 | 28 | { |
4294 | | /* Further data is no more continuously after IFD */ |
4295 | 28 | break; |
4296 | 28 | } |
4297 | 366k | } |
4298 | | /* Check for gap byte of some easy cases. This should cover 90% of cases. |
4299 | | * Otherwise, IFD will be re-written even it might be safely overwritten. */ |
4300 | 532k | if (tif->tif_nextdiroff != 0) |
4301 | 177 | { |
4302 | 177 | if (tif->tif_nextdiroff == IFDendoffset + 1) |
4303 | 60 | size++; |
4304 | 177 | } |
4305 | 532k | else |
4306 | 532k | { |
4307 | | /* Check for IFD data ends at EOF. Then IFD can always be safely |
4308 | | * overwritten. */ |
4309 | 532k | offset = TIFFSeekFile(tif, 0, SEEK_END); |
4310 | 532k | if (offset == IFDendoffset) |
4311 | 531k | { |
4312 | 531k | tif->tif_dir.td_dirdatasize_read = UINT64_MAX; |
4313 | 531k | return; |
4314 | 531k | } |
4315 | 532k | } |
4316 | | |
4317 | | /* Finally, add the size of the IFD tag entries themselves. */ |
4318 | 538 | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
4319 | 538 | tif->tif_dir.td_dirdatasize_read = 2U + dircount * 12U + 4U + size; |
4320 | 0 | else |
4321 | 0 | tif->tif_dir.td_dirdatasize_read = 8U + dircount * 20U + 8U + size; |
4322 | 538 | } /*-- CalcFinalIFDdatasizeReading() --*/ |
4323 | | |
4324 | | /* |
4325 | | * Read the next TIFF directory from a file and convert it to the internal |
4326 | | * format. We read directories sequentially. |
4327 | | */ |
4328 | | int TIFFReadDirectory(TIFF *tif) |
4329 | 1.50M | { |
4330 | 1.50M | static const char module[] = "TIFFReadDirectory"; |
4331 | 1.50M | TIFFDirEntry *dir; |
4332 | 1.50M | uint16_t dircount; |
4333 | 1.50M | TIFFDirEntry *dp; |
4334 | 1.50M | uint16_t di; |
4335 | 1.50M | const TIFFField *fip; |
4336 | 1.50M | uint32_t fii = FAILED_FII; |
4337 | 1.50M | toff_t nextdiroff; |
4338 | 1.50M | int bitspersample_read = FALSE; |
4339 | 1.50M | int color_channels; |
4340 | | |
4341 | 1.50M | if (tif->tif_nextdiroff == 0) |
4342 | 130k | { |
4343 | | /* In this special case, tif_diroff needs also to be set to 0. |
4344 | | * This is behind the last IFD, thus no checking or reading necessary. |
4345 | | */ |
4346 | 130k | tif->tif_diroff = tif->tif_nextdiroff; |
4347 | 130k | return 0; |
4348 | 130k | } |
4349 | | |
4350 | 1.37M | nextdiroff = tif->tif_nextdiroff; |
4351 | | /* tif_curdir++ and tif_nextdiroff should only be updated after SUCCESSFUL |
4352 | | * reading of the directory. Otherwise, invalid IFD offsets could corrupt |
4353 | | * the IFD list. */ |
4354 | 1.37M | if (!_TIFFCheckDirNumberAndOffset(tif, |
4355 | 1.37M | tif->tif_curdir == |
4356 | 1.37M | TIFF_NON_EXISTENT_DIR_NUMBER |
4357 | 1.37M | ? 0 |
4358 | 1.37M | : tif->tif_curdir + 1, |
4359 | 1.37M | nextdiroff)) |
4360 | 3.17k | { |
4361 | 3.17k | return 0; /* bad offset (IFD looping or more than TIFF_MAX_DIR_COUNT |
4362 | | IFDs) */ |
4363 | 3.17k | } |
4364 | 1.37M | dircount = TIFFFetchDirectory(tif, nextdiroff, &dir, &tif->tif_nextdiroff); |
4365 | 1.37M | if (!dircount) |
4366 | 89.7k | { |
4367 | 89.7k | TIFFErrorExtR(tif, module, |
4368 | 89.7k | "Failed to read directory at offset %" PRIu64, |
4369 | 89.7k | nextdiroff); |
4370 | 89.7k | return 0; |
4371 | 89.7k | } |
4372 | | /* Set global values after a valid directory has been fetched. |
4373 | | * tif_diroff is already set to nextdiroff in TIFFFetchDirectory() in the |
4374 | | * beginning. */ |
4375 | 1.28M | if (tif->tif_curdir == TIFF_NON_EXISTENT_DIR_NUMBER) |
4376 | 1.14M | tif->tif_curdir = 0; |
4377 | 139k | else |
4378 | 139k | tif->tif_curdir++; |
4379 | | |
4380 | 1.28M | TIFFReadDirectoryCheckOrder(tif, dir, dircount); |
4381 | | |
4382 | | /* |
4383 | | * Mark duplicates of any tag to be ignored (bugzilla 1994) |
4384 | | * to avoid certain pathological problems. |
4385 | | */ |
4386 | 1.28M | { |
4387 | 1.28M | TIFFDirEntry *ma; |
4388 | 1.28M | uint16_t mb; |
4389 | 89.7M | for (ma = dir, mb = 0; mb < dircount; ma++, mb++) |
4390 | 88.4M | { |
4391 | 88.4M | TIFFDirEntry *na; |
4392 | 88.4M | uint16_t nb; |
4393 | 37.6G | for (na = ma + 1, nb = (uint16_t)(mb + 1); nb < dircount; |
4394 | 37.6G | na++, nb++) |
4395 | 37.6G | { |
4396 | 37.6G | if (ma->tdir_tag == na->tdir_tag) |
4397 | 4.53G | { |
4398 | 4.53G | na->tdir_ignore = TRUE; |
4399 | 4.53G | } |
4400 | 37.6G | } |
4401 | 88.4M | } |
4402 | 1.28M | } |
4403 | | |
4404 | 1.28M | tif->tif_flags &= ~TIFF_BEENWRITING; /* reset before new dir */ |
4405 | 1.28M | tif->tif_flags &= ~TIFF_BUF4WRITE; /* reset before new dir */ |
4406 | 1.28M | tif->tif_flags &= ~TIFF_CHOPPEDUPARRAYS; |
4407 | | |
4408 | | /* When changing directory, in deferred strile loading mode, we must also |
4409 | | * unset the TIFF_LAZYSTRILELOAD_DONE bit if it was initially set, |
4410 | | * to make sure the strile offset/bytecount are read again (when they fit |
4411 | | * in the tag data area). |
4412 | | */ |
4413 | 1.28M | tif->tif_flags &= ~TIFF_LAZYSTRILELOAD_DONE; |
4414 | | |
4415 | | /* Free any old stuff and reinit i/o and other parameters within |
4416 | | * TIFFDefaultDirectory() since we are starting on a new directory. */ |
4417 | 1.28M | TIFFFreeDirectory(tif); |
4418 | 1.28M | TIFFDefaultDirectory(tif); |
4419 | | |
4420 | | /* After setup a fresh directory indicate that now active IFD is also |
4421 | | * present on file, even if its entries could not be read successfully |
4422 | | * below. */ |
4423 | 1.28M | tif->tif_dir.td_iswrittentofile = TRUE; |
4424 | | |
4425 | | /* Allocate arrays for offset values outside IFD entry for IFD data size |
4426 | | * checking. Note: Counter are reset within TIFFFreeDirectory(). */ |
4427 | 1.28M | tif->tif_dir.td_dirdatasize_offsets = |
4428 | 1.28M | (TIFFEntryOffsetAndLength *)_TIFFmallocExt( |
4429 | 1.28M | tif, |
4430 | 1.28M | (tmsize_t)((size_t)dircount * sizeof(TIFFEntryOffsetAndLength))); |
4431 | 1.28M | if (tif->tif_dir.td_dirdatasize_offsets == NULL) |
4432 | 0 | { |
4433 | 0 | TIFFErrorExtR( |
4434 | 0 | tif, module, |
4435 | 0 | "Failed to allocate memory for counting IFD data size at reading"); |
4436 | 0 | goto bad; |
4437 | 0 | } |
4438 | | /* |
4439 | | * Electronic Arts writes gray-scale TIFF files |
4440 | | * without a PlanarConfiguration directory entry. |
4441 | | * Thus we setup a default value here, even though |
4442 | | * the TIFF spec says there is no default value. |
4443 | | * After PlanarConfiguration is preset in TIFFDefaultDirectory() |
4444 | | * the following setting is not needed, but does not harm either. |
4445 | | */ |
4446 | 1.28M | TIFFSetField(tif, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG); |
4447 | | /* |
4448 | | * Setup default value and then make a pass over |
4449 | | * the fields to check type and tag information, |
4450 | | * and to extract info required to size data |
4451 | | * structures. A second pass is made afterwards |
4452 | | * to read in everything not taken in the first pass. |
4453 | | * But we must process the Compression tag first |
4454 | | * in order to merge in codec-private tag definitions (otherwise |
4455 | | * we may get complaints about unknown tags). However, the |
4456 | | * Compression tag may be dependent on the SamplesPerPixel |
4457 | | * tag value because older TIFF specs permitted Compression |
4458 | | * to be written as a SamplesPerPixel-count tag entry. |
4459 | | * Thus if we don't first figure out the correct SamplesPerPixel |
4460 | | * tag value then we may end up ignoring the Compression tag |
4461 | | * value because it has an incorrect count value (if the |
4462 | | * true value of SamplesPerPixel is not 1). |
4463 | | */ |
4464 | 1.28M | dp = |
4465 | 1.28M | TIFFReadDirectoryFindEntry(tif, dir, dircount, TIFFTAG_SAMPLESPERPIXEL); |
4466 | 1.28M | if (dp) |
4467 | 786k | { |
4468 | 786k | if (!TIFFFetchNormalTag(tif, dp, 0)) |
4469 | 418 | goto bad; |
4470 | 786k | dp->tdir_ignore = TRUE; |
4471 | 786k | } |
4472 | 1.28M | dp = TIFFReadDirectoryFindEntry(tif, dir, dircount, TIFFTAG_COMPRESSION); |
4473 | 1.28M | if (dp) |
4474 | 802k | { |
4475 | | /* |
4476 | | * The 5.0 spec says the Compression tag has one value, while |
4477 | | * earlier specs say it has one value per sample. Because of |
4478 | | * this, we accept the tag if one value is supplied with either |
4479 | | * count. |
4480 | | */ |
4481 | 802k | uint16_t value; |
4482 | 802k | enum TIFFReadDirEntryErr err; |
4483 | 802k | err = TIFFReadDirEntryShort(tif, dp, &value); |
4484 | 802k | if (err == TIFFReadDirEntryErrCount) |
4485 | 9.49k | err = TIFFReadDirEntryPersampleShort(tif, dp, &value); |
4486 | 802k | if (err != TIFFReadDirEntryErrOk) |
4487 | 4.18k | { |
4488 | 4.18k | TIFFReadDirEntryOutputErr(tif, err, module, "Compression", 0); |
4489 | 4.18k | goto bad; |
4490 | 4.18k | } |
4491 | 798k | if (!TIFFSetField(tif, TIFFTAG_COMPRESSION, value)) |
4492 | 0 | goto bad; |
4493 | 798k | dp->tdir_ignore = TRUE; |
4494 | 798k | } |
4495 | 481k | else |
4496 | 481k | { |
4497 | 481k | if (!TIFFSetField(tif, TIFFTAG_COMPRESSION, COMPRESSION_NONE)) |
4498 | 0 | goto bad; |
4499 | 481k | } |
4500 | | /* |
4501 | | * First real pass over the directory. |
4502 | | */ |
4503 | 88.4M | for (di = 0, dp = dir; di < dircount; di++, dp++) |
4504 | 87.1M | { |
4505 | 87.1M | if (!dp->tdir_ignore) |
4506 | 40.2M | { |
4507 | 40.2M | TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii); |
4508 | 40.2M | if (fii == FAILED_FII) |
4509 | 28.8M | { |
4510 | 28.8M | if (tif->tif_warn_about_unknown_tags) |
4511 | 0 | { |
4512 | 0 | TIFFWarningExtR(tif, module, |
4513 | 0 | "Unknown field with tag %" PRIu16 |
4514 | 0 | " (0x%" PRIx16 ") encountered", |
4515 | 0 | dp->tdir_tag, dp->tdir_tag); |
4516 | 0 | } |
4517 | | /* the following knowingly leaks the |
4518 | | anonymous field structure */ |
4519 | 28.8M | const TIFFField *fld = _TIFFCreateAnonField( |
4520 | 28.8M | tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type); |
4521 | 28.8M | if (fld == NULL || !_TIFFMergeFields(tif, fld, 1)) |
4522 | 0 | { |
4523 | 0 | TIFFWarningExtR( |
4524 | 0 | tif, module, |
4525 | 0 | "Registering anonymous field with tag %" PRIu16 |
4526 | 0 | " (0x%" PRIx16 ") failed", |
4527 | 0 | dp->tdir_tag, dp->tdir_tag); |
4528 | 0 | dp->tdir_ignore = TRUE; |
4529 | 0 | } |
4530 | 28.8M | else |
4531 | 28.8M | { |
4532 | 28.8M | TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii); |
4533 | 28.8M | assert(fii != FAILED_FII); |
4534 | 28.8M | } |
4535 | 28.8M | } |
4536 | 40.2M | } |
4537 | 87.1M | if (!dp->tdir_ignore) |
4538 | 40.2M | { |
4539 | 40.2M | fip = tif->tif_fields[fii]; |
4540 | 40.2M | if (fip->field_bit == FIELD_IGNORE) |
4541 | 208k | dp->tdir_ignore = TRUE; |
4542 | 40.0M | else |
4543 | 40.0M | { |
4544 | 40.0M | switch (dp->tdir_tag) |
4545 | 40.0M | { |
4546 | 1.10M | case TIFFTAG_STRIPOFFSETS: |
4547 | 1.98M | case TIFFTAG_STRIPBYTECOUNTS: |
4548 | 2.19M | case TIFFTAG_TILEOFFSETS: |
4549 | 2.44M | case TIFFTAG_TILEBYTECOUNTS: |
4550 | 2.44M | TIFFSetFieldBit(tif, fip->field_bit); |
4551 | 2.44M | break; |
4552 | 1.27M | case TIFFTAG_IMAGEWIDTH: |
4553 | 2.53M | case TIFFTAG_IMAGELENGTH: |
4554 | 2.54M | case TIFFTAG_IMAGEDEPTH: |
4555 | 2.71M | case TIFFTAG_TILELENGTH: |
4556 | 2.88M | case TIFFTAG_TILEWIDTH: |
4557 | 2.88M | case TIFFTAG_TILEDEPTH: |
4558 | 3.61M | case TIFFTAG_PLANARCONFIG: |
4559 | 4.29M | case TIFFTAG_ROWSPERSTRIP: |
4560 | 4.34M | case TIFFTAG_EXTRASAMPLES: |
4561 | 4.34M | if (!TIFFFetchNormalTag(tif, dp, 0)) |
4562 | 4.40k | goto bad; |
4563 | 4.34M | dp->tdir_ignore = TRUE; |
4564 | 4.34M | break; |
4565 | 33.2M | default: |
4566 | 33.2M | if (!_TIFFCheckFieldIsValidForCodec(tif, dp->tdir_tag)) |
4567 | 316k | dp->tdir_ignore = TRUE; |
4568 | 33.2M | break; |
4569 | 40.0M | } |
4570 | 40.0M | } |
4571 | 40.2M | } |
4572 | 87.1M | } |
4573 | | /* |
4574 | | * XXX: OJPEG hack. |
4575 | | * If a) compression is OJPEG, b) planarconfig tag says it's separate, |
4576 | | * c) strip offsets/bytecounts tag are both present and |
4577 | | * d) both contain exactly one value, then we consistently find |
4578 | | * that the buggy implementation of the buggy compression scheme |
4579 | | * matches contig planarconfig best. So we 'fix-up' the tag here |
4580 | | */ |
4581 | 1.27M | if ((tif->tif_dir.td_compression == COMPRESSION_OJPEG) && |
4582 | 49.0k | (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)) |
4583 | 32 | { |
4584 | 32 | if (!_TIFFFillStriles(tif)) |
4585 | 32 | goto bad; |
4586 | 0 | dp = TIFFReadDirectoryFindEntry(tif, dir, dircount, |
4587 | 0 | TIFFTAG_STRIPOFFSETS); |
4588 | 0 | if ((dp != 0) && (dp->tdir_count == 1)) |
4589 | 0 | { |
4590 | 0 | dp = TIFFReadDirectoryFindEntry(tif, dir, dircount, |
4591 | 0 | TIFFTAG_STRIPBYTECOUNTS); |
4592 | 0 | if ((dp != 0) && (dp->tdir_count == 1)) |
4593 | 0 | { |
4594 | 0 | tif->tif_dir.td_planarconfig = PLANARCONFIG_CONTIG; |
4595 | 0 | TIFFWarningExtR(tif, module, |
4596 | 0 | "Planarconfig tag value assumed incorrect, " |
4597 | 0 | "assuming data is contig instead of chunky"); |
4598 | 0 | } |
4599 | 0 | } |
4600 | 0 | } |
4601 | | /* |
4602 | | * Allocate directory structure and setup defaults. |
4603 | | */ |
4604 | 1.27M | if (!TIFFFieldSet(tif, FIELD_IMAGEDIMENSIONS)) |
4605 | 1.69k | { |
4606 | 1.69k | MissingRequired(tif, "ImageLength"); |
4607 | 1.69k | goto bad; |
4608 | 1.69k | } |
4609 | | |
4610 | | /* |
4611 | | * Second pass: extract other information. |
4612 | | */ |
4613 | 87.6M | for (di = 0, dp = dir; di < dircount; di++, dp++) |
4614 | 86.3M | { |
4615 | 86.3M | if (!dp->tdir_ignore) |
4616 | 35.0M | { |
4617 | 35.0M | switch (dp->tdir_tag) |
4618 | 35.0M | { |
4619 | 11.2k | case TIFFTAG_MINSAMPLEVALUE: |
4620 | 20.3k | case TIFFTAG_MAXSAMPLEVALUE: |
4621 | 780k | case TIFFTAG_BITSPERSAMPLE: |
4622 | 784k | case TIFFTAG_DATATYPE: |
4623 | 1.36M | case TIFFTAG_SAMPLEFORMAT: |
4624 | | /* |
4625 | | * The MinSampleValue, MaxSampleValue, BitsPerSample |
4626 | | * DataType and SampleFormat tags are supposed to be |
4627 | | * written as one value/sample, but some vendors |
4628 | | * incorrectly write one value only -- so we accept |
4629 | | * that as well (yuck). Other vendors write correct |
4630 | | * value for NumberOfSamples, but incorrect one for |
4631 | | * BitsPerSample and friends, and we will read this |
4632 | | * too. |
4633 | | */ |
4634 | 1.36M | { |
4635 | 1.36M | uint16_t value; |
4636 | 1.36M | enum TIFFReadDirEntryErr err; |
4637 | 1.36M | err = TIFFReadDirEntryShort(tif, dp, &value); |
4638 | 1.36M | if (!EvaluateIFDdatasizeReading(tif, dp)) |
4639 | 4 | goto bad; |
4640 | 1.36M | if (err == TIFFReadDirEntryErrCount) |
4641 | 178k | err = |
4642 | 178k | TIFFReadDirEntryPersampleShort(tif, dp, &value); |
4643 | 1.36M | if (err != TIFFReadDirEntryErrOk) |
4644 | 1.28k | { |
4645 | 1.28k | fip = TIFFFieldWithTag(tif, dp->tdir_tag); |
4646 | 1.28k | TIFFReadDirEntryOutputErr( |
4647 | 1.28k | tif, err, module, |
4648 | 1.28k | fip ? fip->field_name : "unknown tagname", 0); |
4649 | 1.28k | goto bad; |
4650 | 1.28k | } |
4651 | 1.36M | if (!TIFFSetField(tif, dp->tdir_tag, value)) |
4652 | 107 | goto bad; |
4653 | 1.36M | if (dp->tdir_tag == TIFFTAG_BITSPERSAMPLE) |
4654 | 759k | bitspersample_read = TRUE; |
4655 | 1.36M | } |
4656 | 0 | break; |
4657 | 3.55k | case TIFFTAG_SMINSAMPLEVALUE: |
4658 | 7.77k | case TIFFTAG_SMAXSAMPLEVALUE: |
4659 | 7.77k | { |
4660 | | |
4661 | 7.77k | double *data = NULL; |
4662 | 7.77k | enum TIFFReadDirEntryErr err; |
4663 | 7.77k | uint32_t saved_flags; |
4664 | 7.77k | int m; |
4665 | 7.77k | if (dp->tdir_count != |
4666 | 7.77k | (uint64_t)tif->tif_dir.td_samplesperpixel) |
4667 | 312 | err = TIFFReadDirEntryErrCount; |
4668 | 7.46k | else |
4669 | 7.46k | err = TIFFReadDirEntryDoubleArray(tif, dp, &data); |
4670 | 7.77k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
4671 | 9 | goto bad; |
4672 | 7.76k | if (err != TIFFReadDirEntryErrOk) |
4673 | 306 | { |
4674 | 306 | fip = TIFFFieldWithTag(tif, dp->tdir_tag); |
4675 | 306 | TIFFReadDirEntryOutputErr( |
4676 | 306 | tif, err, module, |
4677 | 306 | fip ? fip->field_name : "unknown tagname", 0); |
4678 | 306 | goto bad; |
4679 | 306 | } |
4680 | 7.45k | saved_flags = tif->tif_flags; |
4681 | 7.45k | tif->tif_flags |= TIFF_PERSAMPLE; |
4682 | 7.45k | m = TIFFSetField(tif, dp->tdir_tag, data); |
4683 | 7.45k | tif->tif_flags = saved_flags; |
4684 | 7.45k | _TIFFfreeExt(tif, data); |
4685 | 7.45k | if (!m) |
4686 | 0 | goto bad; |
4687 | 7.45k | } |
4688 | 7.45k | break; |
4689 | 1.09M | case TIFFTAG_STRIPOFFSETS: |
4690 | 1.30M | case TIFFTAG_TILEOFFSETS: |
4691 | 1.30M | { |
4692 | 1.30M | switch (dp->tdir_type) |
4693 | 1.30M | { |
4694 | 38.3k | case TIFF_SHORT: |
4695 | 965k | case TIFF_LONG: |
4696 | 978k | case TIFF_LONG8: |
4697 | 978k | break; |
4698 | 328k | default: |
4699 | | /* Warn except if directory typically created with |
4700 | | * TIFFDeferStrileArrayWriting() */ |
4701 | 328k | if (!(tif->tif_mode == O_RDWR && |
4702 | 0 | dp->tdir_count == 0 && dp->tdir_type == 0 && |
4703 | 0 | dp->tdir_offset.toff_long8 == 0)) |
4704 | 328k | { |
4705 | 328k | fip = TIFFFieldWithTag(tif, dp->tdir_tag); |
4706 | 328k | TIFFWarningExtR( |
4707 | 328k | tif, module, "Invalid data type for tag %s", |
4708 | 328k | fip ? fip->field_name : "unknown tagname"); |
4709 | 328k | } |
4710 | 328k | break; |
4711 | 1.30M | } |
4712 | 1.30M | _TIFFmemcpy(&(tif->tif_dir.td_stripoffset_entry), dp, |
4713 | 1.30M | sizeof(TIFFDirEntry)); |
4714 | 1.30M | if (!EvaluateIFDdatasizeReading(tif, dp)) |
4715 | 17 | goto bad; |
4716 | 1.30M | } |
4717 | 1.30M | break; |
4718 | 1.30M | case TIFFTAG_STRIPBYTECOUNTS: |
4719 | 1.13M | case TIFFTAG_TILEBYTECOUNTS: |
4720 | 1.13M | { |
4721 | 1.13M | switch (dp->tdir_type) |
4722 | 1.13M | { |
4723 | 34.3k | case TIFF_SHORT: |
4724 | 999k | case TIFF_LONG: |
4725 | 1.01M | case TIFF_LONG8: |
4726 | 1.01M | break; |
4727 | 122k | default: |
4728 | | /* Warn except if directory typically created with |
4729 | | * TIFFDeferStrileArrayWriting() */ |
4730 | 122k | if (!(tif->tif_mode == O_RDWR && |
4731 | 0 | dp->tdir_count == 0 && dp->tdir_type == 0 && |
4732 | 0 | dp->tdir_offset.toff_long8 == 0)) |
4733 | 122k | { |
4734 | 122k | fip = TIFFFieldWithTag(tif, dp->tdir_tag); |
4735 | 122k | TIFFWarningExtR( |
4736 | 122k | tif, module, "Invalid data type for tag %s", |
4737 | 122k | fip ? fip->field_name : "unknown tagname"); |
4738 | 122k | } |
4739 | 122k | break; |
4740 | 1.13M | } |
4741 | 1.13M | _TIFFmemcpy(&(tif->tif_dir.td_stripbytecount_entry), dp, |
4742 | 1.13M | sizeof(TIFFDirEntry)); |
4743 | 1.13M | if (!EvaluateIFDdatasizeReading(tif, dp)) |
4744 | 4 | goto bad; |
4745 | 1.13M | } |
4746 | 1.13M | break; |
4747 | 1.13M | case TIFFTAG_COLORMAP: |
4748 | 27.9k | case TIFFTAG_TRANSFERFUNCTION: |
4749 | 27.9k | { |
4750 | 27.9k | enum TIFFReadDirEntryErr err; |
4751 | 27.9k | uint32_t countpersample; |
4752 | 27.9k | uint32_t countrequired; |
4753 | 27.9k | uint32_t incrementpersample; |
4754 | 27.9k | uint16_t *value = NULL; |
4755 | | /* It would be dangerous to instantiate those tag values */ |
4756 | | /* since if td_bitspersample has not yet been read (due to |
4757 | | */ |
4758 | | /* unordered tags), it could be read afterwards with a */ |
4759 | | /* values greater than the default one (1), which may cause |
4760 | | */ |
4761 | | /* crashes in user code */ |
4762 | 27.9k | if (!bitspersample_read) |
4763 | 14.5k | { |
4764 | 14.5k | fip = TIFFFieldWithTag(tif, dp->tdir_tag); |
4765 | 14.5k | TIFFWarningExtR( |
4766 | 14.5k | tif, module, |
4767 | 14.5k | "Ignoring %s since BitsPerSample tag not found", |
4768 | 14.5k | fip ? fip->field_name : "unknown tagname"); |
4769 | 14.5k | continue; |
4770 | 14.5k | } |
4771 | | /* ColorMap or TransferFunction for high bit */ |
4772 | | /* depths do not make much sense and could be */ |
4773 | | /* used as a denial of service vector */ |
4774 | 13.3k | if (tif->tif_dir.td_bitspersample > 24) |
4775 | 2.31k | { |
4776 | 2.31k | fip = TIFFFieldWithTag(tif, dp->tdir_tag); |
4777 | 2.31k | TIFFWarningExtR( |
4778 | 2.31k | tif, module, |
4779 | 2.31k | "Ignoring %s because BitsPerSample=%" PRIu16 ">24", |
4780 | 2.31k | fip ? fip->field_name : "unknown tagname", |
4781 | 2.31k | tif->tif_dir.td_bitspersample); |
4782 | 2.31k | continue; |
4783 | 2.31k | } |
4784 | 11.0k | countpersample = (1U << tif->tif_dir.td_bitspersample); |
4785 | 11.0k | if ((dp->tdir_tag == TIFFTAG_TRANSFERFUNCTION) && |
4786 | 3.27k | (dp->tdir_count == (uint64_t)countpersample)) |
4787 | 1.80k | { |
4788 | 1.80k | countrequired = countpersample; |
4789 | 1.80k | incrementpersample = 0; |
4790 | 1.80k | } |
4791 | 9.26k | else |
4792 | 9.26k | { |
4793 | 9.26k | countrequired = 3 * countpersample; |
4794 | 9.26k | incrementpersample = countpersample; |
4795 | 9.26k | } |
4796 | 11.0k | if (dp->tdir_count != (uint64_t)countrequired) |
4797 | 3.70k | err = TIFFReadDirEntryErrCount; |
4798 | 7.36k | else |
4799 | 7.36k | err = TIFFReadDirEntryShortArray(tif, dp, &value); |
4800 | 11.0k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
4801 | 2 | goto bad; |
4802 | 11.0k | if (err != TIFFReadDirEntryErrOk) |
4803 | 4.24k | { |
4804 | 4.24k | fip = TIFFFieldWithTag(tif, dp->tdir_tag); |
4805 | 4.24k | TIFFReadDirEntryOutputErr( |
4806 | 4.24k | tif, err, module, |
4807 | 4.24k | fip ? fip->field_name : "unknown tagname", 1); |
4808 | 4.24k | } |
4809 | 6.82k | else |
4810 | 6.82k | { |
4811 | 6.82k | TIFFSetField(tif, dp->tdir_tag, value, |
4812 | 6.82k | value + incrementpersample, |
4813 | 6.82k | value + 2 * incrementpersample); |
4814 | 6.82k | _TIFFfreeExt(tif, value); |
4815 | 6.82k | } |
4816 | 11.0k | } |
4817 | 0 | break; |
4818 | | /* BEGIN REV 4.0 COMPATIBILITY */ |
4819 | 0 | case TIFFTAG_OSUBFILETYPE: |
4820 | 0 | { |
4821 | 0 | uint16_t valueo; |
4822 | 0 | uint32_t value; |
4823 | 0 | if (TIFFReadDirEntryShort(tif, dp, &valueo) == |
4824 | 0 | TIFFReadDirEntryErrOk) |
4825 | 0 | { |
4826 | 0 | switch (valueo) |
4827 | 0 | { |
4828 | 0 | case OFILETYPE_REDUCEDIMAGE: |
4829 | 0 | value = FILETYPE_REDUCEDIMAGE; |
4830 | 0 | break; |
4831 | 0 | case OFILETYPE_PAGE: |
4832 | 0 | value = FILETYPE_PAGE; |
4833 | 0 | break; |
4834 | 0 | default: |
4835 | 0 | value = 0; |
4836 | 0 | break; |
4837 | 0 | } |
4838 | 0 | if (value != 0) |
4839 | 0 | TIFFSetField(tif, TIFFTAG_SUBFILETYPE, value); |
4840 | 0 | } |
4841 | 0 | } |
4842 | 0 | break; |
4843 | | /* END REV 4.0 COMPATIBILITY */ |
4844 | | #if 0 |
4845 | | case TIFFTAG_EP_BATTERYLEVEL: |
4846 | | /* TIFFTAG_EP_BATTERYLEVEL can be RATIONAL or ASCII. |
4847 | | * LibTiff defines it as ASCII and converts RATIONAL to an |
4848 | | * ASCII string. */ |
4849 | | switch (dp->tdir_type) |
4850 | | { |
4851 | | case TIFF_RATIONAL: |
4852 | | { |
4853 | | /* Read rational and convert to ASCII*/ |
4854 | | enum TIFFReadDirEntryErr err; |
4855 | | TIFFRational_t rValue; |
4856 | | err = TIFFReadDirEntryCheckedRationalDirect( |
4857 | | tif, dp, &rValue); |
4858 | | if (err != TIFFReadDirEntryErrOk) |
4859 | | { |
4860 | | fip = TIFFFieldWithTag(tif, dp->tdir_tag); |
4861 | | TIFFReadDirEntryOutputErr( |
4862 | | tif, err, module, |
4863 | | fip ? fip->field_name : "unknown tagname", |
4864 | | 1); |
4865 | | } |
4866 | | else |
4867 | | { |
4868 | | char szAux[32]; |
4869 | | snprintf(szAux, sizeof(szAux) - 1, "%d/%d", |
4870 | | rValue.uNum, rValue.uDenom); |
4871 | | TIFFSetField(tif, dp->tdir_tag, szAux); |
4872 | | } |
4873 | | } |
4874 | | break; |
4875 | | case TIFF_ASCII: |
4876 | | (void)TIFFFetchNormalTag(tif, dp, TRUE); |
4877 | | break; |
4878 | | default: |
4879 | | fip = TIFFFieldWithTag(tif, dp->tdir_tag); |
4880 | | TIFFWarningExtR(tif, module, |
4881 | | "Invalid data type for tag %s. " |
4882 | | "ASCII or RATIONAL expected", |
4883 | | fip ? fip->field_name |
4884 | | : "unknown tagname"); |
4885 | | break; |
4886 | | } |
4887 | | break; |
4888 | | #endif |
4889 | 31.2M | default: |
4890 | 31.2M | (void)TIFFFetchNormalTag(tif, dp, TRUE); |
4891 | 31.2M | break; |
4892 | 35.0M | } /* -- switch (dp->tdir_tag) -- */ |
4893 | 35.0M | } /* -- if (!dp->tdir_ignore) */ |
4894 | 86.3M | } /* -- for-loop -- */ |
4895 | | |
4896 | | /* Evaluate final IFD data size. */ |
4897 | 1.27M | CalcFinalIFDdatasizeReading(tif, dircount); |
4898 | | |
4899 | | /* |
4900 | | * OJPEG hack: |
4901 | | * - If a) compression is OJPEG, and b) photometric tag is missing, |
4902 | | * then we consistently find that photometric should be YCbCr |
4903 | | * - If a) compression is OJPEG, and b) photometric tag says it's RGB, |
4904 | | * then we consistently find that the buggy implementation of the |
4905 | | * buggy compression scheme matches photometric YCbCr instead. |
4906 | | * - If a) compression is OJPEG, and b) bitspersample tag is missing, |
4907 | | * then we consistently find bitspersample should be 8. |
4908 | | * - If a) compression is OJPEG, b) samplesperpixel tag is missing, |
4909 | | * and c) photometric is RGB or YCbCr, then we consistently find |
4910 | | * samplesperpixel should be 3 |
4911 | | * - If a) compression is OJPEG, b) samplesperpixel tag is missing, |
4912 | | * and c) photometric is MINISWHITE or MINISBLACK, then we consistently |
4913 | | * find samplesperpixel should be 3 |
4914 | | */ |
4915 | 1.27M | if (tif->tif_dir.td_compression == COMPRESSION_OJPEG) |
4916 | 48.8k | { |
4917 | 48.8k | if (!TIFFFieldSet(tif, FIELD_PHOTOMETRIC)) |
4918 | 41.7k | { |
4919 | 41.7k | TIFFWarningExtR( |
4920 | 41.7k | tif, module, |
4921 | 41.7k | "Photometric tag is missing, assuming data is YCbCr"); |
4922 | 41.7k | if (!TIFFSetField(tif, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_YCBCR)) |
4923 | 0 | goto bad; |
4924 | 41.7k | } |
4925 | 7.12k | else if (tif->tif_dir.td_photometric == PHOTOMETRIC_RGB) |
4926 | 1.16k | { |
4927 | 1.16k | tif->tif_dir.td_photometric = PHOTOMETRIC_YCBCR; |
4928 | 1.16k | TIFFWarningExtR(tif, module, |
4929 | 1.16k | "Photometric tag value assumed incorrect, " |
4930 | 1.16k | "assuming data is YCbCr instead of RGB"); |
4931 | 1.16k | } |
4932 | 48.8k | if (!TIFFFieldSet(tif, FIELD_BITSPERSAMPLE)) |
4933 | 40.2k | { |
4934 | 40.2k | TIFFWarningExtR( |
4935 | 40.2k | tif, module, |
4936 | 40.2k | "BitsPerSample tag is missing, assuming 8 bits per sample"); |
4937 | 40.2k | if (!TIFFSetField(tif, TIFFTAG_BITSPERSAMPLE, 8)) |
4938 | 0 | goto bad; |
4939 | 40.2k | } |
4940 | 48.8k | if (!TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL)) |
4941 | 40.0k | { |
4942 | 40.0k | if (tif->tif_dir.td_photometric == PHOTOMETRIC_RGB) |
4943 | 0 | { |
4944 | 0 | TIFFWarningExtR(tif, module, |
4945 | 0 | "SamplesPerPixel tag is missing, " |
4946 | 0 | "assuming correct SamplesPerPixel value is 3"); |
4947 | 0 | if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 3)) |
4948 | 0 | goto bad; |
4949 | 0 | } |
4950 | 40.0k | if (tif->tif_dir.td_photometric == PHOTOMETRIC_YCBCR) |
4951 | 36.6k | { |
4952 | 36.6k | TIFFWarningExtR(tif, module, |
4953 | 36.6k | "SamplesPerPixel tag is missing, " |
4954 | 36.6k | "applying correct SamplesPerPixel value of 3"); |
4955 | 36.6k | if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 3)) |
4956 | 0 | goto bad; |
4957 | 36.6k | } |
4958 | 3.46k | else if ((tif->tif_dir.td_photometric == PHOTOMETRIC_MINISWHITE) || |
4959 | 2.80k | (tif->tif_dir.td_photometric == PHOTOMETRIC_MINISBLACK)) |
4960 | 1.78k | { |
4961 | | /* |
4962 | | * SamplesPerPixel tag is missing, but is not required |
4963 | | * by spec. Assume correct SamplesPerPixel value of 1. |
4964 | | */ |
4965 | 1.78k | if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 1)) |
4966 | 0 | goto bad; |
4967 | 1.78k | } |
4968 | 40.0k | } |
4969 | 48.8k | } |
4970 | | |
4971 | | /* |
4972 | | * Setup appropriate structures (by strip or by tile) |
4973 | | * We do that only after the above OJPEG hack which alters SamplesPerPixel |
4974 | | * and thus influences the number of strips in the separate planarconfig. |
4975 | | */ |
4976 | 1.27M | if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) |
4977 | 1.09M | { |
4978 | 1.09M | tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif); |
4979 | 1.09M | tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth; |
4980 | 1.09M | tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip; |
4981 | 1.09M | tif->tif_dir.td_tiledepth = tif->tif_dir.td_imagedepth; |
4982 | 1.09M | tif->tif_flags &= ~TIFF_ISTILED; |
4983 | 1.09M | } |
4984 | 181k | else |
4985 | 181k | { |
4986 | 181k | tif->tif_dir.td_nstrips = TIFFNumberOfTiles(tif); |
4987 | 181k | tif->tif_flags |= TIFF_ISTILED; |
4988 | 181k | } |
4989 | 1.27M | if (!tif->tif_dir.td_nstrips) |
4990 | 1.25k | { |
4991 | 1.25k | TIFFErrorExtR(tif, module, "Cannot handle zero number of %s", |
4992 | 1.25k | isTiled(tif) ? "tiles" : "strips"); |
4993 | 1.25k | goto bad; |
4994 | 1.25k | } |
4995 | 1.27M | tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips; |
4996 | 1.27M | if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE) |
4997 | 18.2k | tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel; |
4998 | 1.27M | if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS)) |
4999 | 20.4k | { |
5000 | 20.4k | #ifdef OJPEG_SUPPORT |
5001 | 20.4k | if ((tif->tif_dir.td_compression == COMPRESSION_OJPEG) && |
5002 | 12.6k | (isTiled(tif) == 0) && (tif->tif_dir.td_nstrips == 1)) |
5003 | 12.5k | { |
5004 | | /* |
5005 | | * XXX: OJPEG hack. |
5006 | | * If a) compression is OJPEG, b) it's not a tiled TIFF, |
5007 | | * and c) the number of strips is 1, |
5008 | | * then we tolerate the absence of stripoffsets tag, |
5009 | | * because, presumably, all required data is in the |
5010 | | * JpegInterchangeFormat stream. |
5011 | | */ |
5012 | 12.5k | TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS); |
5013 | 12.5k | } |
5014 | 7.86k | else |
5015 | 7.86k | #endif |
5016 | 7.86k | { |
5017 | 7.86k | MissingRequired(tif, isTiled(tif) ? "TileOffsets" : "StripOffsets"); |
5018 | 7.86k | goto bad; |
5019 | 7.86k | } |
5020 | 20.4k | } |
5021 | | |
5022 | 1.26M | if (tif->tif_mode == O_RDWR && |
5023 | 532k | tif->tif_dir.td_stripoffset_entry.tdir_tag != 0 && |
5024 | 532k | tif->tif_dir.td_stripoffset_entry.tdir_count == 0 && |
5025 | 0 | tif->tif_dir.td_stripoffset_entry.tdir_type == 0 && |
5026 | 0 | tif->tif_dir.td_stripoffset_entry.tdir_offset.toff_long8 == 0 && |
5027 | 0 | tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0 && |
5028 | 0 | tif->tif_dir.td_stripbytecount_entry.tdir_count == 0 && |
5029 | 0 | tif->tif_dir.td_stripbytecount_entry.tdir_type == 0 && |
5030 | 0 | tif->tif_dir.td_stripbytecount_entry.tdir_offset.toff_long8 == 0) |
5031 | 0 | { |
5032 | | /* Directory typically created with TIFFDeferStrileArrayWriting() */ |
5033 | 0 | TIFFSetupStrips(tif); |
5034 | 0 | } |
5035 | 1.26M | else if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD)) |
5036 | 532k | { |
5037 | 532k | if (tif->tif_dir.td_stripoffset_entry.tdir_tag != 0) |
5038 | 532k | { |
5039 | 532k | if (!TIFFFetchStripThing(tif, &(tif->tif_dir.td_stripoffset_entry), |
5040 | 532k | tif->tif_dir.td_nstrips, |
5041 | 532k | &tif->tif_dir.td_stripoffset_p)) |
5042 | 0 | { |
5043 | 0 | goto bad; |
5044 | 0 | } |
5045 | 532k | } |
5046 | 532k | if (tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0) |
5047 | 532k | { |
5048 | 532k | if (!TIFFFetchStripThing( |
5049 | 532k | tif, &(tif->tif_dir.td_stripbytecount_entry), |
5050 | 532k | tif->tif_dir.td_nstrips, &tif->tif_dir.td_stripbytecount_p)) |
5051 | 0 | { |
5052 | 0 | goto bad; |
5053 | 0 | } |
5054 | 532k | } |
5055 | 532k | } |
5056 | | |
5057 | | /* |
5058 | | * Make sure all non-color channels are extrasamples. |
5059 | | * If it's not the case, define them as such. |
5060 | | */ |
5061 | 1.26M | color_channels = _TIFFGetMaxColorChannels(tif->tif_dir.td_photometric); |
5062 | 1.26M | if (color_channels && |
5063 | 1.25M | tif->tif_dir.td_samplesperpixel - tif->tif_dir.td_extrasamples > |
5064 | 1.25M | color_channels) |
5065 | 112k | { |
5066 | 112k | uint16_t old_extrasamples; |
5067 | 112k | uint16_t *new_sampleinfo; |
5068 | | |
5069 | 112k | TIFFWarningExtR( |
5070 | 112k | tif, module, |
5071 | 112k | "Sum of Photometric type-related " |
5072 | 112k | "color channels and ExtraSamples doesn't match SamplesPerPixel. " |
5073 | 112k | "Defining non-color channels as ExtraSamples."); |
5074 | | |
5075 | 112k | old_extrasamples = tif->tif_dir.td_extrasamples; |
5076 | 112k | tif->tif_dir.td_extrasamples = |
5077 | 112k | (uint16_t)(tif->tif_dir.td_samplesperpixel - color_channels); |
5078 | | |
5079 | | // sampleinfo should contain information relative to these new extra |
5080 | | // samples |
5081 | 112k | new_sampleinfo = (uint16_t *)_TIFFcallocExt( |
5082 | 112k | tif, tif->tif_dir.td_extrasamples, sizeof(uint16_t)); |
5083 | 112k | if (!new_sampleinfo) |
5084 | 0 | { |
5085 | 0 | TIFFErrorExtR(tif, module, |
5086 | 0 | "Failed to allocate memory for " |
5087 | 0 | "temporary new sampleinfo array " |
5088 | 0 | "(%" PRIu16 " 16 bit elements)", |
5089 | 0 | tif->tif_dir.td_extrasamples); |
5090 | 0 | goto bad; |
5091 | 0 | } |
5092 | | |
5093 | 112k | if (old_extrasamples > 0) |
5094 | 5.15k | memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, |
5095 | 5.15k | old_extrasamples * sizeof(uint16_t)); |
5096 | 112k | _TIFFsetShortArrayExt(tif, &tif->tif_dir.td_sampleinfo, new_sampleinfo, |
5097 | 112k | tif->tif_dir.td_extrasamples); |
5098 | 112k | _TIFFfreeExt(tif, new_sampleinfo); |
5099 | 112k | } |
5100 | | |
5101 | | /* |
5102 | | * Verify Palette image has a Colormap. |
5103 | | */ |
5104 | 1.26M | if (tif->tif_dir.td_photometric == PHOTOMETRIC_PALETTE && |
5105 | 3.27k | !TIFFFieldSet(tif, FIELD_COLORMAP)) |
5106 | 2.23k | { |
5107 | 2.23k | if (tif->tif_dir.td_bitspersample >= 8 && |
5108 | 2.18k | tif->tif_dir.td_samplesperpixel == 3) |
5109 | 610 | tif->tif_dir.td_photometric = PHOTOMETRIC_RGB; |
5110 | 1.62k | else if (tif->tif_dir.td_bitspersample >= 8) |
5111 | 1.57k | tif->tif_dir.td_photometric = PHOTOMETRIC_MINISBLACK; |
5112 | 41 | else |
5113 | 41 | { |
5114 | 41 | MissingRequired(tif, "Colormap"); |
5115 | 41 | goto bad; |
5116 | 41 | } |
5117 | 2.23k | } |
5118 | | /* |
5119 | | * OJPEG hack: |
5120 | | * We do no further messing with strip/tile offsets/bytecounts in OJPEG |
5121 | | * TIFFs |
5122 | | */ |
5123 | 1.26M | if (tif->tif_dir.td_compression != COMPRESSION_OJPEG) |
5124 | 1.21M | { |
5125 | | /* |
5126 | | * Attempt to deal with a missing StripByteCounts tag. |
5127 | | */ |
5128 | 1.21M | if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS)) |
5129 | 156k | { |
5130 | | /* |
5131 | | * Some manufacturers violate the spec by not giving |
5132 | | * the size of the strips. In this case, assume there |
5133 | | * is one uncompressed strip of data. |
5134 | | */ |
5135 | 156k | if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG && |
5136 | 152k | tif->tif_dir.td_nstrips > 1) || |
5137 | 155k | (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE && |
5138 | 4.05k | tif->tif_dir.td_nstrips != |
5139 | 4.05k | (uint32_t)tif->tif_dir.td_samplesperpixel)) |
5140 | 1.16k | { |
5141 | 1.16k | MissingRequired(tif, "StripByteCounts"); |
5142 | 1.16k | goto bad; |
5143 | 1.16k | } |
5144 | 154k | TIFFWarningExtR( |
5145 | 154k | tif, module, |
5146 | 154k | "TIFF directory is missing required " |
5147 | 154k | "\"StripByteCounts\" field, calculating from imagelength"); |
5148 | 154k | if (EstimateStripByteCounts(tif, dir, dircount) < 0) |
5149 | 2.87k | goto bad; |
5150 | 154k | } |
5151 | 1.05M | else if (tif->tif_dir.td_nstrips == 1 && |
5152 | 859k | !(tif->tif_flags & TIFF_ISTILED) && ByteCountLooksBad(tif)) |
5153 | 54.1k | { |
5154 | | /* |
5155 | | * XXX: Plexus (and others) sometimes give a value of |
5156 | | * zero for a tag when they don't know what the |
5157 | | * correct value is! Try and handle the simple case |
5158 | | * of estimating the size of a one strip image. |
5159 | | */ |
5160 | 54.1k | TIFFWarningExtR(tif, module, |
5161 | 54.1k | "Bogus \"StripByteCounts\" field, ignoring and " |
5162 | 54.1k | "calculating from imagelength"); |
5163 | 54.1k | if (EstimateStripByteCounts(tif, dir, dircount) < 0) |
5164 | 126 | goto bad; |
5165 | 54.1k | } |
5166 | 1.00M | else if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) && |
5167 | 532k | tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG && |
5168 | 532k | tif->tif_dir.td_nstrips > 2 && |
5169 | 826 | tif->tif_dir.td_compression == COMPRESSION_NONE && |
5170 | 718 | TIFFGetStrileByteCount(tif, 0) != |
5171 | 718 | TIFFGetStrileByteCount(tif, 1) && |
5172 | 0 | TIFFGetStrileByteCount(tif, 0) != 0 && |
5173 | 0 | TIFFGetStrileByteCount(tif, 1) != 0) |
5174 | 0 | { |
5175 | | /* |
5176 | | * XXX: Some vendors fill StripByteCount array with |
5177 | | * absolutely wrong values (it can be equal to |
5178 | | * StripOffset array, for example). Catch this case |
5179 | | * here. |
5180 | | * |
5181 | | * We avoid this check if deferring strile loading |
5182 | | * as it would always force us to load the strip/tile |
5183 | | * information. |
5184 | | */ |
5185 | 0 | TIFFWarningExtR(tif, module, |
5186 | 0 | "Wrong \"StripByteCounts\" field, ignoring and " |
5187 | 0 | "calculating from imagelength"); |
5188 | 0 | if (EstimateStripByteCounts(tif, dir, dircount) < 0) |
5189 | 0 | goto bad; |
5190 | 0 | } |
5191 | 1.21M | } |
5192 | 1.25M | if (dir) |
5193 | 1.25M | { |
5194 | 1.25M | _TIFFfreeExt(tif, dir); |
5195 | 1.25M | dir = NULL; |
5196 | 1.25M | } |
5197 | 1.25M | if (!TIFFFieldSet(tif, FIELD_MAXSAMPLEVALUE)) |
5198 | 1.25M | { |
5199 | 1.25M | if (tif->tif_dir.td_bitspersample >= 16) |
5200 | 227k | tif->tif_dir.td_maxsamplevalue = 0xFFFF; |
5201 | 1.02M | else |
5202 | 1.02M | tif->tif_dir.td_maxsamplevalue = |
5203 | 1.02M | (uint16_t)((1 << tif->tif_dir.td_bitspersample) - 1); |
5204 | 1.25M | } |
5205 | | |
5206 | | #ifdef STRIPBYTECOUNTSORTED_UNUSED |
5207 | | /* |
5208 | | * XXX: We can optimize checking for the strip bounds using the sorted |
5209 | | * bytecounts array. See also comments for TIFFAppendToStrip() |
5210 | | * function in tif_write.c. |
5211 | | */ |
5212 | | if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) && tif->tif_dir.td_nstrips > 1) |
5213 | | { |
5214 | | uint32_t strip; |
5215 | | |
5216 | | tif->tif_dir.td_stripbytecountsorted = 1; |
5217 | | for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) |
5218 | | { |
5219 | | if (TIFFGetStrileOffset(tif, strip - 1) > |
5220 | | TIFFGetStrileOffset(tif, strip)) |
5221 | | { |
5222 | | tif->tif_dir.td_stripbytecountsorted = 0; |
5223 | | break; |
5224 | | } |
5225 | | } |
5226 | | } |
5227 | | #endif |
5228 | | |
5229 | | /* |
5230 | | * An opportunity for compression mode dependent tag fixup |
5231 | | */ |
5232 | 1.25M | (*tif->tif_fixuptags)(tif); |
5233 | | |
5234 | | /* |
5235 | | * Some manufacturers make life difficult by writing |
5236 | | * large amounts of uncompressed data as a single strip. |
5237 | | * This is contrary to the recommendations of the spec. |
5238 | | * The following makes an attempt at breaking such images |
5239 | | * into strips closer to the recommended 8k bytes. A |
5240 | | * side effect, however, is that the RowsPerStrip tag |
5241 | | * value may be changed. |
5242 | | */ |
5243 | 1.25M | if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG) && |
5244 | 1.24M | (tif->tif_dir.td_nstrips == 1) && |
5245 | 1.04M | (tif->tif_dir.td_compression == COMPRESSION_NONE) && |
5246 | 366k | ((tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) == TIFF_STRIPCHOP)) |
5247 | 345k | { |
5248 | 345k | ChopUpSingleUncompressedStrip(tif); |
5249 | 345k | } |
5250 | | |
5251 | | /* There are also uncompressed striped files with strips larger than */ |
5252 | | /* 2 GB, which make them unfriendly with a lot of code. If possible, */ |
5253 | | /* try to expose smaller "virtual" strips. */ |
5254 | 1.25M | if (tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG && |
5255 | 1.24M | tif->tif_dir.td_compression == COMPRESSION_NONE && |
5256 | 509k | (tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) == TIFF_STRIPCHOP && |
5257 | 371k | TIFFStripSize64(tif) > 0x7FFFFFFFUL) |
5258 | 22.5k | { |
5259 | 22.5k | TryChopUpUncompressedBigTiff(tif); |
5260 | 22.5k | } |
5261 | | |
5262 | | /* |
5263 | | * Clear the dirty directory flag. |
5264 | | */ |
5265 | 1.25M | tif->tif_flags &= ~TIFF_DIRTYDIRECT; |
5266 | 1.25M | tif->tif_flags &= ~TIFF_DIRTYSTRIP; |
5267 | | |
5268 | | /* |
5269 | | * Reinitialize some further i/o since we are starting on a new directory. |
5270 | | */ |
5271 | 1.25M | tif->tif_dir.td_scanlinesize = TIFFScanlineSize(tif); |
5272 | 1.25M | if (!tif->tif_dir.td_scanlinesize) |
5273 | 2.76k | { |
5274 | 2.76k | TIFFErrorExtR(tif, module, "Cannot handle zero scanline size"); |
5275 | 2.76k | return (0); |
5276 | 2.76k | } |
5277 | | |
5278 | 1.25M | if (isTiled(tif)) |
5279 | 179k | { |
5280 | 179k | tif->tif_dir.td_tilesize = TIFFTileSize(tif); |
5281 | 179k | if (!tif->tif_dir.td_tilesize) |
5282 | 230 | { |
5283 | 230 | TIFFErrorExtR(tif, module, "Cannot handle zero tile size"); |
5284 | 230 | return (0); |
5285 | 230 | } |
5286 | 179k | } |
5287 | 1.07M | else |
5288 | 1.07M | { |
5289 | 1.07M | if (!TIFFStripSize(tif)) |
5290 | 5.01k | { |
5291 | 5.01k | TIFFErrorExtR(tif, module, "Cannot handle zero strip size"); |
5292 | 5.01k | return (0); |
5293 | 5.01k | } |
5294 | 1.07M | } |
5295 | 1.25M | return (1); |
5296 | 25.7k | bad: |
5297 | 25.7k | if (dir) |
5298 | 25.7k | _TIFFfreeExt(tif, dir); |
5299 | 25.7k | return (0); |
5300 | 1.25M | } /*-- TIFFReadDirectory() --*/ |
5301 | | |
5302 | | static void TIFFReadDirectoryCheckOrder(TIFF *tif, TIFFDirEntry *dir, |
5303 | | uint16_t dircount) |
5304 | 1.28M | { |
5305 | 1.28M | static const char module[] = "TIFFReadDirectoryCheckOrder"; |
5306 | 1.28M | uint32_t m; |
5307 | 1.28M | uint16_t n; |
5308 | 1.28M | TIFFDirEntry *o; |
5309 | 1.28M | m = 0; |
5310 | 9.52M | for (n = 0, o = dir; n < dircount; n++, o++) |
5311 | 8.94M | { |
5312 | 8.94M | if (o->tdir_tag < m) |
5313 | 704k | { |
5314 | 704k | TIFFWarningExtR(tif, module, |
5315 | 704k | "Invalid TIFF directory; tags are not sorted in " |
5316 | 704k | "ascending order"); |
5317 | 704k | break; |
5318 | 704k | } |
5319 | 8.23M | m = o->tdir_tag + 1U; |
5320 | 8.23M | } |
5321 | 1.28M | } |
5322 | | |
5323 | | static TIFFDirEntry *TIFFReadDirectoryFindEntry(TIFF *tif, TIFFDirEntry *dir, |
5324 | | uint16_t dircount, |
5325 | | uint16_t tagid) |
5326 | 2.56M | { |
5327 | 2.56M | TIFFDirEntry *m; |
5328 | 2.56M | uint16_t n; |
5329 | 2.56M | (void)tif; |
5330 | 125M | for (m = dir, n = 0; n < dircount; m++, n++) |
5331 | 124M | { |
5332 | 124M | if (m->tdir_tag == tagid) |
5333 | 1.58M | return (m); |
5334 | 124M | } |
5335 | 978k | return (0); |
5336 | 2.56M | } |
5337 | | |
5338 | | static void TIFFReadDirectoryFindFieldInfo(TIFF *tif, uint16_t tagid, |
5339 | | uint32_t *fii) |
5340 | 105M | { |
5341 | 105M | int32_t ma, mb, mc; |
5342 | 105M | ma = -1; |
5343 | 105M | mc = (int32_t)tif->tif_nfields; |
5344 | 807M | while (1) |
5345 | 807M | { |
5346 | 807M | if (ma + 1 == mc) |
5347 | 28.8M | { |
5348 | 28.8M | *fii = FAILED_FII; |
5349 | 28.8M | return; |
5350 | 28.8M | } |
5351 | 778M | mb = (ma + mc) / 2; |
5352 | 778M | if (tif->tif_fields[mb]->field_tag == (uint32_t)tagid) |
5353 | 76.5M | break; |
5354 | 702M | if (tif->tif_fields[mb]->field_tag < (uint32_t)tagid) |
5355 | 363M | ma = mb; |
5356 | 338M | else |
5357 | 338M | mc = mb; |
5358 | 702M | } |
5359 | 76.5M | while (1) |
5360 | 76.5M | { |
5361 | 76.5M | if (mb == 0) |
5362 | 1.27M | break; |
5363 | 75.3M | if (tif->tif_fields[mb - 1]->field_tag != (uint32_t)tagid) |
5364 | 75.3M | break; |
5365 | 0 | mb--; |
5366 | 0 | } |
5367 | 76.5M | *fii = (uint32_t)mb; |
5368 | 76.5M | } |
5369 | | |
5370 | | /* |
5371 | | * Read custom directory from the arbitrary offset. |
5372 | | * The code is very similar to TIFFReadDirectory(). |
5373 | | */ |
5374 | | int TIFFReadCustomDirectory(TIFF *tif, toff_t diroff, |
5375 | | const TIFFFieldArray *infoarray) |
5376 | 0 | { |
5377 | 0 | static const char module[] = "TIFFReadCustomDirectory"; |
5378 | 0 | TIFFDirEntry *dir; |
5379 | 0 | uint16_t dircount; |
5380 | 0 | TIFFDirEntry *dp; |
5381 | 0 | uint16_t di; |
5382 | 0 | const TIFFField *fip; |
5383 | 0 | uint32_t fii; |
5384 | |
|
5385 | 0 | assert(infoarray != NULL); |
5386 | 0 | dircount = TIFFFetchDirectory(tif, diroff, &dir, NULL); |
5387 | 0 | if (!dircount) |
5388 | 0 | { |
5389 | 0 | TIFFErrorExtR(tif, module, |
5390 | 0 | "Failed to read custom directory at offset %" PRIu64, |
5391 | 0 | diroff); |
5392 | 0 | return 0; |
5393 | 0 | } |
5394 | 0 | TIFFReadDirectoryCheckOrder(tif, dir, dircount); |
5395 | | |
5396 | | /* |
5397 | | * Mark duplicates of any tag to be ignored (bugzilla 1994) |
5398 | | * to avoid certain pathological problems. |
5399 | | */ |
5400 | 0 | { |
5401 | 0 | TIFFDirEntry *ma; |
5402 | 0 | uint16_t mb; |
5403 | 0 | for (ma = dir, mb = 0; mb < dircount; ma++, mb++) |
5404 | 0 | { |
5405 | 0 | TIFFDirEntry *na; |
5406 | 0 | uint16_t nb; |
5407 | 0 | for (na = ma + 1, nb = (uint16_t)(mb + 1); nb < dircount; |
5408 | 0 | na++, nb++) |
5409 | 0 | { |
5410 | 0 | if (ma->tdir_tag == na->tdir_tag) |
5411 | 0 | { |
5412 | 0 | na->tdir_ignore = TRUE; |
5413 | 0 | } |
5414 | 0 | } |
5415 | 0 | } |
5416 | 0 | } |
5417 | | |
5418 | | /* Free any old stuff and reinit. */ |
5419 | 0 | TIFFFreeDirectory(tif); |
5420 | | /* Even if custom directories do not need the default settings of a standard |
5421 | | * IFD, the pointer to the TIFFSetField() and TIFFGetField() (i.e. |
5422 | | * tif->tif_tagmethods.vsetfield and tif->tif_tagmethods.vgetfield) need to |
5423 | | * be initialized, which is done in TIFFDefaultDirectory(). |
5424 | | * After that, the field array for the custom tags needs to be setup again. |
5425 | | */ |
5426 | 0 | TIFFDefaultDirectory(tif); |
5427 | 0 | _TIFFSetupFields(tif, infoarray); |
5428 | | |
5429 | | /* Allocate arrays for offset values outside IFD entry for IFD data size |
5430 | | * checking. Note: Counter are reset within TIFFFreeDirectory(). */ |
5431 | 0 | tif->tif_dir.td_dirdatasize_offsets = |
5432 | 0 | (TIFFEntryOffsetAndLength *)_TIFFmallocExt( |
5433 | 0 | tif, |
5434 | 0 | (tmsize_t)((size_t)dircount * sizeof(TIFFEntryOffsetAndLength))); |
5435 | 0 | if (tif->tif_dir.td_dirdatasize_offsets == NULL) |
5436 | 0 | { |
5437 | 0 | TIFFErrorExtR( |
5438 | 0 | tif, module, |
5439 | 0 | "Failed to allocate memory for counting IFD data size at reading"); |
5440 | 0 | if (dir) |
5441 | 0 | _TIFFfreeExt(tif, dir); |
5442 | 0 | return 0; |
5443 | 0 | } |
5444 | | |
5445 | 0 | for (di = 0, dp = dir; di < dircount; di++, dp++) |
5446 | 0 | { |
5447 | 0 | TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii); |
5448 | 0 | if (fii == FAILED_FII) |
5449 | 0 | { |
5450 | 0 | if (tif->tif_warn_about_unknown_tags) |
5451 | 0 | { |
5452 | 0 | TIFFWarningExtR(tif, module, |
5453 | 0 | "Unknown field with tag %" PRIu16 " (0x%" PRIx16 |
5454 | 0 | ") encountered", |
5455 | 0 | dp->tdir_tag, dp->tdir_tag); |
5456 | 0 | } |
5457 | 0 | const TIFFField *fld = _TIFFCreateAnonField( |
5458 | 0 | tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type); |
5459 | 0 | if (fld == NULL || !_TIFFMergeFields(tif, fld, 1)) |
5460 | 0 | { |
5461 | 0 | if (tif->tif_warn_about_unknown_tags) |
5462 | 0 | { |
5463 | 0 | TIFFWarningExtR( |
5464 | 0 | tif, module, |
5465 | 0 | "Registering anonymous field with tag %" PRIu16 |
5466 | 0 | " (0x%" PRIx16 ") failed", |
5467 | 0 | dp->tdir_tag, dp->tdir_tag); |
5468 | 0 | } |
5469 | 0 | dp->tdir_ignore = TRUE; |
5470 | 0 | } |
5471 | 0 | else |
5472 | 0 | { |
5473 | 0 | TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii); |
5474 | 0 | assert(fii != FAILED_FII); |
5475 | 0 | } |
5476 | 0 | } |
5477 | 0 | if (!dp->tdir_ignore) |
5478 | 0 | { |
5479 | 0 | fip = tif->tif_fields[fii]; |
5480 | 0 | if (fip->field_bit == FIELD_IGNORE) |
5481 | 0 | dp->tdir_ignore = TRUE; |
5482 | 0 | else |
5483 | 0 | { |
5484 | | /* check data type */ |
5485 | 0 | while ((fip->field_type != TIFF_ANY) && |
5486 | 0 | (fip->field_type != dp->tdir_type)) |
5487 | 0 | { |
5488 | 0 | fii++; |
5489 | 0 | if ((fii == tif->tif_nfields) || |
5490 | 0 | (tif->tif_fields[fii]->field_tag != |
5491 | 0 | (uint32_t)dp->tdir_tag)) |
5492 | 0 | { |
5493 | 0 | fii = 0xFFFF; |
5494 | 0 | break; |
5495 | 0 | } |
5496 | 0 | fip = tif->tif_fields[fii]; |
5497 | 0 | } |
5498 | 0 | if (fii == 0xFFFF) |
5499 | 0 | { |
5500 | 0 | TIFFWarningExtR(tif, module, |
5501 | 0 | "Wrong data type %" PRIu16 |
5502 | 0 | " for \"%s\"; tag ignored", |
5503 | 0 | dp->tdir_type, fip->field_name); |
5504 | 0 | dp->tdir_ignore = TRUE; |
5505 | 0 | } |
5506 | 0 | else |
5507 | 0 | { |
5508 | | /* check count if known in advance */ |
5509 | 0 | if ((fip->field_readcount != TIFF_VARIABLE) && |
5510 | 0 | (fip->field_readcount != TIFF_VARIABLE2)) |
5511 | 0 | { |
5512 | 0 | uint32_t expected; |
5513 | 0 | if (fip->field_readcount == TIFF_SPP) |
5514 | 0 | expected = |
5515 | 0 | (uint32_t)tif->tif_dir.td_samplesperpixel; |
5516 | 0 | else |
5517 | 0 | expected = (uint32_t)fip->field_readcount; |
5518 | 0 | if (!CheckDirCount(tif, dp, expected)) |
5519 | 0 | dp->tdir_ignore = TRUE; |
5520 | 0 | } |
5521 | 0 | } |
5522 | 0 | } |
5523 | 0 | if (!dp->tdir_ignore) |
5524 | 0 | { |
5525 | 0 | switch (dp->tdir_tag) |
5526 | 0 | { |
5527 | 0 | case EXIFTAG_SUBJECTDISTANCE: |
5528 | 0 | if (!TIFFFieldIsAnonymous(fip)) |
5529 | 0 | { |
5530 | | /* should only be called on a Exif directory */ |
5531 | | /* when exifFields[] is active */ |
5532 | 0 | (void)TIFFFetchSubjectDistance(tif, dp); |
5533 | 0 | } |
5534 | 0 | else |
5535 | 0 | { |
5536 | 0 | (void)TIFFFetchNormalTag(tif, dp, TRUE); |
5537 | 0 | } |
5538 | 0 | break; |
5539 | 0 | default: |
5540 | 0 | (void)TIFFFetchNormalTag(tif, dp, TRUE); |
5541 | 0 | break; |
5542 | 0 | } |
5543 | 0 | } /*-- if (!dp->tdir_ignore) */ |
5544 | 0 | } |
5545 | 0 | } |
5546 | | /* Evaluate final IFD data size. */ |
5547 | 0 | CalcFinalIFDdatasizeReading(tif, dircount); |
5548 | | |
5549 | | /* To be able to return from SubIFD or custom-IFD to main-IFD */ |
5550 | 0 | tif->tif_setdirectory_force_absolute = TRUE; |
5551 | 0 | if (dir) |
5552 | 0 | _TIFFfreeExt(tif, dir); |
5553 | 0 | return 1; |
5554 | 0 | } |
5555 | | |
5556 | | /* |
5557 | | * EXIF is important special case of custom IFD, so we have a special |
5558 | | * function to read it. |
5559 | | */ |
5560 | | int TIFFReadEXIFDirectory(TIFF *tif, toff_t diroff) |
5561 | 0 | { |
5562 | 0 | return TIFFReadCustomDirectory(tif, diroff, _TIFFGetExifFields()); |
5563 | 0 | } |
5564 | | |
5565 | | /* |
5566 | | *--: EXIF-GPS custom directory reading as another special case of custom IFD. |
5567 | | */ |
5568 | | int TIFFReadGPSDirectory(TIFF *tif, toff_t diroff) |
5569 | 0 | { |
5570 | 0 | return TIFFReadCustomDirectory(tif, diroff, _TIFFGetGpsFields()); |
5571 | 0 | } |
5572 | | |
5573 | | static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir, |
5574 | | uint16_t dircount) |
5575 | 209k | { |
5576 | 209k | static const char module[] = "EstimateStripByteCounts"; |
5577 | | |
5578 | 209k | TIFFDirEntry *dp; |
5579 | 209k | TIFFDirectory *td = &tif->tif_dir; |
5580 | 209k | uint32_t strip; |
5581 | | |
5582 | | /* Do not try to load stripbytecount as we will compute it */ |
5583 | 209k | if (!_TIFFFillStrilesInternal(tif, 0)) |
5584 | 2.36k | return -1; |
5585 | | |
5586 | 206k | const uint64_t allocsize = (uint64_t)td->td_nstrips * sizeof(uint64_t); |
5587 | 206k | uint64_t filesize = 0; |
5588 | 206k | if (allocsize > 100 * 1024 * 1024) |
5589 | 0 | { |
5590 | | /* Before allocating a huge amount of memory for corrupted files, check |
5591 | | * if size of requested memory is not greater than file size. */ |
5592 | 0 | filesize = TIFFGetFileSize(tif); |
5593 | 0 | if (allocsize > filesize) |
5594 | 0 | { |
5595 | 0 | TIFFWarningExtR( |
5596 | 0 | tif, module, |
5597 | 0 | "Requested memory size for StripByteCounts of %" PRIu64 |
5598 | 0 | " is greater than filesize %" PRIu64 ". Memory not allocated", |
5599 | 0 | allocsize, filesize); |
5600 | 0 | return -1; |
5601 | 0 | } |
5602 | 0 | } |
5603 | | |
5604 | 206k | if (td->td_stripbytecount_p) |
5605 | 31.7k | _TIFFfreeExt(tif, td->td_stripbytecount_p); |
5606 | 206k | td->td_stripbytecount_p = (uint64_t *)_TIFFCheckMalloc( |
5607 | 206k | tif, td->td_nstrips, sizeof(uint64_t), "for \"StripByteCounts\" array"); |
5608 | 206k | if (td->td_stripbytecount_p == NULL) |
5609 | 0 | return -1; |
5610 | | |
5611 | 206k | if (td->td_compression != COMPRESSION_NONE) |
5612 | 43.4k | { |
5613 | 43.4k | uint64_t space; |
5614 | 43.4k | uint16_t n; |
5615 | 43.4k | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
5616 | 43.2k | space = sizeof(TIFFHeaderClassic) + 2 + |
5617 | 43.2k | (unsigned long)dircount * 12 + 4; |
5618 | 205 | else |
5619 | 205 | space = |
5620 | 205 | sizeof(TIFFHeaderBig) + 8 + (unsigned long)dircount * 20 + 8; |
5621 | | /* calculate amount of space used by indirect values */ |
5622 | 467k | for (dp = dir, n = dircount; n > 0; n--, dp++) |
5623 | 424k | { |
5624 | 424k | uint32_t typewidth; |
5625 | 424k | uint64_t datasize; |
5626 | 424k | typewidth = (uint32_t)TIFFDataWidth((TIFFDataType)dp->tdir_type); |
5627 | 424k | if (typewidth == 0) |
5628 | 541 | { |
5629 | 541 | TIFFErrorExtR( |
5630 | 541 | tif, module, |
5631 | 541 | "Cannot determine size of unknown tag type %" PRIu16, |
5632 | 541 | dp->tdir_type); |
5633 | 541 | return -1; |
5634 | 541 | } |
5635 | 423k | if (dp->tdir_count > UINT64_MAX / typewidth) |
5636 | 7 | return -1; |
5637 | 423k | datasize = (uint64_t)typewidth * dp->tdir_count; |
5638 | 423k | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
5639 | 422k | { |
5640 | 422k | if (datasize <= 4) |
5641 | 259k | datasize = 0; |
5642 | 422k | } |
5643 | 1.32k | else |
5644 | 1.32k | { |
5645 | 1.32k | if (datasize <= 8) |
5646 | 918 | datasize = 0; |
5647 | 1.32k | } |
5648 | 423k | if (space > UINT64_MAX - datasize) |
5649 | 26 | return -1; |
5650 | 423k | space += datasize; |
5651 | 423k | } |
5652 | 42.8k | if (filesize == 0) |
5653 | 42.8k | filesize = TIFFGetFileSize(tif); |
5654 | 42.8k | if (filesize < space) |
5655 | | /* we should perhaps return in error ? */ |
5656 | 34.2k | space = filesize; |
5657 | 8.55k | else |
5658 | 8.55k | space = filesize - space; |
5659 | 42.8k | if (td->td_planarconfig == PLANARCONFIG_SEPARATE) |
5660 | 1.87k | space /= td->td_samplesperpixel; |
5661 | 482k | for (strip = 0; strip < td->td_nstrips; strip++) |
5662 | 440k | td->td_stripbytecount_p[strip] = space; |
5663 | | /* |
5664 | | * This gross hack handles the case were the offset to |
5665 | | * the last strip is past the place where we think the strip |
5666 | | * should begin. Since a strip of data must be contiguous, |
5667 | | * it's safe to assume that we've overestimated the amount |
5668 | | * of data in the strip and trim this number back accordingly. |
5669 | | */ |
5670 | 42.8k | strip--; |
5671 | 42.8k | if (td->td_stripoffset_p[strip] > |
5672 | 42.8k | UINT64_MAX - td->td_stripbytecount_p[strip]) |
5673 | 7 | return -1; |
5674 | 42.8k | if (td->td_stripoffset_p[strip] + td->td_stripbytecount_p[strip] > |
5675 | 42.8k | filesize) |
5676 | 35.4k | { |
5677 | 35.4k | if (td->td_stripoffset_p[strip] >= filesize) |
5678 | 9.32k | { |
5679 | | /* Not sure what we should in that case... */ |
5680 | 9.32k | td->td_stripbytecount_p[strip] = 0; |
5681 | 9.32k | } |
5682 | 26.1k | else |
5683 | 26.1k | { |
5684 | 26.1k | td->td_stripbytecount_p[strip] = |
5685 | 26.1k | filesize - td->td_stripoffset_p[strip]; |
5686 | 26.1k | } |
5687 | 35.4k | } |
5688 | 42.8k | } |
5689 | 163k | else if (isTiled(tif)) |
5690 | 16.3k | { |
5691 | 16.3k | uint64_t bytespertile = TIFFTileSize64(tif); |
5692 | | |
5693 | 385k | for (strip = 0; strip < td->td_nstrips; strip++) |
5694 | 368k | td->td_stripbytecount_p[strip] = bytespertile; |
5695 | 16.3k | } |
5696 | 146k | else |
5697 | 146k | { |
5698 | 146k | uint64_t rowbytes = TIFFScanlineSize64(tif); |
5699 | 146k | uint32_t rowsperstrip = td->td_imagelength / td->td_stripsperimage; |
5700 | 2.17M | for (strip = 0; strip < td->td_nstrips; strip++) |
5701 | 2.03M | { |
5702 | 2.03M | if (rowbytes > 0 && rowsperstrip > UINT64_MAX / rowbytes) |
5703 | 51 | return -1; |
5704 | 2.03M | td->td_stripbytecount_p[strip] = rowbytes * rowsperstrip; |
5705 | 2.03M | } |
5706 | 146k | } |
5707 | 206k | TIFFSetFieldBit(tif, FIELD_STRIPBYTECOUNTS); |
5708 | 206k | if (!TIFFFieldSet(tif, FIELD_ROWSPERSTRIP)) |
5709 | 156k | td->td_rowsperstrip = td->td_imagelength; |
5710 | 206k | return 1; |
5711 | 206k | } |
5712 | | |
5713 | | static void MissingRequired(TIFF *tif, const char *tagname) |
5714 | 10.7k | { |
5715 | 10.7k | static const char module[] = "MissingRequired"; |
5716 | | |
5717 | 10.7k | TIFFErrorExtR(tif, module, |
5718 | 10.7k | "TIFF directory is missing required \"%s\" field", tagname); |
5719 | 10.7k | } |
5720 | | |
5721 | | static unsigned long hashFuncOffsetToNumber(const void *elt) |
5722 | 7.04M | { |
5723 | 7.04M | const TIFFOffsetAndDirNumber *offsetAndDirNumber = |
5724 | 7.04M | (const TIFFOffsetAndDirNumber *)elt; |
5725 | 7.04M | const uint32_t hash = (uint32_t)(offsetAndDirNumber->offset >> 32) ^ |
5726 | 7.04M | ((uint32_t)offsetAndDirNumber->offset & 0xFFFFFFFFU); |
5727 | 7.04M | return hash; |
5728 | 7.04M | } |
5729 | | |
5730 | | static bool equalFuncOffsetToNumber(const void *elt1, const void *elt2) |
5731 | 2.29M | { |
5732 | 2.29M | const TIFFOffsetAndDirNumber *offsetAndDirNumber1 = |
5733 | 2.29M | (const TIFFOffsetAndDirNumber *)elt1; |
5734 | 2.29M | const TIFFOffsetAndDirNumber *offsetAndDirNumber2 = |
5735 | 2.29M | (const TIFFOffsetAndDirNumber *)elt2; |
5736 | 2.29M | return offsetAndDirNumber1->offset == offsetAndDirNumber2->offset; |
5737 | 2.29M | } |
5738 | | |
5739 | | static unsigned long hashFuncNumberToOffset(const void *elt) |
5740 | 5.64M | { |
5741 | 5.64M | const TIFFOffsetAndDirNumber *offsetAndDirNumber = |
5742 | 5.64M | (const TIFFOffsetAndDirNumber *)elt; |
5743 | 5.64M | return offsetAndDirNumber->dirNumber; |
5744 | 5.64M | } |
5745 | | |
5746 | | static bool equalFuncNumberToOffset(const void *elt1, const void *elt2) |
5747 | 1.23M | { |
5748 | 1.23M | const TIFFOffsetAndDirNumber *offsetAndDirNumber1 = |
5749 | 1.23M | (const TIFFOffsetAndDirNumber *)elt1; |
5750 | 1.23M | const TIFFOffsetAndDirNumber *offsetAndDirNumber2 = |
5751 | 1.23M | (const TIFFOffsetAndDirNumber *)elt2; |
5752 | 1.23M | return offsetAndDirNumber1->dirNumber == offsetAndDirNumber2->dirNumber; |
5753 | 1.23M | } |
5754 | | |
5755 | | /* |
5756 | | * Check the directory number and offset against the list of already seen |
5757 | | * directory numbers and offsets. This is a trick to prevent IFD looping. |
5758 | | * The one can create TIFF file with looped directory pointers. We will |
5759 | | * maintain a list of already seen directories and check every IFD offset |
5760 | | * and its IFD number against that list. However, the offset of an IFD number |
5761 | | * can change - e.g. when writing updates to file. |
5762 | | * Returns 1 if all is ok; 0 if last directory or IFD loop is encountered, |
5763 | | * or an error has occurred. |
5764 | | */ |
5765 | | int _TIFFCheckDirNumberAndOffset(TIFF *tif, tdir_t dirn, uint64_t diroff) |
5766 | 2.81M | { |
5767 | 2.81M | if (diroff == 0) /* no more directories */ |
5768 | 0 | return 0; |
5769 | | |
5770 | 2.81M | if (tif->tif_map_dir_offset_to_number == NULL) |
5771 | 931k | { |
5772 | 931k | tif->tif_map_dir_offset_to_number = TIFFHashSetNew( |
5773 | 931k | hashFuncOffsetToNumber, equalFuncOffsetToNumber, free); |
5774 | 931k | if (tif->tif_map_dir_offset_to_number == NULL) |
5775 | 0 | { |
5776 | 0 | TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset", |
5777 | 0 | "Not enough memory"); |
5778 | 0 | return 1; |
5779 | 0 | } |
5780 | 931k | } |
5781 | | |
5782 | 2.81M | if (tif->tif_map_dir_number_to_offset == NULL) |
5783 | 931k | { |
5784 | | /* No free callback for this map, as it shares the same items as |
5785 | | * tif->tif_map_dir_offset_to_number. */ |
5786 | 931k | tif->tif_map_dir_number_to_offset = TIFFHashSetNew( |
5787 | 931k | hashFuncNumberToOffset, equalFuncNumberToOffset, NULL); |
5788 | 931k | if (tif->tif_map_dir_number_to_offset == NULL) |
5789 | 0 | { |
5790 | 0 | TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset", |
5791 | 0 | "Not enough memory"); |
5792 | 0 | return 1; |
5793 | 0 | } |
5794 | 931k | } |
5795 | | |
5796 | | /* Check if offset is already in the list: |
5797 | | * - yes: check, if offset is at the same IFD number - if not, it is an IFD |
5798 | | * loop |
5799 | | * - no: add to list or update offset at that IFD number |
5800 | | */ |
5801 | 2.81M | TIFFOffsetAndDirNumber entry; |
5802 | 2.81M | entry.offset = diroff; |
5803 | 2.81M | entry.dirNumber = dirn; |
5804 | | |
5805 | 2.81M | TIFFOffsetAndDirNumber *foundEntry = |
5806 | 2.81M | (TIFFOffsetAndDirNumber *)TIFFHashSetLookup( |
5807 | 2.81M | tif->tif_map_dir_offset_to_number, &entry); |
5808 | 2.81M | if (foundEntry) |
5809 | 1.30M | { |
5810 | 1.30M | if (foundEntry->dirNumber == dirn) |
5811 | 1.30M | { |
5812 | 1.30M | return 1; |
5813 | 1.30M | } |
5814 | 6.22k | else |
5815 | 6.22k | { |
5816 | 6.22k | TIFFWarningExtR(tif, "_TIFFCheckDirNumberAndOffset", |
5817 | 6.22k | "TIFF directory %d has IFD looping to directory %u " |
5818 | 6.22k | "at offset 0x%" PRIx64 " (%" PRIu64 ")", |
5819 | 6.22k | (int)dirn - 1, foundEntry->dirNumber, diroff, |
5820 | 6.22k | diroff); |
5821 | 6.22k | return 0; |
5822 | 6.22k | } |
5823 | 1.30M | } |
5824 | | |
5825 | | /* Check if offset of an IFD has been changed and update offset of that IFD |
5826 | | * number. */ |
5827 | 1.50M | foundEntry = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup( |
5828 | 1.50M | tif->tif_map_dir_number_to_offset, &entry); |
5829 | 1.50M | if (foundEntry) |
5830 | 116k | { |
5831 | 116k | if (foundEntry->offset != diroff) |
5832 | 116k | { |
5833 | 116k | TIFFOffsetAndDirNumber entryOld; |
5834 | 116k | entryOld.offset = foundEntry->offset; |
5835 | 116k | entryOld.dirNumber = dirn; |
5836 | | /* We must remove first from tif_map_dir_number_to_offset as the */ |
5837 | | /* entry is owned (and thus freed) by */ |
5838 | | /* tif_map_dir_offset_to_number */ |
5839 | 116k | TIFFOffsetAndDirNumber *foundEntryOld = |
5840 | 116k | (TIFFOffsetAndDirNumber *)TIFFHashSetLookup( |
5841 | 116k | tif->tif_map_dir_number_to_offset, &entryOld); |
5842 | 116k | if (foundEntryOld) |
5843 | 116k | { |
5844 | 116k | TIFFHashSetRemove(tif->tif_map_dir_number_to_offset, |
5845 | 116k | foundEntryOld); |
5846 | 116k | } |
5847 | 116k | foundEntryOld = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup( |
5848 | 116k | tif->tif_map_dir_offset_to_number, &entryOld); |
5849 | 116k | if (foundEntryOld) |
5850 | 116k | { |
5851 | 116k | TIFFHashSetRemove(tif->tif_map_dir_offset_to_number, |
5852 | 116k | foundEntryOld); |
5853 | 116k | } |
5854 | | |
5855 | 116k | TIFFOffsetAndDirNumber *entryPtr = (TIFFOffsetAndDirNumber *)malloc( |
5856 | 116k | sizeof(TIFFOffsetAndDirNumber)); |
5857 | 116k | if (entryPtr == NULL) |
5858 | 0 | { |
5859 | 0 | return 0; |
5860 | 0 | } |
5861 | | |
5862 | | /* Add IFD offset and dirn to IFD directory list */ |
5863 | 116k | *entryPtr = entry; |
5864 | | |
5865 | 116k | if (!TIFFHashSetInsert(tif->tif_map_dir_offset_to_number, entryPtr)) |
5866 | 0 | { |
5867 | 0 | TIFFErrorExtR( |
5868 | 0 | tif, "_TIFFCheckDirNumberAndOffset", |
5869 | 0 | "Insertion in tif_map_dir_offset_to_number failed"); |
5870 | 0 | return 0; |
5871 | 0 | } |
5872 | 116k | if (!TIFFHashSetInsert(tif->tif_map_dir_number_to_offset, entryPtr)) |
5873 | 0 | { |
5874 | 0 | TIFFErrorExtR( |
5875 | 0 | tif, "_TIFFCheckDirNumberAndOffset", |
5876 | 0 | "Insertion in tif_map_dir_number_to_offset failed"); |
5877 | 0 | return 0; |
5878 | 0 | } |
5879 | 116k | } |
5880 | 116k | return 1; |
5881 | 116k | } |
5882 | | |
5883 | | /* Arbitrary (hopefully big enough) limit */ |
5884 | 1.39M | if (TIFFHashSetSize(tif->tif_map_dir_offset_to_number) >= |
5885 | 1.39M | TIFF_MAX_DIR_COUNT) |
5886 | 0 | { |
5887 | 0 | TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset", |
5888 | 0 | "Cannot handle more than %u TIFF directories", |
5889 | 0 | (unsigned)TIFF_MAX_DIR_COUNT); |
5890 | 0 | return 0; |
5891 | 0 | } |
5892 | | |
5893 | 1.39M | TIFFOffsetAndDirNumber *entryPtr = |
5894 | 1.39M | (TIFFOffsetAndDirNumber *)malloc(sizeof(TIFFOffsetAndDirNumber)); |
5895 | 1.39M | if (entryPtr == NULL) |
5896 | 0 | { |
5897 | 0 | TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset", |
5898 | 0 | "malloc(sizeof(TIFFOffsetAndDirNumber)) failed"); |
5899 | 0 | return 0; |
5900 | 0 | } |
5901 | | |
5902 | | /* Add IFD offset and dirn to IFD directory list */ |
5903 | 1.39M | *entryPtr = entry; |
5904 | | |
5905 | 1.39M | if (!TIFFHashSetInsert(tif->tif_map_dir_offset_to_number, entryPtr)) |
5906 | 0 | { |
5907 | 0 | TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset", |
5908 | 0 | "Insertion in tif_map_dir_offset_to_number failed"); |
5909 | 0 | return 0; |
5910 | 0 | } |
5911 | 1.39M | if (!TIFFHashSetInsert(tif->tif_map_dir_number_to_offset, entryPtr)) |
5912 | 0 | { |
5913 | 0 | TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset", |
5914 | 0 | "Insertion in tif_map_dir_number_to_offset failed"); |
5915 | 0 | return 0; |
5916 | 0 | } |
5917 | | |
5918 | 1.39M | return 1; |
5919 | 1.39M | } /* --- _TIFFCheckDirNumberAndOffset() ---*/ |
5920 | | |
5921 | | /* |
5922 | | * Retrieve the matching IFD directory number of a given IFD offset |
5923 | | * from the list of directories already seen. |
5924 | | * Returns 1 if the offset was in the list and the directory number |
5925 | | * can be returned. |
5926 | | * Otherwise returns 0 or if an error occurred. |
5927 | | */ |
5928 | | int _TIFFGetDirNumberFromOffset(TIFF *tif, uint64_t diroff, tdir_t *dirn) |
5929 | 450k | { |
5930 | 450k | if (diroff == 0) /* no more directories */ |
5931 | 0 | return 0; |
5932 | | |
5933 | | /* Check if offset is already in the list and return matching directory |
5934 | | * number. Otherwise update IFD list using TIFFNumberOfDirectories() and |
5935 | | * search again in IFD list. |
5936 | | */ |
5937 | 450k | if (tif->tif_map_dir_offset_to_number == NULL) |
5938 | 0 | return 0; |
5939 | 450k | TIFFOffsetAndDirNumber entry; |
5940 | 450k | entry.offset = diroff; |
5941 | 450k | entry.dirNumber = 0; /* not used */ |
5942 | | |
5943 | 450k | TIFFOffsetAndDirNumber *foundEntry = |
5944 | 450k | (TIFFOffsetAndDirNumber *)TIFFHashSetLookup( |
5945 | 450k | tif->tif_map_dir_offset_to_number, &entry); |
5946 | 450k | if (foundEntry) |
5947 | 279k | { |
5948 | 279k | *dirn = foundEntry->dirNumber; |
5949 | 279k | return 1; |
5950 | 279k | } |
5951 | | |
5952 | | /* This updates the directory list for all main-IFDs in the file. */ |
5953 | 170k | TIFFNumberOfDirectories(tif); |
5954 | | |
5955 | 170k | foundEntry = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup( |
5956 | 170k | tif->tif_map_dir_offset_to_number, &entry); |
5957 | 170k | if (foundEntry) |
5958 | 75.8k | { |
5959 | 75.8k | *dirn = foundEntry->dirNumber; |
5960 | 75.8k | return 1; |
5961 | 75.8k | } |
5962 | | |
5963 | 94.5k | return 0; |
5964 | 170k | } /*--- _TIFFGetDirNumberFromOffset() ---*/ |
5965 | | |
5966 | | /* |
5967 | | * Retrieve the matching IFD directory offset of a given IFD number |
5968 | | * from the list of directories already seen. |
5969 | | * Returns 1 if the offset was in the list of already seen IFDs and the |
5970 | | * directory offset can be returned. The directory list is not updated. |
5971 | | * Otherwise returns 0 or if an error occurred. |
5972 | | */ |
5973 | | int _TIFFGetOffsetFromDirNumber(TIFF *tif, tdir_t dirn, uint64_t *diroff) |
5974 | 531k | { |
5975 | | |
5976 | 531k | if (tif->tif_map_dir_number_to_offset == NULL) |
5977 | 0 | return 0; |
5978 | 531k | TIFFOffsetAndDirNumber entry; |
5979 | 531k | entry.offset = 0; /* not used */ |
5980 | 531k | entry.dirNumber = dirn; |
5981 | | |
5982 | 531k | TIFFOffsetAndDirNumber *foundEntry = |
5983 | 531k | (TIFFOffsetAndDirNumber *)TIFFHashSetLookup( |
5984 | 531k | tif->tif_map_dir_number_to_offset, &entry); |
5985 | 531k | if (foundEntry) |
5986 | 531k | { |
5987 | 531k | *diroff = foundEntry->offset; |
5988 | 531k | return 1; |
5989 | 531k | } |
5990 | | |
5991 | 0 | return 0; |
5992 | 531k | } /*--- _TIFFGetOffsetFromDirNumber() ---*/ |
5993 | | |
5994 | | /* |
5995 | | * Remove an entry from the directory list of already seen directories |
5996 | | * by directory offset. |
5997 | | * If an entry is to be removed from the list, it is also okay if the entry |
5998 | | * is not in the list or the list does not exist. |
5999 | | */ |
6000 | | int _TIFFRemoveEntryFromDirectoryListByOffset(TIFF *tif, uint64_t diroff) |
6001 | 178k | { |
6002 | 178k | if (tif->tif_map_dir_offset_to_number == NULL) |
6003 | 0 | return 1; |
6004 | | |
6005 | 178k | TIFFOffsetAndDirNumber entryOld; |
6006 | 178k | entryOld.offset = diroff; |
6007 | 178k | entryOld.dirNumber = 0; |
6008 | | /* We must remove first from tif_map_dir_number_to_offset as the |
6009 | | * entry is owned (and thus freed) by tif_map_dir_offset_to_number. |
6010 | | * However, we need firstly to find the directory number from offset. */ |
6011 | | |
6012 | 178k | TIFFOffsetAndDirNumber *foundEntryOldOff = |
6013 | 178k | (TIFFOffsetAndDirNumber *)TIFFHashSetLookup( |
6014 | 178k | tif->tif_map_dir_offset_to_number, &entryOld); |
6015 | 178k | if (foundEntryOldOff) |
6016 | 178k | { |
6017 | 178k | entryOld.dirNumber = foundEntryOldOff->dirNumber; |
6018 | 178k | if (tif->tif_map_dir_number_to_offset != NULL) |
6019 | 178k | { |
6020 | 178k | TIFFOffsetAndDirNumber *foundEntryOldDir = |
6021 | 178k | (TIFFOffsetAndDirNumber *)TIFFHashSetLookup( |
6022 | 178k | tif->tif_map_dir_number_to_offset, &entryOld); |
6023 | 178k | if (foundEntryOldDir) |
6024 | 178k | { |
6025 | 178k | TIFFHashSetRemove(tif->tif_map_dir_number_to_offset, |
6026 | 178k | foundEntryOldDir); |
6027 | 178k | TIFFHashSetRemove(tif->tif_map_dir_offset_to_number, |
6028 | 178k | foundEntryOldOff); |
6029 | 178k | return 1; |
6030 | 178k | } |
6031 | 178k | } |
6032 | 0 | else |
6033 | 0 | { |
6034 | 0 | TIFFErrorExtR(tif, "_TIFFRemoveEntryFromDirectoryListByOffset", |
6035 | 0 | "Unexpectedly tif_map_dir_number_to_offset is " |
6036 | 0 | "missing but tif_map_dir_offset_to_number exists."); |
6037 | 0 | return 0; |
6038 | 0 | } |
6039 | 178k | } |
6040 | 0 | return 1; |
6041 | 178k | } /*--- _TIFFRemoveEntryFromDirectoryListByOffset() ---*/ |
6042 | | |
6043 | | /* |
6044 | | * Check the count field of a directory entry against a known value. The |
6045 | | * caller is expected to skip/ignore the tag if there is a mismatch. |
6046 | | */ |
6047 | | static int CheckDirCount(TIFF *tif, TIFFDirEntry *dir, uint32_t count) |
6048 | 0 | { |
6049 | 0 | if ((uint64_t)count > dir->tdir_count) |
6050 | 0 | { |
6051 | 0 | const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag); |
6052 | 0 | TIFFWarningExtR(tif, tif->tif_name, |
6053 | 0 | "incorrect count for field \"%s\" (%" PRIu64 |
6054 | 0 | ", expecting %" PRIu32 "); tag ignored", |
6055 | 0 | fip ? fip->field_name : "unknown tagname", |
6056 | 0 | dir->tdir_count, count); |
6057 | 0 | return (0); |
6058 | 0 | } |
6059 | 0 | else if ((uint64_t)count < dir->tdir_count) |
6060 | 0 | { |
6061 | 0 | const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag); |
6062 | 0 | TIFFWarningExtR(tif, tif->tif_name, |
6063 | 0 | "incorrect count for field \"%s\" (%" PRIu64 |
6064 | 0 | ", expecting %" PRIu32 "); tag trimmed", |
6065 | 0 | fip ? fip->field_name : "unknown tagname", |
6066 | 0 | dir->tdir_count, count); |
6067 | 0 | dir->tdir_count = count; |
6068 | 0 | return (1); |
6069 | 0 | } |
6070 | 0 | return (1); |
6071 | 0 | } |
6072 | | |
6073 | | /* |
6074 | | * Read IFD structure from the specified offset. If the pointer to |
6075 | | * nextdiroff variable has been specified, read it too. Function returns a |
6076 | | * number of fields in the directory or 0 if failed. |
6077 | | */ |
6078 | | static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff, |
6079 | | TIFFDirEntry **pdir, uint64_t *nextdiroff) |
6080 | 1.37M | { |
6081 | 1.37M | static const char module[] = "TIFFFetchDirectory"; |
6082 | | |
6083 | 1.37M | void *origdir; |
6084 | 1.37M | uint16_t dircount16; |
6085 | 1.37M | uint32_t dirsize; |
6086 | 1.37M | TIFFDirEntry *dir; |
6087 | 1.37M | uint8_t *ma; |
6088 | 1.37M | TIFFDirEntry *mb; |
6089 | 1.37M | uint16_t n; |
6090 | | |
6091 | 1.37M | assert(pdir); |
6092 | | |
6093 | 1.37M | tif->tif_diroff = diroff; |
6094 | 1.37M | if (nextdiroff) |
6095 | 1.37M | *nextdiroff = 0; |
6096 | 1.37M | if (!isMapped(tif)) |
6097 | 1.09M | { |
6098 | 1.09M | if (!SeekOK(tif, tif->tif_diroff)) |
6099 | 651 | { |
6100 | 651 | TIFFErrorExtR(tif, module, |
6101 | 651 | "%s: Seek error accessing TIFF directory", |
6102 | 651 | tif->tif_name); |
6103 | 651 | return 0; |
6104 | 651 | } |
6105 | 1.09M | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
6106 | 1.09M | { |
6107 | 1.09M | if (!ReadOK(tif, &dircount16, sizeof(uint16_t))) |
6108 | 58.4k | { |
6109 | 58.4k | TIFFErrorExtR(tif, module, |
6110 | 58.4k | "%s: Can not read TIFF directory count", |
6111 | 58.4k | tif->tif_name); |
6112 | 58.4k | return 0; |
6113 | 58.4k | } |
6114 | 1.03M | if (tif->tif_flags & TIFF_SWAB) |
6115 | 3.85k | TIFFSwabShort(&dircount16); |
6116 | 1.03M | if (dircount16 > 4096) |
6117 | 6.41k | { |
6118 | 6.41k | TIFFErrorExtR(tif, module, |
6119 | 6.41k | "Sanity check on directory count failed, this is " |
6120 | 6.41k | "probably not a valid IFD offset"); |
6121 | 6.41k | return 0; |
6122 | 6.41k | } |
6123 | 1.02M | dirsize = 12; |
6124 | 1.02M | } |
6125 | 3.44k | else |
6126 | 3.44k | { |
6127 | 3.44k | uint64_t dircount64; |
6128 | 3.44k | if (!ReadOK(tif, &dircount64, sizeof(uint64_t))) |
6129 | 383 | { |
6130 | 383 | TIFFErrorExtR(tif, module, |
6131 | 383 | "%s: Can not read TIFF directory count", |
6132 | 383 | tif->tif_name); |
6133 | 383 | return 0; |
6134 | 383 | } |
6135 | 3.06k | if (tif->tif_flags & TIFF_SWAB) |
6136 | 669 | TIFFSwabLong8(&dircount64); |
6137 | 3.06k | if (dircount64 > 4096) |
6138 | 274 | { |
6139 | 274 | TIFFErrorExtR(tif, module, |
6140 | 274 | "Sanity check on directory count failed, this is " |
6141 | 274 | "probably not a valid IFD offset"); |
6142 | 274 | return 0; |
6143 | 274 | } |
6144 | 2.79k | dircount16 = (uint16_t)dircount64; |
6145 | 2.79k | dirsize = 20; |
6146 | 2.79k | } |
6147 | 1.03M | origdir = _TIFFCheckMalloc(tif, dircount16, dirsize, |
6148 | 1.03M | "to read TIFF directory"); |
6149 | 1.03M | if (origdir == NULL) |
6150 | 1.18k | return 0; |
6151 | 1.03M | if (!ReadOK(tif, origdir, (tmsize_t)dircount16 * dirsize)) |
6152 | 2.72k | { |
6153 | 2.72k | TIFFErrorExtR(tif, module, "%.100s: Can not read TIFF directory", |
6154 | 2.72k | tif->tif_name); |
6155 | 2.72k | _TIFFfreeExt(tif, origdir); |
6156 | 2.72k | return 0; |
6157 | 2.72k | } |
6158 | | /* |
6159 | | * Read offset to next directory for sequential scans if |
6160 | | * needed. |
6161 | | */ |
6162 | 1.02M | if (nextdiroff) |
6163 | 1.02M | { |
6164 | 1.02M | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
6165 | 1.02M | { |
6166 | 1.02M | uint32_t nextdiroff32; |
6167 | 1.02M | if (!ReadOK(tif, &nextdiroff32, sizeof(uint32_t))) |
6168 | 44.5k | nextdiroff32 = 0; |
6169 | 1.02M | if (tif->tif_flags & TIFF_SWAB) |
6170 | 3.68k | TIFFSwabLong(&nextdiroff32); |
6171 | 1.02M | *nextdiroff = nextdiroff32; |
6172 | 1.02M | } |
6173 | 2.49k | else |
6174 | 2.49k | { |
6175 | 2.49k | if (!ReadOK(tif, nextdiroff, sizeof(uint64_t))) |
6176 | 937 | *nextdiroff = 0; |
6177 | 2.49k | if (tif->tif_flags & TIFF_SWAB) |
6178 | 591 | TIFFSwabLong8(nextdiroff); |
6179 | 2.49k | } |
6180 | 1.02M | } |
6181 | 1.02M | } |
6182 | 276k | else |
6183 | 276k | { |
6184 | 276k | tmsize_t m; |
6185 | 276k | tmsize_t off; |
6186 | 276k | if (tif->tif_diroff > (uint64_t)INT64_MAX) |
6187 | 253 | { |
6188 | 253 | TIFFErrorExtR(tif, module, "Can not read TIFF directory count"); |
6189 | 253 | return (0); |
6190 | 253 | } |
6191 | 276k | off = (tmsize_t)tif->tif_diroff; |
6192 | | |
6193 | | /* |
6194 | | * Check for integer overflow when validating the dir_off, |
6195 | | * otherwise a very high offset may cause an OOB read and |
6196 | | * crash the client. Make two comparisons instead of |
6197 | | * |
6198 | | * off + sizeof(uint16_t) > tif->tif_size |
6199 | | * |
6200 | | * to avoid overflow. |
6201 | | */ |
6202 | 276k | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
6203 | 274k | { |
6204 | 274k | m = (tmsize_t)((uint64_t)off + sizeof(uint16_t)); |
6205 | 274k | if ((m < off) || ((uint64_t)m < sizeof(uint16_t)) || |
6206 | 274k | ((uint64_t)m > (uint64_t)tif->tif_size)) |
6207 | 16.3k | { |
6208 | 16.3k | TIFFErrorExtR(tif, module, "Can not read TIFF directory count"); |
6209 | 16.3k | return 0; |
6210 | 16.3k | } |
6211 | 257k | else |
6212 | 257k | { |
6213 | 257k | _TIFFmemcpy(&dircount16, tif->tif_base + off, sizeof(uint16_t)); |
6214 | 257k | } |
6215 | 257k | off = (tmsize_t)((uint64_t)off + sizeof(uint16_t)); |
6216 | 257k | if (tif->tif_flags & TIFF_SWAB) |
6217 | 1.98k | TIFFSwabShort(&dircount16); |
6218 | 257k | if (dircount16 > 4096) |
6219 | 997 | { |
6220 | 997 | TIFFErrorExtR(tif, module, |
6221 | 997 | "Sanity check on directory count failed, this is " |
6222 | 997 | "probably not a valid IFD offset"); |
6223 | 997 | return 0; |
6224 | 997 | } |
6225 | 256k | dirsize = 12; |
6226 | 256k | } |
6227 | 2.44k | else |
6228 | 2.44k | { |
6229 | 2.44k | uint64_t dircount64; |
6230 | 2.44k | m = (tmsize_t)((uint64_t)off + sizeof(uint64_t)); |
6231 | 2.44k | if ((m < off) || ((uint64_t)m < sizeof(uint64_t)) || |
6232 | 2.44k | ((uint64_t)m > (uint64_t)tif->tif_size)) |
6233 | 404 | { |
6234 | 404 | TIFFErrorExtR(tif, module, "Can not read TIFF directory count"); |
6235 | 404 | return 0; |
6236 | 404 | } |
6237 | 2.04k | else |
6238 | 2.04k | { |
6239 | 2.04k | _TIFFmemcpy(&dircount64, tif->tif_base + off, sizeof(uint64_t)); |
6240 | 2.04k | } |
6241 | 2.04k | off = (tmsize_t)((uint64_t)off + sizeof(uint64_t)); |
6242 | 2.04k | if (tif->tif_flags & TIFF_SWAB) |
6243 | 948 | TIFFSwabLong8(&dircount64); |
6244 | 2.04k | if (dircount64 > 4096) |
6245 | 125 | { |
6246 | 125 | TIFFErrorExtR(tif, module, |
6247 | 125 | "Sanity check on directory count failed, this is " |
6248 | 125 | "probably not a valid IFD offset"); |
6249 | 125 | return 0; |
6250 | 125 | } |
6251 | 1.91k | dircount16 = (uint16_t)dircount64; |
6252 | 1.91k | dirsize = 20; |
6253 | 1.91k | } |
6254 | 258k | if (dircount16 == 0) |
6255 | 764 | { |
6256 | 764 | TIFFErrorExtR(tif, module, |
6257 | 764 | "Sanity check on directory count failed, zero tag " |
6258 | 764 | "directories not supported"); |
6259 | 764 | return 0; |
6260 | 764 | } |
6261 | | /* Before allocating a huge amount of memory for corrupted files, check |
6262 | | * if size of requested memory is not greater than file size. */ |
6263 | 257k | uint64_t filesize = TIFFGetFileSize(tif); |
6264 | 257k | uint64_t allocsize = (uint64_t)dircount16 * dirsize; |
6265 | 257k | if (allocsize > filesize) |
6266 | 654 | { |
6267 | 654 | TIFFWarningExtR( |
6268 | 654 | tif, module, |
6269 | 654 | "Requested memory size for TIFF directory of %" PRIu64 |
6270 | 654 | " is greater than filesize %" PRIu64 |
6271 | 654 | ". Memory not allocated, TIFF directory not read", |
6272 | 654 | allocsize, filesize); |
6273 | 654 | return 0; |
6274 | 654 | } |
6275 | 257k | origdir = _TIFFCheckMalloc(tif, dircount16, dirsize, |
6276 | 257k | "to read TIFF directory"); |
6277 | 257k | if (origdir == NULL) |
6278 | 0 | return 0; |
6279 | 257k | m = off + dircount16 * dirsize; |
6280 | 257k | if ((m < off) || (m < (tmsize_t)dircount16 * (tmsize_t)dirsize) || |
6281 | 257k | (m > tif->tif_size)) |
6282 | 120 | { |
6283 | 120 | TIFFErrorExtR(tif, module, "Can not read TIFF directory"); |
6284 | 120 | _TIFFfreeExt(tif, origdir); |
6285 | 120 | return 0; |
6286 | 120 | } |
6287 | 257k | else |
6288 | 257k | { |
6289 | 257k | _TIFFmemcpy(origdir, tif->tif_base + off, |
6290 | 257k | (tmsize_t)dircount16 * dirsize); |
6291 | 257k | } |
6292 | 257k | if (nextdiroff) |
6293 | 257k | { |
6294 | 257k | off += dircount16 * dirsize; |
6295 | 257k | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
6296 | 255k | { |
6297 | 255k | uint32_t nextdiroff32; |
6298 | 255k | m = (tmsize_t)((uint64_t)off + sizeof(uint32_t)); |
6299 | 255k | if ((m < off) || ((uint64_t)m < sizeof(uint32_t)) || |
6300 | 255k | ((uint64_t)m > (uint64_t)tif->tif_size)) |
6301 | 29.3k | nextdiroff32 = 0; |
6302 | 225k | else |
6303 | 225k | _TIFFmemcpy(&nextdiroff32, tif->tif_base + off, |
6304 | 225k | sizeof(uint32_t)); |
6305 | 255k | if (tif->tif_flags & TIFF_SWAB) |
6306 | 1.94k | TIFFSwabLong(&nextdiroff32); |
6307 | 255k | *nextdiroff = nextdiroff32; |
6308 | 255k | } |
6309 | 1.90k | else |
6310 | 1.90k | { |
6311 | 1.90k | m = (tmsize_t)((uint64_t)off + sizeof(uint64_t)); |
6312 | 1.90k | if ((m < off) || ((uint64_t)m < sizeof(uint64_t)) || |
6313 | 1.90k | ((uint64_t)m > (uint64_t)tif->tif_size)) |
6314 | 903 | *nextdiroff = 0; |
6315 | 1.00k | else |
6316 | 1.00k | _TIFFmemcpy(nextdiroff, tif->tif_base + off, |
6317 | 1.00k | sizeof(uint64_t)); |
6318 | 1.90k | if (tif->tif_flags & TIFF_SWAB) |
6319 | 877 | TIFFSwabLong8(nextdiroff); |
6320 | 1.90k | } |
6321 | 257k | } |
6322 | 257k | } |
6323 | | /* No check against filesize needed here because "dir" should have same size |
6324 | | * than "origdir" checked above. */ |
6325 | 1.28M | dir = (TIFFDirEntry *)_TIFFCheckMalloc( |
6326 | 1.28M | tif, dircount16, sizeof(TIFFDirEntry), "to read TIFF directory"); |
6327 | 1.28M | if (dir == 0) |
6328 | 0 | { |
6329 | 0 | _TIFFfreeExt(tif, origdir); |
6330 | 0 | return 0; |
6331 | 0 | } |
6332 | 1.28M | ma = (uint8_t *)origdir; |
6333 | 1.28M | mb = dir; |
6334 | 89.7M | for (n = 0; n < dircount16; n++) |
6335 | 88.4M | { |
6336 | 88.4M | mb->tdir_ignore = FALSE; |
6337 | 88.4M | if (tif->tif_flags & TIFF_SWAB) |
6338 | 216k | TIFFSwabShort((uint16_t *)ma); |
6339 | 88.4M | mb->tdir_tag = *(uint16_t *)ma; |
6340 | 88.4M | ma += sizeof(uint16_t); |
6341 | 88.4M | if (tif->tif_flags & TIFF_SWAB) |
6342 | 216k | TIFFSwabShort((uint16_t *)ma); |
6343 | 88.4M | mb->tdir_type = *(uint16_t *)ma; |
6344 | 88.4M | ma += sizeof(uint16_t); |
6345 | 88.4M | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
6346 | 88.3M | { |
6347 | 88.3M | if (tif->tif_flags & TIFF_SWAB) |
6348 | 200k | TIFFSwabLong((uint32_t *)ma); |
6349 | 88.3M | mb->tdir_count = (uint64_t)(*(uint32_t *)ma); |
6350 | 88.3M | ma += sizeof(uint32_t); |
6351 | 88.3M | mb->tdir_offset.toff_long8 = 0; |
6352 | 88.3M | *(uint32_t *)(&mb->tdir_offset) = *(uint32_t *)ma; |
6353 | 88.3M | ma += sizeof(uint32_t); |
6354 | 88.3M | } |
6355 | 118k | else |
6356 | 118k | { |
6357 | 118k | if (tif->tif_flags & TIFF_SWAB) |
6358 | 15.8k | TIFFSwabLong8((uint64_t *)ma); |
6359 | 118k | mb->tdir_count = TIFFReadUInt64(ma); |
6360 | 118k | ma += sizeof(uint64_t); |
6361 | 118k | mb->tdir_offset.toff_long8 = TIFFReadUInt64(ma); |
6362 | 118k | ma += sizeof(uint64_t); |
6363 | 118k | } |
6364 | 88.4M | mb++; |
6365 | 88.4M | } |
6366 | 1.28M | _TIFFfreeExt(tif, origdir); |
6367 | 1.28M | *pdir = dir; |
6368 | 1.28M | return dircount16; |
6369 | 1.28M | } |
6370 | | |
6371 | | /* |
6372 | | * Fetch a tag that is not handled by special case code. |
6373 | | */ |
6374 | | static int TIFFFetchNormalTag(TIFF *tif, TIFFDirEntry *dp, int recover) |
6375 | 36.3M | { |
6376 | 36.3M | static const char module[] = "TIFFFetchNormalTag"; |
6377 | 36.3M | enum TIFFReadDirEntryErr err; |
6378 | 36.3M | uint32_t fii; |
6379 | 36.3M | const TIFFField *fip = NULL; |
6380 | 36.3M | TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii); |
6381 | 36.3M | if (fii == FAILED_FII) |
6382 | 0 | { |
6383 | 0 | TIFFErrorExtR(tif, "TIFFFetchNormalTag", |
6384 | 0 | "No definition found for tag %" PRIu16, dp->tdir_tag); |
6385 | 0 | return 0; |
6386 | 0 | } |
6387 | 36.3M | fip = tif->tif_fields[fii]; |
6388 | 36.3M | assert(fip != NULL); /* should not happen */ |
6389 | 36.3M | assert(fip->set_get_field_type != |
6390 | 36.3M | TIFF_SETGET_OTHER); /* if so, we shouldn't arrive here but deal with |
6391 | | this in specialized code */ |
6392 | 36.3M | assert(fip->set_get_field_type != |
6393 | 36.3M | TIFF_SETGET_INT); /* if so, we shouldn't arrive here as this is only |
6394 | | the case for pseudo-tags */ |
6395 | 36.3M | err = TIFFReadDirEntryErrOk; |
6396 | 36.3M | switch (fip->set_get_field_type) |
6397 | 36.3M | { |
6398 | 26.2M | case TIFF_SETGET_UNDEFINED: |
6399 | 26.2M | TIFFErrorExtR( |
6400 | 26.2M | tif, "TIFFFetchNormalTag", |
6401 | 26.2M | "Defined set_get_field_type of custom tag %u (%s) is " |
6402 | 26.2M | "TIFF_SETGET_UNDEFINED and thus tag is not read from file", |
6403 | 26.2M | fip->field_tag, fip->field_name); |
6404 | 26.2M | break; |
6405 | 389k | case TIFF_SETGET_ASCII: |
6406 | 389k | { |
6407 | 389k | uint8_t *data; |
6408 | 389k | assert(fip->field_passcount == 0); |
6409 | 389k | err = TIFFReadDirEntryByteArray(tif, dp, &data); |
6410 | 389k | if (err == TIFFReadDirEntryErrOk) |
6411 | 257k | { |
6412 | 257k | size_t mb = 0; |
6413 | 257k | int n; |
6414 | 257k | if (data != NULL) |
6415 | 253k | { |
6416 | 253k | if (dp->tdir_count > 0 && data[dp->tdir_count - 1] == 0) |
6417 | 95.4k | { |
6418 | | /* optimization: if data is known to be 0 terminated, we |
6419 | | * can use strlen() */ |
6420 | 95.4k | mb = strlen((const char *)data); |
6421 | 95.4k | } |
6422 | 158k | else |
6423 | 158k | { |
6424 | | /* general case. equivalent to non-portable */ |
6425 | | /* mb = strnlen((const char*)data, |
6426 | | * (uint32_t)dp->tdir_count); */ |
6427 | 158k | uint8_t *ma = data; |
6428 | 16.9M | while (mb < (uint32_t)dp->tdir_count) |
6429 | 16.9M | { |
6430 | 16.9M | if (*ma == 0) |
6431 | 94.9k | break; |
6432 | 16.8M | ma++; |
6433 | 16.8M | mb++; |
6434 | 16.8M | } |
6435 | 158k | } |
6436 | 253k | } |
6437 | 257k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6438 | 10 | { |
6439 | 10 | if (data != NULL) |
6440 | 10 | _TIFFfreeExt(tif, data); |
6441 | 10 | return (0); |
6442 | 10 | } |
6443 | 257k | if (mb + 1 < (uint32_t)dp->tdir_count) |
6444 | 176k | TIFFWarningExtR( |
6445 | 176k | tif, module, |
6446 | 176k | "ASCII value for tag \"%s\" contains null byte in " |
6447 | 176k | "value; value incorrectly truncated during reading due " |
6448 | 176k | "to implementation limitations", |
6449 | 176k | fip->field_name); |
6450 | 80.0k | else if (mb + 1 > (uint32_t)dp->tdir_count) |
6451 | 66.6k | { |
6452 | 66.6k | TIFFWarningExtR(tif, module, |
6453 | 66.6k | "ASCII value for tag \"%s\" does not end " |
6454 | 66.6k | "in null byte. Forcing it to be null", |
6455 | 66.6k | fip->field_name); |
6456 | | /* TIFFReadDirEntryArrayWithLimit() ensures this can't be |
6457 | | * larger than MAX_SIZE_TAG_DATA */ |
6458 | 66.6k | assert((uint32_t)dp->tdir_count + 1 == dp->tdir_count + 1); |
6459 | 66.6k | uint8_t *o = (uint8_t *)_TIFFmallocExt( |
6460 | 66.6k | tif, (uint32_t)dp->tdir_count + 1); |
6461 | 66.6k | if (o == NULL) |
6462 | 0 | { |
6463 | 0 | if (data != NULL) |
6464 | 0 | _TIFFfreeExt(tif, data); |
6465 | 0 | return (0); |
6466 | 0 | } |
6467 | 66.6k | if (dp->tdir_count > 0) |
6468 | 63.3k | { |
6469 | 63.3k | _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count); |
6470 | 63.3k | } |
6471 | 66.6k | o[(uint32_t)dp->tdir_count] = 0; |
6472 | 66.6k | if (data != 0) |
6473 | 63.3k | _TIFFfreeExt(tif, data); |
6474 | 66.6k | data = o; |
6475 | 66.6k | } |
6476 | 257k | n = TIFFSetField(tif, dp->tdir_tag, data); |
6477 | 257k | if (data != 0) |
6478 | 257k | _TIFFfreeExt(tif, data); |
6479 | 257k | if (!n) |
6480 | 0 | return (0); |
6481 | 257k | } |
6482 | 389k | } |
6483 | 389k | break; |
6484 | 389k | case TIFF_SETGET_UINT8: |
6485 | 16.9k | { |
6486 | 16.9k | uint8_t data = 0; |
6487 | 16.9k | assert(fip->field_readcount == 1); |
6488 | 16.9k | assert(fip->field_passcount == 0); |
6489 | 16.9k | err = TIFFReadDirEntryByte(tif, dp, &data); |
6490 | 16.9k | if (err == TIFFReadDirEntryErrOk) |
6491 | 4.00k | { |
6492 | 4.00k | if (!TIFFSetField(tif, dp->tdir_tag, data)) |
6493 | 0 | return (0); |
6494 | 4.00k | } |
6495 | 16.9k | } |
6496 | 16.9k | break; |
6497 | 16.9k | case TIFF_SETGET_SINT8: |
6498 | 0 | { |
6499 | 0 | int8_t data = 0; |
6500 | 0 | assert(fip->field_readcount == 1); |
6501 | 0 | assert(fip->field_passcount == 0); |
6502 | 0 | err = TIFFReadDirEntrySbyte(tif, dp, &data); |
6503 | 0 | if (err == TIFFReadDirEntryErrOk) |
6504 | 0 | { |
6505 | 0 | if (!TIFFSetField(tif, dp->tdir_tag, data)) |
6506 | 0 | return (0); |
6507 | 0 | } |
6508 | 0 | } |
6509 | 0 | break; |
6510 | 2.50M | case TIFF_SETGET_UINT16: |
6511 | 2.50M | { |
6512 | 2.50M | uint16_t data; |
6513 | 2.50M | assert(fip->field_readcount == 1); |
6514 | 2.50M | assert(fip->field_passcount == 0); |
6515 | 2.50M | err = TIFFReadDirEntryShort(tif, dp, &data); |
6516 | 2.50M | if (err == TIFFReadDirEntryErrOk) |
6517 | 2.25M | { |
6518 | 2.25M | if (!TIFFSetField(tif, dp->tdir_tag, data)) |
6519 | 9.00k | return (0); |
6520 | 2.25M | } |
6521 | 2.50M | } |
6522 | 2.49M | break; |
6523 | 2.49M | case TIFF_SETGET_SINT16: |
6524 | 0 | { |
6525 | 0 | int16_t data; |
6526 | 0 | assert(fip->field_readcount == 1); |
6527 | 0 | assert(fip->field_passcount == 0); |
6528 | 0 | err = TIFFReadDirEntrySshort(tif, dp, &data); |
6529 | 0 | if (err == TIFFReadDirEntryErrOk) |
6530 | 0 | { |
6531 | 0 | if (!TIFFSetField(tif, dp->tdir_tag, data)) |
6532 | 0 | return (0); |
6533 | 0 | } |
6534 | 0 | } |
6535 | 0 | break; |
6536 | 3.91M | case TIFF_SETGET_UINT32: |
6537 | 3.91M | { |
6538 | 3.91M | uint32_t data; |
6539 | 3.91M | assert(fip->field_readcount == 1); |
6540 | 3.91M | assert(fip->field_passcount == 0); |
6541 | 3.91M | err = TIFFReadDirEntryLong(tif, dp, &data); |
6542 | 3.91M | if (err == TIFFReadDirEntryErrOk) |
6543 | 3.87M | { |
6544 | 3.87M | if (!TIFFSetField(tif, dp->tdir_tag, data)) |
6545 | 71 | return (0); |
6546 | 3.87M | } |
6547 | 3.91M | } |
6548 | 3.91M | break; |
6549 | 3.91M | case TIFF_SETGET_SINT32: |
6550 | 0 | { |
6551 | 0 | int32_t data; |
6552 | 0 | assert(fip->field_readcount == 1); |
6553 | 0 | assert(fip->field_passcount == 0); |
6554 | 0 | err = TIFFReadDirEntrySlong(tif, dp, &data); |
6555 | 0 | if (err == TIFFReadDirEntryErrOk) |
6556 | 0 | { |
6557 | 0 | if (!TIFFSetField(tif, dp->tdir_tag, data)) |
6558 | 0 | return (0); |
6559 | 0 | } |
6560 | 0 | } |
6561 | 0 | break; |
6562 | 34.6k | case TIFF_SETGET_UINT64: |
6563 | 34.6k | { |
6564 | 34.6k | uint64_t data; |
6565 | 34.6k | assert(fip->field_readcount == 1); |
6566 | 34.6k | assert(fip->field_passcount == 0); |
6567 | 34.6k | err = TIFFReadDirEntryLong8(tif, dp, &data); |
6568 | 34.6k | if (err == TIFFReadDirEntryErrOk) |
6569 | 15.7k | { |
6570 | 15.7k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6571 | 0 | return 0; |
6572 | 15.7k | if (!TIFFSetField(tif, dp->tdir_tag, data)) |
6573 | 416 | return (0); |
6574 | 15.7k | } |
6575 | 34.6k | } |
6576 | 34.2k | break; |
6577 | 34.2k | case TIFF_SETGET_SINT64: |
6578 | 0 | { |
6579 | 0 | int64_t data; |
6580 | 0 | assert(fip->field_readcount == 1); |
6581 | 0 | assert(fip->field_passcount == 0); |
6582 | 0 | err = TIFFReadDirEntrySlong8(tif, dp, &data); |
6583 | 0 | if (err == TIFFReadDirEntryErrOk) |
6584 | 0 | { |
6585 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6586 | 0 | return 0; |
6587 | 0 | if (!TIFFSetField(tif, dp->tdir_tag, data)) |
6588 | 0 | return (0); |
6589 | 0 | } |
6590 | 0 | } |
6591 | 0 | break; |
6592 | 126k | case TIFF_SETGET_FLOAT: |
6593 | 126k | { |
6594 | 126k | float data; |
6595 | 126k | assert(fip->field_readcount == 1); |
6596 | 126k | assert(fip->field_passcount == 0); |
6597 | 126k | err = TIFFReadDirEntryFloat(tif, dp, &data); |
6598 | 126k | if (err == TIFFReadDirEntryErrOk) |
6599 | 66.8k | { |
6600 | 66.8k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6601 | 0 | return 0; |
6602 | 66.8k | if (!TIFFSetField(tif, dp->tdir_tag, (double)data)) |
6603 | 2.62k | return (0); |
6604 | 66.8k | } |
6605 | 126k | } |
6606 | 123k | break; |
6607 | 123k | case TIFF_SETGET_DOUBLE: |
6608 | 7.77k | { |
6609 | 7.77k | double data; |
6610 | 7.77k | assert(fip->field_readcount == 1); |
6611 | 7.77k | assert(fip->field_passcount == 0); |
6612 | 7.77k | err = TIFFReadDirEntryDouble(tif, dp, &data); |
6613 | 7.77k | if (err == TIFFReadDirEntryErrOk) |
6614 | 4.52k | { |
6615 | 4.52k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6616 | 0 | return 0; |
6617 | 4.52k | if (!TIFFSetField(tif, dp->tdir_tag, data)) |
6618 | 0 | return (0); |
6619 | 4.52k | } |
6620 | 7.77k | } |
6621 | 7.77k | break; |
6622 | 9.34k | case TIFF_SETGET_IFD8: |
6623 | 9.34k | { |
6624 | 9.34k | uint64_t data; |
6625 | 9.34k | assert(fip->field_readcount == 1); |
6626 | 9.34k | assert(fip->field_passcount == 0); |
6627 | 9.34k | err = TIFFReadDirEntryIfd8(tif, dp, &data); |
6628 | 9.34k | if (err == TIFFReadDirEntryErrOk) |
6629 | 1.84k | { |
6630 | 1.84k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6631 | 0 | return 0; |
6632 | 1.84k | if (!TIFFSetField(tif, dp->tdir_tag, data)) |
6633 | 776 | return (0); |
6634 | 1.84k | } |
6635 | 9.34k | } |
6636 | 8.57k | break; |
6637 | 70.5k | case TIFF_SETGET_UINT16_PAIR: |
6638 | 70.5k | { |
6639 | 70.5k | uint16_t *data; |
6640 | 70.5k | assert(fip->field_readcount == 2); |
6641 | 70.5k | assert(fip->field_passcount == 0); |
6642 | 70.5k | if (dp->tdir_count != 2) |
6643 | 26.9k | { |
6644 | 26.9k | TIFFWarningExtR(tif, module, |
6645 | 26.9k | "incorrect count for field \"%s\", expected 2, " |
6646 | 26.9k | "got %" PRIu64, |
6647 | 26.9k | fip->field_name, dp->tdir_count); |
6648 | 26.9k | return (0); |
6649 | 26.9k | } |
6650 | 43.5k | err = TIFFReadDirEntryShortArray(tif, dp, &data); |
6651 | 43.5k | if (err == TIFFReadDirEntryErrOk) |
6652 | 40.8k | { |
6653 | 40.8k | int m; |
6654 | 40.8k | assert(data); /* avoid CLang static Analyzer false positive */ |
6655 | 40.8k | m = TIFFSetField(tif, dp->tdir_tag, data[0], data[1]); |
6656 | 40.8k | _TIFFfreeExt(tif, data); |
6657 | 40.8k | if (!m) |
6658 | 0 | return (0); |
6659 | 40.8k | } |
6660 | 43.5k | } |
6661 | 43.5k | break; |
6662 | 43.5k | case TIFF_SETGET_C0_UINT8: |
6663 | 4.83k | { |
6664 | 4.83k | uint8_t *data; |
6665 | 4.83k | assert(fip->field_readcount >= 1); |
6666 | 4.83k | assert(fip->field_passcount == 0); |
6667 | 4.83k | if (dp->tdir_count != (uint64_t)fip->field_readcount) |
6668 | 2.70k | { |
6669 | 2.70k | TIFFWarningExtR(tif, module, |
6670 | 2.70k | "incorrect count for field \"%s\", expected " |
6671 | 2.70k | "%d, got %" PRIu64, |
6672 | 2.70k | fip->field_name, (int)fip->field_readcount, |
6673 | 2.70k | dp->tdir_count); |
6674 | 2.70k | return (0); |
6675 | 2.70k | } |
6676 | 2.12k | else |
6677 | 2.12k | { |
6678 | 2.12k | err = TIFFReadDirEntryByteArray(tif, dp, &data); |
6679 | 2.12k | if (err == TIFFReadDirEntryErrOk) |
6680 | 1.59k | { |
6681 | 1.59k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6682 | 0 | { |
6683 | 0 | if (data != 0) |
6684 | 0 | _TIFFfreeExt(tif, data); |
6685 | 0 | return 0; |
6686 | 0 | } |
6687 | 1.59k | int m; |
6688 | 1.59k | m = TIFFSetField(tif, dp->tdir_tag, data); |
6689 | 1.59k | if (data != 0) |
6690 | 1.59k | _TIFFfreeExt(tif, data); |
6691 | 1.59k | if (!m) |
6692 | 0 | return (0); |
6693 | 1.59k | } |
6694 | 2.12k | } |
6695 | 4.83k | } |
6696 | 2.12k | break; |
6697 | 2.12k | case TIFF_SETGET_C0_SINT8: |
6698 | 0 | { |
6699 | 0 | int8_t *data; |
6700 | 0 | assert(fip->field_readcount >= 1); |
6701 | 0 | assert(fip->field_passcount == 0); |
6702 | 0 | if (dp->tdir_count != (uint64_t)fip->field_readcount) |
6703 | 0 | { |
6704 | 0 | TIFFWarningExtR(tif, module, |
6705 | 0 | "incorrect count for field \"%s\", expected " |
6706 | 0 | "%d, got %" PRIu64, |
6707 | 0 | fip->field_name, (int)fip->field_readcount, |
6708 | 0 | dp->tdir_count); |
6709 | 0 | return (0); |
6710 | 0 | } |
6711 | 0 | else |
6712 | 0 | { |
6713 | 0 | err = TIFFReadDirEntrySbyteArray(tif, dp, &data); |
6714 | 0 | if (err == TIFFReadDirEntryErrOk) |
6715 | 0 | { |
6716 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6717 | 0 | { |
6718 | 0 | if (data != 0) |
6719 | 0 | _TIFFfreeExt(tif, data); |
6720 | 0 | return 0; |
6721 | 0 | } |
6722 | 0 | int m; |
6723 | 0 | m = TIFFSetField(tif, dp->tdir_tag, data); |
6724 | 0 | if (data != 0) |
6725 | 0 | _TIFFfreeExt(tif, data); |
6726 | 0 | if (!m) |
6727 | 0 | return (0); |
6728 | 0 | } |
6729 | 0 | } |
6730 | 0 | } |
6731 | 0 | break; |
6732 | 1.67k | case TIFF_SETGET_C0_UINT16: |
6733 | 1.67k | { |
6734 | 1.67k | uint16_t *data; |
6735 | 1.67k | assert(fip->field_readcount >= 1); |
6736 | 1.67k | assert(fip->field_passcount == 0); |
6737 | 1.67k | if (dp->tdir_count != (uint64_t)fip->field_readcount) |
6738 | 1.04k | { |
6739 | 1.04k | TIFFWarningExtR(tif, module, |
6740 | 1.04k | "incorrect count for field \"%s\", expected " |
6741 | 1.04k | "%d, got %" PRIu64, |
6742 | 1.04k | fip->field_name, (int)fip->field_readcount, |
6743 | 1.04k | dp->tdir_count); |
6744 | 1.04k | return (0); |
6745 | 1.04k | } |
6746 | 631 | else |
6747 | 631 | { |
6748 | 631 | err = TIFFReadDirEntryShortArray(tif, dp, &data); |
6749 | 631 | if (err == TIFFReadDirEntryErrOk) |
6750 | 255 | { |
6751 | 255 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6752 | 0 | { |
6753 | 0 | if (data != 0) |
6754 | 0 | _TIFFfreeExt(tif, data); |
6755 | 0 | return 0; |
6756 | 0 | } |
6757 | 255 | int m; |
6758 | 255 | m = TIFFSetField(tif, dp->tdir_tag, data); |
6759 | 255 | if (data != 0) |
6760 | 255 | _TIFFfreeExt(tif, data); |
6761 | 255 | if (!m) |
6762 | 0 | return (0); |
6763 | 255 | } |
6764 | 631 | } |
6765 | 1.67k | } |
6766 | 631 | break; |
6767 | 631 | case TIFF_SETGET_C0_SINT16: |
6768 | 0 | { |
6769 | 0 | int16_t *data; |
6770 | 0 | assert(fip->field_readcount >= 1); |
6771 | 0 | assert(fip->field_passcount == 0); |
6772 | 0 | if (dp->tdir_count != (uint64_t)fip->field_readcount) |
6773 | 0 | { |
6774 | 0 | TIFFWarningExtR(tif, module, |
6775 | 0 | "incorrect count for field \"%s\", expected " |
6776 | 0 | "%d, got %" PRIu64, |
6777 | 0 | fip->field_name, (int)fip->field_readcount, |
6778 | 0 | dp->tdir_count); |
6779 | 0 | return (0); |
6780 | 0 | } |
6781 | 0 | else |
6782 | 0 | { |
6783 | 0 | err = TIFFReadDirEntrySshortArray(tif, dp, &data); |
6784 | 0 | if (err == TIFFReadDirEntryErrOk) |
6785 | 0 | { |
6786 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6787 | 0 | { |
6788 | 0 | if (data != 0) |
6789 | 0 | _TIFFfreeExt(tif, data); |
6790 | 0 | return 0; |
6791 | 0 | } |
6792 | 0 | int m; |
6793 | 0 | m = TIFFSetField(tif, dp->tdir_tag, data); |
6794 | 0 | if (data != 0) |
6795 | 0 | _TIFFfreeExt(tif, data); |
6796 | 0 | if (!m) |
6797 | 0 | return (0); |
6798 | 0 | } |
6799 | 0 | } |
6800 | 0 | } |
6801 | 0 | break; |
6802 | 3.65k | case TIFF_SETGET_C0_UINT32: |
6803 | 3.65k | { |
6804 | 3.65k | uint32_t *data; |
6805 | 3.65k | assert(fip->field_readcount >= 1); |
6806 | 3.65k | assert(fip->field_passcount == 0); |
6807 | 3.65k | if (dp->tdir_count != (uint64_t)fip->field_readcount) |
6808 | 1.07k | { |
6809 | 1.07k | TIFFWarningExtR(tif, module, |
6810 | 1.07k | "incorrect count for field \"%s\", expected " |
6811 | 1.07k | "%d, got %" PRIu64, |
6812 | 1.07k | fip->field_name, (int)fip->field_readcount, |
6813 | 1.07k | dp->tdir_count); |
6814 | 1.07k | return (0); |
6815 | 1.07k | } |
6816 | 2.58k | else |
6817 | 2.58k | { |
6818 | 2.58k | err = TIFFReadDirEntryLongArray(tif, dp, &data); |
6819 | 2.58k | if (err == TIFFReadDirEntryErrOk) |
6820 | 612 | { |
6821 | 612 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6822 | 0 | { |
6823 | 0 | if (data != 0) |
6824 | 0 | _TIFFfreeExt(tif, data); |
6825 | 0 | return 0; |
6826 | 0 | } |
6827 | 612 | int m; |
6828 | 612 | m = TIFFSetField(tif, dp->tdir_tag, data); |
6829 | 612 | if (data != 0) |
6830 | 612 | _TIFFfreeExt(tif, data); |
6831 | 612 | if (!m) |
6832 | 0 | return (0); |
6833 | 612 | } |
6834 | 2.58k | } |
6835 | 3.65k | } |
6836 | 2.58k | break; |
6837 | 2.58k | case TIFF_SETGET_C0_SINT32: |
6838 | 0 | { |
6839 | 0 | int32_t *data; |
6840 | 0 | assert(fip->field_readcount >= 1); |
6841 | 0 | assert(fip->field_passcount == 0); |
6842 | 0 | if (dp->tdir_count != (uint64_t)fip->field_readcount) |
6843 | 0 | { |
6844 | 0 | TIFFWarningExtR(tif, module, |
6845 | 0 | "incorrect count for field \"%s\", expected " |
6846 | 0 | "%d, got %" PRIu64, |
6847 | 0 | fip->field_name, (int)fip->field_readcount, |
6848 | 0 | dp->tdir_count); |
6849 | 0 | return (0); |
6850 | 0 | } |
6851 | 0 | else |
6852 | 0 | { |
6853 | 0 | err = TIFFReadDirEntrySlongArray(tif, dp, &data); |
6854 | 0 | if (err == TIFFReadDirEntryErrOk) |
6855 | 0 | { |
6856 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6857 | 0 | { |
6858 | 0 | if (data != 0) |
6859 | 0 | _TIFFfreeExt(tif, data); |
6860 | 0 | return 0; |
6861 | 0 | } |
6862 | 0 | int m; |
6863 | 0 | m = TIFFSetField(tif, dp->tdir_tag, data); |
6864 | 0 | if (data != 0) |
6865 | 0 | _TIFFfreeExt(tif, data); |
6866 | 0 | if (!m) |
6867 | 0 | return (0); |
6868 | 0 | } |
6869 | 0 | } |
6870 | 0 | } |
6871 | 0 | break; |
6872 | 0 | case TIFF_SETGET_C0_UINT64: |
6873 | 0 | { |
6874 | 0 | uint64_t *data; |
6875 | 0 | assert(fip->field_readcount >= 1); |
6876 | 0 | assert(fip->field_passcount == 0); |
6877 | 0 | if (dp->tdir_count != (uint64_t)fip->field_readcount) |
6878 | 0 | { |
6879 | 0 | TIFFWarningExtR(tif, module, |
6880 | 0 | "incorrect count for field \"%s\", expected " |
6881 | 0 | "%d, got %" PRIu64, |
6882 | 0 | fip->field_name, (int)fip->field_readcount, |
6883 | 0 | dp->tdir_count); |
6884 | 0 | return (0); |
6885 | 0 | } |
6886 | 0 | else |
6887 | 0 | { |
6888 | 0 | err = TIFFReadDirEntryLong8Array(tif, dp, &data); |
6889 | 0 | if (err == TIFFReadDirEntryErrOk) |
6890 | 0 | { |
6891 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6892 | 0 | { |
6893 | 0 | if (data != 0) |
6894 | 0 | _TIFFfreeExt(tif, data); |
6895 | 0 | return 0; |
6896 | 0 | } |
6897 | 0 | int m; |
6898 | 0 | m = TIFFSetField(tif, dp->tdir_tag, data); |
6899 | 0 | if (data != 0) |
6900 | 0 | _TIFFfreeExt(tif, data); |
6901 | 0 | if (!m) |
6902 | 0 | return (0); |
6903 | 0 | } |
6904 | 0 | } |
6905 | 0 | } |
6906 | 0 | break; |
6907 | 0 | case TIFF_SETGET_C0_SINT64: |
6908 | 0 | { |
6909 | 0 | int64_t *data; |
6910 | 0 | assert(fip->field_readcount >= 1); |
6911 | 0 | assert(fip->field_passcount == 0); |
6912 | 0 | if (dp->tdir_count != (uint64_t)fip->field_readcount) |
6913 | 0 | { |
6914 | 0 | TIFFWarningExtR(tif, module, |
6915 | 0 | "incorrect count for field \"%s\", expected " |
6916 | 0 | "%d, got %" PRIu64, |
6917 | 0 | fip->field_name, (int)fip->field_readcount, |
6918 | 0 | dp->tdir_count); |
6919 | 0 | return (0); |
6920 | 0 | } |
6921 | 0 | else |
6922 | 0 | { |
6923 | 0 | err = TIFFReadDirEntrySlong8Array(tif, dp, &data); |
6924 | 0 | if (err == TIFFReadDirEntryErrOk) |
6925 | 0 | { |
6926 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6927 | 0 | { |
6928 | 0 | if (data != 0) |
6929 | 0 | _TIFFfreeExt(tif, data); |
6930 | 0 | return 0; |
6931 | 0 | } |
6932 | 0 | int m; |
6933 | 0 | m = TIFFSetField(tif, dp->tdir_tag, data); |
6934 | 0 | if (data != 0) |
6935 | 0 | _TIFFfreeExt(tif, data); |
6936 | 0 | if (!m) |
6937 | 0 | return (0); |
6938 | 0 | } |
6939 | 0 | } |
6940 | 0 | } |
6941 | 0 | break; |
6942 | 49.0k | case TIFF_SETGET_C0_FLOAT: |
6943 | 49.0k | { |
6944 | 49.0k | float *data; |
6945 | 49.0k | assert(fip->field_readcount >= 1); |
6946 | 49.0k | assert(fip->field_passcount == 0); |
6947 | 49.0k | if (dp->tdir_count != (uint64_t)fip->field_readcount) |
6948 | 28.4k | { |
6949 | 28.4k | TIFFWarningExtR(tif, module, |
6950 | 28.4k | "incorrect count for field \"%s\", expected " |
6951 | 28.4k | "%d, got %" PRIu64, |
6952 | 28.4k | fip->field_name, (int)fip->field_readcount, |
6953 | 28.4k | dp->tdir_count); |
6954 | 28.4k | return (0); |
6955 | 28.4k | } |
6956 | 20.6k | else |
6957 | 20.6k | { |
6958 | 20.6k | err = TIFFReadDirEntryFloatArray(tif, dp, &data); |
6959 | 20.6k | if (err == TIFFReadDirEntryErrOk) |
6960 | 17.7k | { |
6961 | 17.7k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6962 | 0 | { |
6963 | 0 | if (data != 0) |
6964 | 0 | _TIFFfreeExt(tif, data); |
6965 | 0 | return 0; |
6966 | 0 | } |
6967 | 17.7k | int m; |
6968 | 17.7k | m = TIFFSetField(tif, dp->tdir_tag, data); |
6969 | 17.7k | if (data != 0) |
6970 | 17.7k | _TIFFfreeExt(tif, data); |
6971 | 17.7k | if (!m) |
6972 | 0 | return (0); |
6973 | 17.7k | } |
6974 | 20.6k | } |
6975 | 49.0k | } |
6976 | 20.6k | break; |
6977 | | /*--: Rational2Double: Extend for Double Arrays and Rational-Arrays read |
6978 | | * into Double-Arrays. */ |
6979 | 20.6k | case TIFF_SETGET_C0_DOUBLE: |
6980 | 0 | { |
6981 | 0 | double *data; |
6982 | 0 | assert(fip->field_readcount >= 1); |
6983 | 0 | assert(fip->field_passcount == 0); |
6984 | 0 | if (dp->tdir_count != (uint64_t)fip->field_readcount) |
6985 | 0 | { |
6986 | 0 | TIFFWarningExtR(tif, module, |
6987 | 0 | "incorrect count for field \"%s\", expected " |
6988 | 0 | "%d, got %" PRIu64, |
6989 | 0 | fip->field_name, (int)fip->field_readcount, |
6990 | 0 | dp->tdir_count); |
6991 | 0 | return (0); |
6992 | 0 | } |
6993 | 0 | else |
6994 | 0 | { |
6995 | 0 | err = TIFFReadDirEntryDoubleArray(tif, dp, &data); |
6996 | 0 | if (err == TIFFReadDirEntryErrOk) |
6997 | 0 | { |
6998 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
6999 | 0 | { |
7000 | 0 | if (data != 0) |
7001 | 0 | _TIFFfreeExt(tif, data); |
7002 | 0 | return 0; |
7003 | 0 | } |
7004 | 0 | int m; |
7005 | 0 | m = TIFFSetField(tif, dp->tdir_tag, data); |
7006 | 0 | if (data != 0) |
7007 | 0 | _TIFFfreeExt(tif, data); |
7008 | 0 | if (!m) |
7009 | 0 | return (0); |
7010 | 0 | } |
7011 | 0 | } |
7012 | 0 | } |
7013 | 0 | break; |
7014 | 0 | case TIFF_SETGET_C0_IFD8: |
7015 | 0 | { |
7016 | 0 | uint64_t *data; |
7017 | 0 | assert(fip->field_readcount >= 1); |
7018 | 0 | assert(fip->field_passcount == 0); |
7019 | 0 | if (dp->tdir_count != (uint64_t)fip->field_readcount) |
7020 | 0 | { |
7021 | 0 | TIFFWarningExtR(tif, module, |
7022 | 0 | "incorrect count for field \"%s\", expected " |
7023 | 0 | "%d, got %" PRIu64, |
7024 | 0 | fip->field_name, (int)fip->field_readcount, |
7025 | 0 | dp->tdir_count); |
7026 | 0 | return (0); |
7027 | 0 | } |
7028 | 0 | else |
7029 | 0 | { |
7030 | 0 | err = TIFFReadDirEntryIfd8Array(tif, dp, &data); |
7031 | 0 | if (err == TIFFReadDirEntryErrOk) |
7032 | 0 | { |
7033 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7034 | 0 | { |
7035 | 0 | if (data != 0) |
7036 | 0 | _TIFFfreeExt(tif, data); |
7037 | 0 | return 0; |
7038 | 0 | } |
7039 | 0 | int m; |
7040 | 0 | m = TIFFSetField(tif, dp->tdir_tag, data); |
7041 | 0 | if (data != 0) |
7042 | 0 | _TIFFfreeExt(tif, data); |
7043 | 0 | if (!m) |
7044 | 0 | return (0); |
7045 | 0 | } |
7046 | 0 | } |
7047 | 0 | } |
7048 | 0 | break; |
7049 | 11.8k | case TIFF_SETGET_C16_ASCII: |
7050 | 11.8k | { |
7051 | 11.8k | uint8_t *data; |
7052 | 11.8k | assert(fip->field_readcount == TIFF_VARIABLE); |
7053 | 11.8k | assert(fip->field_passcount == 1); |
7054 | 11.8k | if (dp->tdir_count > 0xFFFF) |
7055 | 3.87k | err = TIFFReadDirEntryErrCount; |
7056 | 7.95k | else |
7057 | 7.95k | { |
7058 | 7.95k | err = TIFFReadDirEntryByteArray(tif, dp, &data); |
7059 | 7.95k | if (err == TIFFReadDirEntryErrOk) |
7060 | 4.74k | { |
7061 | 4.74k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7062 | 1 | { |
7063 | 1 | if (data != 0) |
7064 | 1 | _TIFFfreeExt(tif, data); |
7065 | 1 | return 0; |
7066 | 1 | } |
7067 | 4.74k | int m; |
7068 | 4.74k | if (data != 0 && dp->tdir_count > 0 && |
7069 | 4.20k | data[dp->tdir_count - 1] != '\0') |
7070 | 3.21k | { |
7071 | 3.21k | TIFFWarningExtR(tif, module, |
7072 | 3.21k | "ASCII value for ASCII array tag " |
7073 | 3.21k | "\"%s\" does not end in null " |
7074 | 3.21k | "byte. Forcing it to be null", |
7075 | 3.21k | fip->field_name); |
7076 | | /* Enlarge buffer and add terminating null. */ |
7077 | 3.21k | uint8_t *o = (uint8_t *)_TIFFmallocExt( |
7078 | 3.21k | tif, (uint32_t)dp->tdir_count + 1); |
7079 | 3.21k | if (o == NULL) |
7080 | 0 | { |
7081 | 0 | if (data != NULL) |
7082 | 0 | _TIFFfreeExt(tif, data); |
7083 | 0 | return (0); |
7084 | 0 | } |
7085 | 3.21k | if (dp->tdir_count > 0) |
7086 | 3.21k | { |
7087 | 3.21k | _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count); |
7088 | 3.21k | } |
7089 | 3.21k | o[(uint32_t)dp->tdir_count] = 0; |
7090 | 3.21k | dp->tdir_count++; /* Increment for added null. */ |
7091 | 3.21k | if (data != 0) |
7092 | 3.21k | _TIFFfreeExt(tif, data); |
7093 | 3.21k | data = o; |
7094 | 3.21k | } |
7095 | 4.74k | m = TIFFSetField(tif, dp->tdir_tag, |
7096 | 4.74k | (uint16_t)(dp->tdir_count), data); |
7097 | 4.74k | if (data != 0) |
7098 | 4.20k | _TIFFfreeExt(tif, data); |
7099 | 4.74k | if (!m) |
7100 | 537 | return (0); |
7101 | 4.74k | } |
7102 | 7.95k | } |
7103 | 11.8k | } |
7104 | 11.2k | break; |
7105 | 11.2k | case TIFF_SETGET_C16_UINT8: |
7106 | 3.88k | { |
7107 | 3.88k | uint8_t *data; |
7108 | 3.88k | assert(fip->field_readcount == TIFF_VARIABLE); |
7109 | 3.88k | assert(fip->field_passcount == 1); |
7110 | 3.88k | if (dp->tdir_count > 0xFFFF) |
7111 | 1.49k | err = TIFFReadDirEntryErrCount; |
7112 | 2.39k | else |
7113 | 2.39k | { |
7114 | 2.39k | err = TIFFReadDirEntryByteArray(tif, dp, &data); |
7115 | 2.39k | if (err == TIFFReadDirEntryErrOk) |
7116 | 910 | { |
7117 | 910 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7118 | 1 | { |
7119 | 1 | if (data != 0) |
7120 | 1 | _TIFFfreeExt(tif, data); |
7121 | 1 | return 0; |
7122 | 1 | } |
7123 | 909 | int m; |
7124 | 909 | m = TIFFSetField(tif, dp->tdir_tag, |
7125 | 909 | (uint16_t)(dp->tdir_count), data); |
7126 | 909 | if (data != 0) |
7127 | 550 | _TIFFfreeExt(tif, data); |
7128 | 909 | if (!m) |
7129 | 0 | return (0); |
7130 | 909 | } |
7131 | 2.39k | } |
7132 | 3.88k | } |
7133 | 3.88k | break; |
7134 | 3.88k | case TIFF_SETGET_C16_SINT8: |
7135 | 0 | { |
7136 | 0 | int8_t *data; |
7137 | 0 | assert(fip->field_readcount == TIFF_VARIABLE); |
7138 | 0 | assert(fip->field_passcount == 1); |
7139 | 0 | if (dp->tdir_count > 0xFFFF) |
7140 | 0 | err = TIFFReadDirEntryErrCount; |
7141 | 0 | else |
7142 | 0 | { |
7143 | 0 | err = TIFFReadDirEntrySbyteArray(tif, dp, &data); |
7144 | 0 | if (err == TIFFReadDirEntryErrOk) |
7145 | 0 | { |
7146 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7147 | 0 | { |
7148 | 0 | if (data != 0) |
7149 | 0 | _TIFFfreeExt(tif, data); |
7150 | 0 | return 0; |
7151 | 0 | } |
7152 | 0 | int m; |
7153 | 0 | m = TIFFSetField(tif, dp->tdir_tag, |
7154 | 0 | (uint16_t)(dp->tdir_count), data); |
7155 | 0 | if (data != 0) |
7156 | 0 | _TIFFfreeExt(tif, data); |
7157 | 0 | if (!m) |
7158 | 0 | return (0); |
7159 | 0 | } |
7160 | 0 | } |
7161 | 0 | } |
7162 | 0 | break; |
7163 | 212k | case TIFF_SETGET_C16_UINT16: |
7164 | 212k | { |
7165 | 212k | uint16_t *data; |
7166 | 212k | assert(fip->field_readcount == TIFF_VARIABLE); |
7167 | 212k | assert(fip->field_passcount == 1); |
7168 | 212k | if (dp->tdir_count > 0xFFFF) |
7169 | 5.96k | err = TIFFReadDirEntryErrCount; |
7170 | 206k | else |
7171 | 206k | { |
7172 | 206k | err = TIFFReadDirEntryShortArray(tif, dp, &data); |
7173 | 206k | if (err == TIFFReadDirEntryErrOk) |
7174 | 194k | { |
7175 | 194k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7176 | 0 | { |
7177 | 0 | if (data != 0) |
7178 | 0 | _TIFFfreeExt(tif, data); |
7179 | 0 | return 0; |
7180 | 0 | } |
7181 | 194k | int m; |
7182 | 194k | m = TIFFSetField(tif, dp->tdir_tag, |
7183 | 194k | (uint16_t)(dp->tdir_count), data); |
7184 | 194k | if (data != 0) |
7185 | 192k | _TIFFfreeExt(tif, data); |
7186 | 194k | if (!m) |
7187 | 169 | return (0); |
7188 | 194k | } |
7189 | 206k | } |
7190 | 212k | } |
7191 | 212k | break; |
7192 | 212k | case TIFF_SETGET_C16_SINT16: |
7193 | 0 | { |
7194 | 0 | int16_t *data; |
7195 | 0 | assert(fip->field_readcount == TIFF_VARIABLE); |
7196 | 0 | assert(fip->field_passcount == 1); |
7197 | 0 | if (dp->tdir_count > 0xFFFF) |
7198 | 0 | err = TIFFReadDirEntryErrCount; |
7199 | 0 | else |
7200 | 0 | { |
7201 | 0 | err = TIFFReadDirEntrySshortArray(tif, dp, &data); |
7202 | 0 | if (err == TIFFReadDirEntryErrOk) |
7203 | 0 | { |
7204 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7205 | 0 | { |
7206 | 0 | if (data != 0) |
7207 | 0 | _TIFFfreeExt(tif, data); |
7208 | 0 | return 0; |
7209 | 0 | } |
7210 | 0 | int m; |
7211 | 0 | m = TIFFSetField(tif, dp->tdir_tag, |
7212 | 0 | (uint16_t)(dp->tdir_count), data); |
7213 | 0 | if (data != 0) |
7214 | 0 | _TIFFfreeExt(tif, data); |
7215 | 0 | if (!m) |
7216 | 0 | return (0); |
7217 | 0 | } |
7218 | 0 | } |
7219 | 0 | } |
7220 | 0 | break; |
7221 | 19.6k | case TIFF_SETGET_C16_UINT32: |
7222 | 19.6k | { |
7223 | 19.6k | uint32_t *data; |
7224 | 19.6k | assert(fip->field_readcount == TIFF_VARIABLE); |
7225 | 19.6k | assert(fip->field_passcount == 1); |
7226 | 19.6k | if (dp->tdir_count > 0xFFFF) |
7227 | 3.95k | err = TIFFReadDirEntryErrCount; |
7228 | 15.6k | else |
7229 | 15.6k | { |
7230 | 15.6k | err = TIFFReadDirEntryLongArray(tif, dp, &data); |
7231 | 15.6k | if (err == TIFFReadDirEntryErrOk) |
7232 | 4.97k | { |
7233 | 4.97k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7234 | 1 | { |
7235 | 1 | if (data != 0) |
7236 | 1 | _TIFFfreeExt(tif, data); |
7237 | 1 | return 0; |
7238 | 1 | } |
7239 | 4.97k | int m; |
7240 | 4.97k | m = TIFFSetField(tif, dp->tdir_tag, |
7241 | 4.97k | (uint16_t)(dp->tdir_count), data); |
7242 | 4.97k | if (data != 0) |
7243 | 4.27k | _TIFFfreeExt(tif, data); |
7244 | 4.97k | if (!m) |
7245 | 0 | return (0); |
7246 | 4.97k | } |
7247 | 15.6k | } |
7248 | 19.6k | } |
7249 | 19.6k | break; |
7250 | 19.6k | case TIFF_SETGET_C16_SINT32: |
7251 | 0 | { |
7252 | 0 | int32_t *data; |
7253 | 0 | assert(fip->field_readcount == TIFF_VARIABLE); |
7254 | 0 | assert(fip->field_passcount == 1); |
7255 | 0 | if (dp->tdir_count > 0xFFFF) |
7256 | 0 | err = TIFFReadDirEntryErrCount; |
7257 | 0 | else |
7258 | 0 | { |
7259 | 0 | err = TIFFReadDirEntrySlongArray(tif, dp, &data); |
7260 | 0 | if (err == TIFFReadDirEntryErrOk) |
7261 | 0 | { |
7262 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7263 | 0 | { |
7264 | 0 | if (data != 0) |
7265 | 0 | _TIFFfreeExt(tif, data); |
7266 | 0 | return 0; |
7267 | 0 | } |
7268 | 0 | int m; |
7269 | 0 | m = TIFFSetField(tif, dp->tdir_tag, |
7270 | 0 | (uint16_t)(dp->tdir_count), data); |
7271 | 0 | if (data != 0) |
7272 | 0 | _TIFFfreeExt(tif, data); |
7273 | 0 | if (!m) |
7274 | 0 | return (0); |
7275 | 0 | } |
7276 | 0 | } |
7277 | 0 | } |
7278 | 0 | break; |
7279 | 0 | case TIFF_SETGET_C16_UINT64: |
7280 | 0 | { |
7281 | 0 | uint64_t *data; |
7282 | 0 | assert(fip->field_readcount == TIFF_VARIABLE); |
7283 | 0 | assert(fip->field_passcount == 1); |
7284 | 0 | if (dp->tdir_count > 0xFFFF) |
7285 | 0 | err = TIFFReadDirEntryErrCount; |
7286 | 0 | else |
7287 | 0 | { |
7288 | 0 | err = TIFFReadDirEntryLong8Array(tif, dp, &data); |
7289 | 0 | if (err == TIFFReadDirEntryErrOk) |
7290 | 0 | { |
7291 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7292 | 0 | { |
7293 | 0 | if (data != 0) |
7294 | 0 | _TIFFfreeExt(tif, data); |
7295 | 0 | return 0; |
7296 | 0 | } |
7297 | 0 | int m; |
7298 | 0 | m = TIFFSetField(tif, dp->tdir_tag, |
7299 | 0 | (uint16_t)(dp->tdir_count), data); |
7300 | 0 | if (data != 0) |
7301 | 0 | _TIFFfreeExt(tif, data); |
7302 | 0 | if (!m) |
7303 | 0 | return (0); |
7304 | 0 | } |
7305 | 0 | } |
7306 | 0 | } |
7307 | 0 | break; |
7308 | 0 | case TIFF_SETGET_C16_SINT64: |
7309 | 0 | { |
7310 | 0 | int64_t *data; |
7311 | 0 | assert(fip->field_readcount == TIFF_VARIABLE); |
7312 | 0 | assert(fip->field_passcount == 1); |
7313 | 0 | if (dp->tdir_count > 0xFFFF) |
7314 | 0 | err = TIFFReadDirEntryErrCount; |
7315 | 0 | else |
7316 | 0 | { |
7317 | 0 | err = TIFFReadDirEntrySlong8Array(tif, dp, &data); |
7318 | 0 | if (err == TIFFReadDirEntryErrOk) |
7319 | 0 | { |
7320 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7321 | 0 | { |
7322 | 0 | if (data != 0) |
7323 | 0 | _TIFFfreeExt(tif, data); |
7324 | 0 | return 0; |
7325 | 0 | } |
7326 | 0 | int m; |
7327 | 0 | m = TIFFSetField(tif, dp->tdir_tag, |
7328 | 0 | (uint16_t)(dp->tdir_count), data); |
7329 | 0 | if (data != 0) |
7330 | 0 | _TIFFfreeExt(tif, data); |
7331 | 0 | if (!m) |
7332 | 0 | return (0); |
7333 | 0 | } |
7334 | 0 | } |
7335 | 0 | } |
7336 | 0 | break; |
7337 | 21.7k | case TIFF_SETGET_C16_FLOAT: |
7338 | 21.7k | { |
7339 | 21.7k | float *data; |
7340 | 21.7k | assert(fip->field_readcount == TIFF_VARIABLE); |
7341 | 21.7k | assert(fip->field_passcount == 1); |
7342 | 21.7k | if (dp->tdir_count > 0xFFFF) |
7343 | 5.31k | err = TIFFReadDirEntryErrCount; |
7344 | 16.4k | else |
7345 | 16.4k | { |
7346 | 16.4k | err = TIFFReadDirEntryFloatArray(tif, dp, &data); |
7347 | 16.4k | if (err == TIFFReadDirEntryErrOk) |
7348 | 12.7k | { |
7349 | 12.7k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7350 | 1 | { |
7351 | 1 | if (data != 0) |
7352 | 1 | _TIFFfreeExt(tif, data); |
7353 | 1 | return 0; |
7354 | 1 | } |
7355 | 12.7k | int m; |
7356 | 12.7k | m = TIFFSetField(tif, dp->tdir_tag, |
7357 | 12.7k | (uint16_t)(dp->tdir_count), data); |
7358 | 12.7k | if (data != 0) |
7359 | 11.0k | _TIFFfreeExt(tif, data); |
7360 | 12.7k | if (!m) |
7361 | 0 | return (0); |
7362 | 12.7k | } |
7363 | 16.4k | } |
7364 | 21.7k | } |
7365 | 21.7k | break; |
7366 | 218k | case TIFF_SETGET_C16_DOUBLE: |
7367 | 218k | { |
7368 | 218k | double *data; |
7369 | 218k | assert(fip->field_readcount == TIFF_VARIABLE); |
7370 | 218k | assert(fip->field_passcount == 1); |
7371 | 218k | if (dp->tdir_count > 0xFFFF) |
7372 | 59.0k | err = TIFFReadDirEntryErrCount; |
7373 | 159k | else |
7374 | 159k | { |
7375 | 159k | err = TIFFReadDirEntryDoubleArray(tif, dp, &data); |
7376 | 159k | if (err == TIFFReadDirEntryErrOk) |
7377 | 114k | { |
7378 | 114k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7379 | 0 | { |
7380 | 0 | if (data != 0) |
7381 | 0 | _TIFFfreeExt(tif, data); |
7382 | 0 | return 0; |
7383 | 0 | } |
7384 | 114k | int m; |
7385 | 114k | m = TIFFSetField(tif, dp->tdir_tag, |
7386 | 114k | (uint16_t)(dp->tdir_count), data); |
7387 | 114k | if (data != 0) |
7388 | 112k | _TIFFfreeExt(tif, data); |
7389 | 114k | if (!m) |
7390 | 0 | return (0); |
7391 | 114k | } |
7392 | 159k | } |
7393 | 218k | } |
7394 | 218k | break; |
7395 | 218k | case TIFF_SETGET_C16_IFD8: |
7396 | 217k | { |
7397 | 217k | uint64_t *data; |
7398 | 217k | assert(fip->field_readcount == TIFF_VARIABLE); |
7399 | 217k | assert(fip->field_passcount == 1); |
7400 | 217k | if (dp->tdir_count > 0xFFFF) |
7401 | 4.75k | err = TIFFReadDirEntryErrCount; |
7402 | 212k | else |
7403 | 212k | { |
7404 | 212k | err = TIFFReadDirEntryIfd8Array(tif, dp, &data); |
7405 | 212k | if (err == TIFFReadDirEntryErrOk) |
7406 | 204k | { |
7407 | 204k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7408 | 1 | { |
7409 | 1 | if (data != 0) |
7410 | 1 | _TIFFfreeExt(tif, data); |
7411 | 1 | return 0; |
7412 | 1 | } |
7413 | 204k | int m; |
7414 | 204k | m = TIFFSetField(tif, dp->tdir_tag, |
7415 | 204k | (uint16_t)(dp->tdir_count), data); |
7416 | 204k | if (data != 0) |
7417 | 202k | _TIFFfreeExt(tif, data); |
7418 | 204k | if (!m) |
7419 | 0 | return (0); |
7420 | 204k | } |
7421 | 212k | } |
7422 | 217k | } |
7423 | 217k | break; |
7424 | 217k | case TIFF_SETGET_C32_ASCII: |
7425 | 135k | { |
7426 | 135k | uint8_t *data; |
7427 | 135k | assert(fip->field_readcount == TIFF_VARIABLE2); |
7428 | 135k | assert(fip->field_passcount == 1); |
7429 | 135k | err = TIFFReadDirEntryByteArray(tif, dp, &data); |
7430 | 135k | if (err == TIFFReadDirEntryErrOk) |
7431 | 44.3k | { |
7432 | 44.3k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7433 | 6 | { |
7434 | 6 | if (data != 0) |
7435 | 6 | _TIFFfreeExt(tif, data); |
7436 | 6 | return 0; |
7437 | 6 | } |
7438 | 44.3k | int m; |
7439 | 44.3k | if (data != 0 && dp->tdir_count > 0 && |
7440 | 34.7k | data[dp->tdir_count - 1] != '\0') |
7441 | 23.9k | { |
7442 | 23.9k | TIFFWarningExtR( |
7443 | 23.9k | tif, module, |
7444 | 23.9k | "ASCII value for ASCII array tag \"%s\" does not end " |
7445 | 23.9k | "in null byte. Forcing it to be null", |
7446 | 23.9k | fip->field_name); |
7447 | | /* Enlarge buffer and add terminating null. */ |
7448 | 23.9k | uint8_t *o = (uint8_t *)_TIFFmallocExt( |
7449 | 23.9k | tif, (uint32_t)dp->tdir_count + 1); |
7450 | 23.9k | if (o == NULL) |
7451 | 0 | { |
7452 | 0 | if (data != NULL) |
7453 | 0 | _TIFFfreeExt(tif, data); |
7454 | 0 | return (0); |
7455 | 0 | } |
7456 | 23.9k | if (dp->tdir_count > 0) |
7457 | 23.9k | { |
7458 | 23.9k | _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count); |
7459 | 23.9k | } |
7460 | 23.9k | o[(uint32_t)dp->tdir_count] = 0; |
7461 | 23.9k | dp->tdir_count++; /* Increment for added null. */ |
7462 | 23.9k | if (data != 0) |
7463 | 23.9k | _TIFFfreeExt(tif, data); |
7464 | 23.9k | data = o; |
7465 | 23.9k | } |
7466 | 44.3k | m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count), |
7467 | 44.3k | data); |
7468 | 44.3k | if (data != 0) |
7469 | 34.7k | _TIFFfreeExt(tif, data); |
7470 | 44.3k | if (!m) |
7471 | 0 | return (0); |
7472 | 44.3k | } |
7473 | 135k | } |
7474 | 135k | break; |
7475 | 766k | case TIFF_SETGET_C32_UINT8: |
7476 | 766k | { |
7477 | 766k | uint8_t *data; |
7478 | 766k | uint32_t count = 0; |
7479 | 766k | assert(fip->field_readcount == TIFF_VARIABLE2); |
7480 | 766k | assert(fip->field_passcount == 1); |
7481 | 766k | if (fip->field_tag == TIFFTAG_RICHTIFFIPTC && |
7482 | 3.68k | dp->tdir_type == TIFF_LONG) |
7483 | 1.89k | { |
7484 | | /* Adobe's software (wrongly) writes RichTIFFIPTC tag with |
7485 | | * data type LONG instead of UNDEFINED. Work around this |
7486 | | * frequently found issue */ |
7487 | 1.89k | void *origdata; |
7488 | 1.89k | err = TIFFReadDirEntryArray(tif, dp, &count, 4, &origdata); |
7489 | 1.89k | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
7490 | 1.24k | { |
7491 | 1.24k | data = NULL; |
7492 | 1.24k | } |
7493 | 651 | else |
7494 | 651 | { |
7495 | 651 | if (tif->tif_flags & TIFF_SWAB) |
7496 | 67 | TIFFSwabArrayOfLong((uint32_t *)origdata, count); |
7497 | 651 | data = (uint8_t *)origdata; |
7498 | 651 | count = (uint32_t)(count * 4); |
7499 | 651 | } |
7500 | 1.89k | } |
7501 | 764k | else |
7502 | 764k | { |
7503 | 764k | err = TIFFReadDirEntryByteArray(tif, dp, &data); |
7504 | 764k | count = (uint32_t)(dp->tdir_count); |
7505 | 764k | } |
7506 | 766k | if (err == TIFFReadDirEntryErrOk) |
7507 | 272k | { |
7508 | 272k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7509 | 11 | { |
7510 | 11 | if (data != 0) |
7511 | 11 | _TIFFfreeExt(tif, data); |
7512 | 11 | return 0; |
7513 | 11 | } |
7514 | 272k | int m; |
7515 | 272k | m = TIFFSetField(tif, dp->tdir_tag, count, data); |
7516 | 272k | if (data != 0) |
7517 | 222k | _TIFFfreeExt(tif, data); |
7518 | 272k | if (!m) |
7519 | 231 | return (0); |
7520 | 272k | } |
7521 | 766k | } |
7522 | 765k | break; |
7523 | 765k | case TIFF_SETGET_C32_SINT8: |
7524 | 73.1k | { |
7525 | 73.1k | int8_t *data = NULL; |
7526 | 73.1k | assert(fip->field_readcount == TIFF_VARIABLE2); |
7527 | 73.1k | assert(fip->field_passcount == 1); |
7528 | 73.1k | err = TIFFReadDirEntrySbyteArray(tif, dp, &data); |
7529 | 73.1k | if (err == TIFFReadDirEntryErrOk) |
7530 | 27.2k | { |
7531 | 27.2k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7532 | 6 | { |
7533 | 6 | if (data != 0) |
7534 | 6 | _TIFFfreeExt(tif, data); |
7535 | 6 | return 0; |
7536 | 6 | } |
7537 | 27.2k | int m; |
7538 | 27.2k | m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count), |
7539 | 27.2k | data); |
7540 | 27.2k | if (data != 0) |
7541 | 23.1k | _TIFFfreeExt(tif, data); |
7542 | 27.2k | if (!m) |
7543 | 0 | return (0); |
7544 | 27.2k | } |
7545 | 73.1k | } |
7546 | 73.1k | break; |
7547 | 684k | case TIFF_SETGET_C32_UINT16: |
7548 | 684k | { |
7549 | 684k | uint16_t *data; |
7550 | 684k | assert(fip->field_readcount == TIFF_VARIABLE2); |
7551 | 684k | assert(fip->field_passcount == 1); |
7552 | 684k | err = TIFFReadDirEntryShortArray(tif, dp, &data); |
7553 | 684k | if (err == TIFFReadDirEntryErrOk) |
7554 | 363k | { |
7555 | 363k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7556 | 10 | { |
7557 | 10 | if (data != 0) |
7558 | 10 | _TIFFfreeExt(tif, data); |
7559 | 10 | return 0; |
7560 | 10 | } |
7561 | 363k | int m; |
7562 | 363k | m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count), |
7563 | 363k | data); |
7564 | 363k | if (data != 0) |
7565 | 355k | _TIFFfreeExt(tif, data); |
7566 | 363k | if (!m) |
7567 | 0 | return (0); |
7568 | 363k | } |
7569 | 684k | } |
7570 | 684k | break; |
7571 | 684k | case TIFF_SETGET_C32_SINT16: |
7572 | 122k | { |
7573 | 122k | int16_t *data = NULL; |
7574 | 122k | assert(fip->field_readcount == TIFF_VARIABLE2); |
7575 | 122k | assert(fip->field_passcount == 1); |
7576 | 122k | err = TIFFReadDirEntrySshortArray(tif, dp, &data); |
7577 | 122k | if (err == TIFFReadDirEntryErrOk) |
7578 | 16.4k | { |
7579 | 16.4k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7580 | 10 | { |
7581 | 10 | if (data != 0) |
7582 | 10 | _TIFFfreeExt(tif, data); |
7583 | 10 | return 0; |
7584 | 10 | } |
7585 | 16.4k | int m; |
7586 | 16.4k | m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count), |
7587 | 16.4k | data); |
7588 | 16.4k | if (data != 0) |
7589 | 8.72k | _TIFFfreeExt(tif, data); |
7590 | 16.4k | if (!m) |
7591 | 0 | return (0); |
7592 | 16.4k | } |
7593 | 122k | } |
7594 | 122k | break; |
7595 | 158k | case TIFF_SETGET_C32_UINT32: |
7596 | 158k | { |
7597 | 158k | uint32_t *data; |
7598 | 158k | assert(fip->field_readcount == TIFF_VARIABLE2); |
7599 | 158k | assert(fip->field_passcount == 1); |
7600 | 158k | err = TIFFReadDirEntryLongArray(tif, dp, &data); |
7601 | 158k | if (err == TIFFReadDirEntryErrOk) |
7602 | 34.3k | { |
7603 | 34.3k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7604 | 3 | { |
7605 | 3 | if (data != 0) |
7606 | 3 | _TIFFfreeExt(tif, data); |
7607 | 3 | return 0; |
7608 | 3 | } |
7609 | 34.3k | int m; |
7610 | 34.3k | m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count), |
7611 | 34.3k | data); |
7612 | 34.3k | if (data != 0) |
7613 | 26.2k | _TIFFfreeExt(tif, data); |
7614 | 34.3k | if (!m) |
7615 | 578 | return (0); |
7616 | 34.3k | } |
7617 | 158k | } |
7618 | 157k | break; |
7619 | 157k | case TIFF_SETGET_C32_SINT32: |
7620 | 41.0k | { |
7621 | 41.0k | int32_t *data = NULL; |
7622 | 41.0k | assert(fip->field_readcount == TIFF_VARIABLE2); |
7623 | 41.0k | assert(fip->field_passcount == 1); |
7624 | 41.0k | err = TIFFReadDirEntrySlongArray(tif, dp, &data); |
7625 | 41.0k | if (err == TIFFReadDirEntryErrOk) |
7626 | 19.5k | { |
7627 | 19.5k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7628 | 4 | { |
7629 | 4 | if (data != 0) |
7630 | 4 | _TIFFfreeExt(tif, data); |
7631 | 4 | return 0; |
7632 | 4 | } |
7633 | 19.5k | int m; |
7634 | 19.5k | m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count), |
7635 | 19.5k | data); |
7636 | 19.5k | if (data != 0) |
7637 | 14.8k | _TIFFfreeExt(tif, data); |
7638 | 19.5k | if (!m) |
7639 | 0 | return (0); |
7640 | 19.5k | } |
7641 | 41.0k | } |
7642 | 41.0k | break; |
7643 | 60.4k | case TIFF_SETGET_C32_UINT64: |
7644 | 60.4k | { |
7645 | 60.4k | uint64_t *data; |
7646 | 60.4k | assert(fip->field_readcount == TIFF_VARIABLE2); |
7647 | 60.4k | assert(fip->field_passcount == 1); |
7648 | 60.4k | err = TIFFReadDirEntryLong8Array(tif, dp, &data); |
7649 | 60.4k | if (err == TIFFReadDirEntryErrOk) |
7650 | 22.1k | { |
7651 | 22.1k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7652 | 1 | { |
7653 | 1 | if (data != 0) |
7654 | 1 | _TIFFfreeExt(tif, data); |
7655 | 1 | return 0; |
7656 | 1 | } |
7657 | 22.1k | int m; |
7658 | 22.1k | m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count), |
7659 | 22.1k | data); |
7660 | 22.1k | if (data != 0) |
7661 | 16.1k | _TIFFfreeExt(tif, data); |
7662 | 22.1k | if (!m) |
7663 | 7.17k | return (0); |
7664 | 22.1k | } |
7665 | 60.4k | } |
7666 | 53.2k | break; |
7667 | 53.2k | case TIFF_SETGET_C32_SINT64: |
7668 | 26.5k | { |
7669 | 26.5k | int64_t *data = NULL; |
7670 | 26.5k | assert(fip->field_readcount == TIFF_VARIABLE2); |
7671 | 26.5k | assert(fip->field_passcount == 1); |
7672 | 26.5k | err = TIFFReadDirEntrySlong8Array(tif, dp, &data); |
7673 | 26.5k | if (err == TIFFReadDirEntryErrOk) |
7674 | 8.58k | { |
7675 | 8.58k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7676 | 6 | { |
7677 | 6 | if (data != 0) |
7678 | 6 | _TIFFfreeExt(tif, data); |
7679 | 6 | return 0; |
7680 | 6 | } |
7681 | 8.57k | int m; |
7682 | 8.57k | m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count), |
7683 | 8.57k | data); |
7684 | 8.57k | if (data != 0) |
7685 | 4.98k | _TIFFfreeExt(tif, data); |
7686 | 8.57k | if (!m) |
7687 | 4.11k | return (0); |
7688 | 8.57k | } |
7689 | 26.5k | } |
7690 | 22.4k | break; |
7691 | 119k | case TIFF_SETGET_C32_FLOAT: |
7692 | 119k | { |
7693 | 119k | float *data; |
7694 | 119k | assert(fip->field_readcount == TIFF_VARIABLE2); |
7695 | 119k | assert(fip->field_passcount == 1); |
7696 | 119k | err = TIFFReadDirEntryFloatArray(tif, dp, &data); |
7697 | 119k | if (err == TIFFReadDirEntryErrOk) |
7698 | 51.0k | { |
7699 | 51.0k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7700 | 6 | { |
7701 | 6 | if (data != 0) |
7702 | 6 | _TIFFfreeExt(tif, data); |
7703 | 6 | return 0; |
7704 | 6 | } |
7705 | 51.0k | int m; |
7706 | 51.0k | m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count), |
7707 | 51.0k | data); |
7708 | 51.0k | if (data != 0) |
7709 | 36.9k | _TIFFfreeExt(tif, data); |
7710 | 51.0k | if (!m) |
7711 | 0 | return (0); |
7712 | 51.0k | } |
7713 | 119k | } |
7714 | 119k | break; |
7715 | 119k | case TIFF_SETGET_C32_DOUBLE: |
7716 | 88.3k | { |
7717 | 88.3k | double *data; |
7718 | 88.3k | assert(fip->field_readcount == TIFF_VARIABLE2); |
7719 | 88.3k | assert(fip->field_passcount == 1); |
7720 | 88.3k | err = TIFFReadDirEntryDoubleArray(tif, dp, &data); |
7721 | 88.3k | if (err == TIFFReadDirEntryErrOk) |
7722 | 24.7k | { |
7723 | 24.7k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7724 | 5 | { |
7725 | 5 | if (data != 0) |
7726 | 5 | _TIFFfreeExt(tif, data); |
7727 | 5 | return 0; |
7728 | 5 | } |
7729 | 24.7k | int m; |
7730 | 24.7k | m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count), |
7731 | 24.7k | data); |
7732 | 24.7k | if (data != 0) |
7733 | 10.3k | _TIFFfreeExt(tif, data); |
7734 | 24.7k | if (!m) |
7735 | 0 | return (0); |
7736 | 24.7k | } |
7737 | 88.3k | } |
7738 | 88.3k | break; |
7739 | 88.3k | case TIFF_SETGET_C32_IFD8: |
7740 | 40.9k | { |
7741 | 40.9k | uint64_t *data; |
7742 | 40.9k | assert(fip->field_readcount == TIFF_VARIABLE2); |
7743 | 40.9k | assert(fip->field_passcount == 1); |
7744 | 40.9k | err = TIFFReadDirEntryIfd8Array(tif, dp, &data); |
7745 | 40.9k | if (err == TIFFReadDirEntryErrOk) |
7746 | 15.0k | { |
7747 | 15.0k | if (!EvaluateIFDdatasizeReading(tif, dp)) |
7748 | 10 | { |
7749 | 10 | if (data != 0) |
7750 | 10 | _TIFFfreeExt(tif, data); |
7751 | 10 | return 0; |
7752 | 10 | } |
7753 | 15.0k | int m; |
7754 | 15.0k | m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count), |
7755 | 15.0k | data); |
7756 | 15.0k | if (data != 0) |
7757 | 5.14k | _TIFFfreeExt(tif, data); |
7758 | 15.0k | if (!m) |
7759 | 2.13k | return (0); |
7760 | 15.0k | } |
7761 | 40.9k | } |
7762 | 38.8k | break; |
7763 | 38.8k | case TIFF_SETGET_INT: |
7764 | 0 | case TIFF_SETGET_C0_ASCII: |
7765 | 0 | case TIFF_SETGET_OTHER: |
7766 | 0 | assert(0); /* these should not arrive here */ |
7767 | 0 | break; |
7768 | 0 | default: |
7769 | 0 | assert(0); /* we should never get here */ |
7770 | 0 | break; |
7771 | 36.3M | } |
7772 | 36.2M | if (err != TIFFReadDirEntryErrOk) |
7773 | 2.10M | { |
7774 | 2.10M | TIFFReadDirEntryOutputErr(tif, err, module, fip->field_name, recover); |
7775 | 2.10M | return (0); |
7776 | 2.10M | } |
7777 | 34.1M | return (1); |
7778 | 36.2M | } |
7779 | | |
7780 | | /* |
7781 | | * Fetch a set of offsets or lengths. |
7782 | | * While this routine says "strips", in fact it's also used for tiles. |
7783 | | */ |
7784 | | static int TIFFFetchStripThing(TIFF *tif, TIFFDirEntry *dir, uint32_t nstrips, |
7785 | | uint64_t **lpp) |
7786 | 1.38M | { |
7787 | 1.38M | static const char module[] = "TIFFFetchStripThing"; |
7788 | 1.38M | enum TIFFReadDirEntryErr err; |
7789 | 1.38M | uint64_t *data; |
7790 | 1.38M | err = TIFFReadDirEntryLong8ArrayWithLimit(tif, dir, &data, nstrips); |
7791 | 1.38M | if (err != TIFFReadDirEntryErrOk) |
7792 | 9.31k | { |
7793 | 9.31k | const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag); |
7794 | 9.31k | TIFFReadDirEntryOutputErr(tif, err, module, |
7795 | 9.31k | fip ? fip->field_name : "unknown tagname", 0); |
7796 | 9.31k | return (0); |
7797 | 9.31k | } |
7798 | 1.37M | if (dir->tdir_count < (uint64_t)nstrips) |
7799 | 15.1k | { |
7800 | 15.1k | uint64_t *resizeddata; |
7801 | 15.1k | const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag); |
7802 | 15.1k | const char *pszMax = getenv("LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT"); |
7803 | 15.1k | uint32_t max_nstrips = 1000000; |
7804 | 15.1k | if (pszMax) |
7805 | 0 | max_nstrips = (uint32_t)atoi(pszMax); |
7806 | 15.1k | TIFFReadDirEntryOutputErr(tif, TIFFReadDirEntryErrCount, module, |
7807 | 15.1k | fip ? fip->field_name : "unknown tagname", |
7808 | 15.1k | (nstrips <= max_nstrips)); |
7809 | | |
7810 | 15.1k | if (nstrips > max_nstrips) |
7811 | 1.03k | { |
7812 | 1.03k | _TIFFfreeExt(tif, data); |
7813 | 1.03k | return (0); |
7814 | 1.03k | } |
7815 | | |
7816 | 14.1k | const uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t); |
7817 | 14.1k | if (allocsize > 100 * 1024 * 1024) |
7818 | 0 | { |
7819 | | /* Before allocating a huge amount of memory for corrupted files, |
7820 | | * check if size of requested memory is not greater than file size. |
7821 | | */ |
7822 | 0 | const uint64_t filesize = TIFFGetFileSize(tif); |
7823 | 0 | if (allocsize > filesize) |
7824 | 0 | { |
7825 | 0 | TIFFWarningExtR( |
7826 | 0 | tif, module, |
7827 | 0 | "Requested memory size for StripArray of %" PRIu64 |
7828 | 0 | " is greater than filesize %" PRIu64 |
7829 | 0 | ". Memory not allocated", |
7830 | 0 | allocsize, filesize); |
7831 | 0 | _TIFFfreeExt(tif, data); |
7832 | 0 | return (0); |
7833 | 0 | } |
7834 | 0 | } |
7835 | 14.1k | resizeddata = (uint64_t *)_TIFFCheckMalloc( |
7836 | 14.1k | tif, nstrips, sizeof(uint64_t), "for strip array"); |
7837 | 14.1k | if (resizeddata == 0) |
7838 | 0 | { |
7839 | 0 | _TIFFfreeExt(tif, data); |
7840 | 0 | return (0); |
7841 | 0 | } |
7842 | 14.1k | if (dir->tdir_count) |
7843 | 13.3k | _TIFFmemcpy(resizeddata, data, |
7844 | 13.3k | (tmsize_t)((size_t)dir->tdir_count * sizeof(uint64_t))); |
7845 | 14.1k | _TIFFmemset(resizeddata + (uint32_t)dir->tdir_count, 0, |
7846 | 14.1k | (tmsize_t)((size_t)(nstrips - (uint32_t)dir->tdir_count) * |
7847 | 14.1k | sizeof(uint64_t))); |
7848 | 14.1k | _TIFFfreeExt(tif, data); |
7849 | 14.1k | data = resizeddata; |
7850 | 14.1k | } |
7851 | 1.37M | *lpp = data; |
7852 | 1.37M | return (1); |
7853 | 1.37M | } |
7854 | | |
7855 | | /* |
7856 | | * Fetch and set the SubjectDistance EXIF tag. |
7857 | | */ |
7858 | | static int TIFFFetchSubjectDistance(TIFF *tif, TIFFDirEntry *dir) |
7859 | 0 | { |
7860 | 0 | static const char module[] = "TIFFFetchSubjectDistance"; |
7861 | 0 | enum TIFFReadDirEntryErr err; |
7862 | 0 | UInt64Aligned_t m; |
7863 | 0 | m.l = 0; |
7864 | 0 | assert(sizeof(double) == 8); |
7865 | 0 | assert(sizeof(uint64_t) == 8); |
7866 | 0 | assert(sizeof(uint32_t) == 4); |
7867 | 0 | if (dir->tdir_count != 1) |
7868 | 0 | err = TIFFReadDirEntryErrCount; |
7869 | 0 | else if (dir->tdir_type != TIFF_RATIONAL) |
7870 | 0 | err = TIFFReadDirEntryErrType; |
7871 | 0 | else |
7872 | 0 | { |
7873 | 0 | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
7874 | 0 | { |
7875 | 0 | uint32_t offset; |
7876 | 0 | offset = *(uint32_t *)(&dir->tdir_offset); |
7877 | 0 | if (tif->tif_flags & TIFF_SWAB) |
7878 | 0 | TIFFSwabLong(&offset); |
7879 | 0 | err = TIFFReadDirEntryData(tif, offset, 8, m.i); |
7880 | 0 | } |
7881 | 0 | else |
7882 | 0 | { |
7883 | 0 | m.l = dir->tdir_offset.toff_long8; |
7884 | 0 | err = TIFFReadDirEntryErrOk; |
7885 | 0 | } |
7886 | 0 | } |
7887 | 0 | if (err == TIFFReadDirEntryErrOk) |
7888 | 0 | { |
7889 | 0 | double n; |
7890 | 0 | if (tif->tif_flags & TIFF_SWAB) |
7891 | 0 | TIFFSwabArrayOfLong(m.i, 2); |
7892 | 0 | if (m.i[0] == 0) |
7893 | 0 | n = 0.0; |
7894 | 0 | else if (m.i[0] == 0xFFFFFFFF || m.i[1] == 0) |
7895 | | /* |
7896 | | * XXX: Numerator 0xFFFFFFFF means that we have infinite |
7897 | | * distance. Indicate that with a negative floating point |
7898 | | * SubjectDistance value. |
7899 | | */ |
7900 | 0 | n = -1.0; |
7901 | 0 | else |
7902 | 0 | n = (double)m.i[0] / (double)m.i[1]; |
7903 | 0 | return (TIFFSetField(tif, dir->tdir_tag, n)); |
7904 | 0 | } |
7905 | 0 | else |
7906 | 0 | { |
7907 | 0 | TIFFReadDirEntryOutputErr(tif, err, module, "SubjectDistance", TRUE); |
7908 | 0 | return (0); |
7909 | 0 | } |
7910 | 0 | } |
7911 | | |
7912 | | static void allocChoppedUpStripArrays(TIFF *tif, uint32_t nstrips, |
7913 | | uint64_t stripbytes, |
7914 | | uint32_t rowsperstrip) |
7915 | 240k | { |
7916 | 240k | TIFFDirectory *td = &tif->tif_dir; |
7917 | 240k | uint64_t bytecount; |
7918 | 240k | uint64_t offset; |
7919 | 240k | uint64_t last_offset; |
7920 | 240k | uint64_t last_bytecount; |
7921 | 240k | uint32_t i; |
7922 | 240k | uint64_t *newcounts; |
7923 | 240k | uint64_t *newoffsets; |
7924 | | |
7925 | 240k | offset = TIFFGetStrileOffset(tif, 0); |
7926 | 240k | last_offset = TIFFGetStrileOffset(tif, td->td_nstrips - 1); |
7927 | 240k | last_bytecount = TIFFGetStrileByteCount(tif, td->td_nstrips - 1); |
7928 | 240k | if (last_offset > UINT64_MAX - last_bytecount || |
7929 | 239k | last_offset + last_bytecount < offset) |
7930 | 1.45k | { |
7931 | 1.45k | return; |
7932 | 1.45k | } |
7933 | 239k | bytecount = last_offset + last_bytecount - offset; |
7934 | | |
7935 | | /* Before allocating a huge amount of memory for corrupted files, check if |
7936 | | * size of StripByteCount and StripOffset tags is not greater than |
7937 | | * file size. |
7938 | | */ |
7939 | 239k | const uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t) * 2; |
7940 | 239k | if (allocsize > 100 * 1024 * 1024) |
7941 | 0 | { |
7942 | 0 | const uint64_t filesize = TIFFGetFileSize(tif); |
7943 | 0 | if (allocsize > filesize) |
7944 | 0 | { |
7945 | 0 | TIFFWarningExtR(tif, "allocChoppedUpStripArrays", |
7946 | 0 | "Requested memory size for StripByteCount and " |
7947 | 0 | "StripOffsets %" PRIu64 |
7948 | 0 | " is greater than filesize %" PRIu64 |
7949 | 0 | ". Memory not allocated", |
7950 | 0 | allocsize, filesize); |
7951 | 0 | return; |
7952 | 0 | } |
7953 | 0 | } |
7954 | | |
7955 | 239k | newcounts = |
7956 | 239k | (uint64_t *)_TIFFCheckMalloc(tif, nstrips, sizeof(uint64_t), |
7957 | 239k | "for chopped \"StripByteCounts\" array"); |
7958 | 239k | newoffsets = (uint64_t *)_TIFFCheckMalloc( |
7959 | 239k | tif, nstrips, sizeof(uint64_t), "for chopped \"StripOffsets\" array"); |
7960 | 239k | if (newcounts == NULL || newoffsets == NULL) |
7961 | 0 | { |
7962 | | /* |
7963 | | * Unable to allocate new strip information, give up and use |
7964 | | * the original one strip information. |
7965 | | */ |
7966 | 0 | if (newcounts != NULL) |
7967 | 0 | _TIFFfreeExt(tif, newcounts); |
7968 | 0 | if (newoffsets != NULL) |
7969 | 0 | _TIFFfreeExt(tif, newoffsets); |
7970 | 0 | return; |
7971 | 0 | } |
7972 | | |
7973 | | /* |
7974 | | * Fill the strip information arrays with new bytecounts and offsets |
7975 | | * that reflect the broken-up format. |
7976 | | */ |
7977 | 1.50G | for (i = 0; i < nstrips; i++) |
7978 | 1.50G | { |
7979 | 1.50G | if (stripbytes > bytecount) |
7980 | 215k | stripbytes = bytecount; |
7981 | 1.50G | newcounts[i] = stripbytes; |
7982 | 1.50G | newoffsets[i] = stripbytes ? offset : 0; |
7983 | 1.50G | offset += stripbytes; |
7984 | 1.50G | bytecount -= stripbytes; |
7985 | 1.50G | } |
7986 | | |
7987 | | /* |
7988 | | * Replace old single strip info with multi-strip info. |
7989 | | */ |
7990 | 239k | td->td_stripsperimage = td->td_nstrips = nstrips; |
7991 | 239k | TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, rowsperstrip); |
7992 | | |
7993 | 239k | _TIFFfreeExt(tif, td->td_stripbytecount_p); |
7994 | 239k | _TIFFfreeExt(tif, td->td_stripoffset_p); |
7995 | 239k | td->td_stripbytecount_p = newcounts; |
7996 | 239k | td->td_stripoffset_p = newoffsets; |
7997 | | #ifdef STRIPBYTECOUNTSORTED_UNUSED |
7998 | | td->td_stripbytecountsorted = 1; |
7999 | | #endif |
8000 | 239k | tif->tif_flags |= TIFF_CHOPPEDUPARRAYS; |
8001 | 239k | } |
8002 | | |
8003 | | /* |
8004 | | * Replace a single strip (tile) of uncompressed data by multiple strips |
8005 | | * (tiles), each approximately STRIP_SIZE_DEFAULT bytes. This is useful for |
8006 | | * dealing with large images or for dealing with machines with a limited |
8007 | | * amount memory. |
8008 | | */ |
8009 | | static void ChopUpSingleUncompressedStrip(TIFF *tif) |
8010 | 345k | { |
8011 | 345k | TIFFDirectory *td = &tif->tif_dir; |
8012 | 345k | uint64_t bytecount; |
8013 | 345k | uint64_t offset; |
8014 | 345k | uint32_t rowblock; |
8015 | 345k | uint64_t rowblockbytes; |
8016 | 345k | uint64_t stripbytes; |
8017 | 345k | uint32_t nstrips; |
8018 | 345k | uint32_t rowsperstrip; |
8019 | | |
8020 | 345k | bytecount = TIFFGetStrileByteCount(tif, 0); |
8021 | | /* On a newly created file, just re-opened to be filled, we */ |
8022 | | /* don't want strip chop to trigger as it is going to cause issues */ |
8023 | | /* later ( StripOffsets and StripByteCounts improperly filled) . */ |
8024 | 345k | if (bytecount == 0 && tif->tif_mode != O_RDONLY) |
8025 | 290 | return; |
8026 | 344k | offset = TIFFGetStrileOffset(tif, 0); |
8027 | 344k | assert(td->td_planarconfig == PLANARCONFIG_CONTIG); |
8028 | 344k | if ((td->td_photometric == PHOTOMETRIC_YCBCR) && (!isUpSampled(tif))) |
8029 | 5.37k | rowblock = td->td_ycbcrsubsampling[1]; |
8030 | 339k | else |
8031 | 339k | rowblock = 1; |
8032 | 344k | rowblockbytes = TIFFVTileSize64(tif, rowblock); |
8033 | | /* |
8034 | | * Make the rows hold at least one scanline, but fill specified amount |
8035 | | * of data if possible. |
8036 | | */ |
8037 | 344k | if (rowblockbytes > STRIP_SIZE_DEFAULT) |
8038 | 30.8k | { |
8039 | 30.8k | stripbytes = rowblockbytes; |
8040 | 30.8k | rowsperstrip = rowblock; |
8041 | 30.8k | } |
8042 | 314k | else if (rowblockbytes > 0) |
8043 | 312k | { |
8044 | 312k | uint32_t rowblocksperstrip; |
8045 | 312k | rowblocksperstrip = (uint32_t)(STRIP_SIZE_DEFAULT / rowblockbytes); |
8046 | 312k | rowsperstrip = rowblocksperstrip * rowblock; |
8047 | 312k | stripbytes = rowblocksperstrip * rowblockbytes; |
8048 | 312k | } |
8049 | 1.73k | else |
8050 | 1.73k | return; |
8051 | | |
8052 | | /* |
8053 | | * never increase the number of rows per strip |
8054 | | */ |
8055 | 343k | if (rowsperstrip >= td->td_rowsperstrip || rowsperstrip == 0) |
8056 | 90.9k | return; |
8057 | 252k | nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip); |
8058 | 252k | if (nstrips == 0) |
8059 | 1.13k | return; |
8060 | | |
8061 | | /* If we are going to allocate a lot of memory, make sure that the */ |
8062 | | /* file is as big as needed */ |
8063 | 251k | if (tif->tif_mode == O_RDONLY && nstrips > 1000000 && |
8064 | 19.2k | (offset >= TIFFGetFileSize(tif) || |
8065 | 13.6k | stripbytes > (TIFFGetFileSize(tif) - offset) / (nstrips - 1))) |
8066 | 19.2k | { |
8067 | 19.2k | return; |
8068 | 19.2k | } |
8069 | | |
8070 | 231k | allocChoppedUpStripArrays(tif, nstrips, stripbytes, rowsperstrip); |
8071 | 231k | } |
8072 | | |
8073 | | /* |
8074 | | * Replace a file with contiguous strips > 2 GB of uncompressed data by |
8075 | | * multiple smaller strips. This is useful for |
8076 | | * dealing with large images or for dealing with machines with a limited |
8077 | | * amount memory. |
8078 | | */ |
8079 | | static void TryChopUpUncompressedBigTiff(TIFF *tif) |
8080 | 22.5k | { |
8081 | 22.5k | TIFFDirectory *td = &tif->tif_dir; |
8082 | 22.5k | uint32_t rowblock; |
8083 | 22.5k | uint64_t rowblockbytes; |
8084 | 22.5k | uint32_t i; |
8085 | 22.5k | uint64_t stripsize; |
8086 | 22.5k | uint32_t rowblocksperstrip; |
8087 | 22.5k | uint32_t rowsperstrip; |
8088 | 22.5k | uint64_t stripbytes; |
8089 | 22.5k | uint32_t nstrips; |
8090 | | |
8091 | 22.5k | stripsize = TIFFStripSize64(tif); |
8092 | | |
8093 | 22.5k | assert(tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG); |
8094 | 22.5k | assert(tif->tif_dir.td_compression == COMPRESSION_NONE); |
8095 | 22.5k | assert((tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) == |
8096 | 22.5k | TIFF_STRIPCHOP); |
8097 | 22.5k | assert(stripsize > 0x7FFFFFFFUL); |
8098 | | |
8099 | | /* On a newly created file, just re-opened to be filled, we */ |
8100 | | /* don't want strip chop to trigger as it is going to cause issues */ |
8101 | | /* later ( StripOffsets and StripByteCounts improperly filled) . */ |
8102 | 22.5k | if (TIFFGetStrileByteCount(tif, 0) == 0 && tif->tif_mode != O_RDONLY) |
8103 | 0 | return; |
8104 | | |
8105 | 22.5k | if ((td->td_photometric == PHOTOMETRIC_YCBCR) && (!isUpSampled(tif))) |
8106 | 517 | rowblock = td->td_ycbcrsubsampling[1]; |
8107 | 22.0k | else |
8108 | 22.0k | rowblock = 1; |
8109 | 22.5k | rowblockbytes = TIFFVStripSize64(tif, rowblock); |
8110 | 22.5k | if (rowblockbytes == 0 || rowblockbytes > 0x7FFFFFFFUL) |
8111 | 1.81k | { |
8112 | | /* In case of file with gigantic width */ |
8113 | 1.81k | return; |
8114 | 1.81k | } |
8115 | | |
8116 | | /* Check that the strips are contiguous and of the expected size */ |
8117 | 33.2k | for (i = 0; i < td->td_nstrips; i++) |
8118 | 20.7k | { |
8119 | 20.7k | if (i == td->td_nstrips - 1) |
8120 | 19.2k | { |
8121 | 19.2k | if (TIFFGetStrileByteCount(tif, i) < |
8122 | 19.2k | TIFFVStripSize64(tif, |
8123 | 19.2k | td->td_imagelength - i * td->td_rowsperstrip)) |
8124 | 6.76k | { |
8125 | 6.76k | return; |
8126 | 6.76k | } |
8127 | 19.2k | } |
8128 | 1.49k | else |
8129 | 1.49k | { |
8130 | 1.49k | if (TIFFGetStrileByteCount(tif, i) != stripsize) |
8131 | 1.49k | { |
8132 | 1.49k | return; |
8133 | 1.49k | } |
8134 | 3 | if (i > 0 && TIFFGetStrileOffset(tif, i) != |
8135 | 0 | TIFFGetStrileOffset(tif, i - 1) + |
8136 | 0 | TIFFGetStrileByteCount(tif, i - 1)) |
8137 | 0 | { |
8138 | 0 | return; |
8139 | 0 | } |
8140 | 3 | } |
8141 | 20.7k | } |
8142 | | |
8143 | | /* Aim for 512 MB strips (that will still be manageable by 32 bit builds */ |
8144 | 12.4k | rowblocksperstrip = (uint32_t)(512 * 1024 * 1024 / rowblockbytes); |
8145 | 12.4k | if (rowblocksperstrip == 0) |
8146 | 452 | rowblocksperstrip = 1; |
8147 | 12.4k | rowsperstrip = rowblocksperstrip * rowblock; |
8148 | 12.4k | stripbytes = rowblocksperstrip * rowblockbytes; |
8149 | 12.4k | assert(stripbytes <= 0x7FFFFFFFUL); |
8150 | | |
8151 | 12.4k | if (rowsperstrip == 0) |
8152 | 0 | return; |
8153 | 12.4k | nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip); |
8154 | 12.4k | if (nstrips == 0) |
8155 | 442 | return; |
8156 | | |
8157 | | /* If we are going to allocate a lot of memory, make sure that the */ |
8158 | | /* file is as big as needed */ |
8159 | 12.0k | if (tif->tif_mode == O_RDONLY && nstrips > 1000000) |
8160 | 3.36k | { |
8161 | 3.36k | uint64_t last_offset = TIFFGetStrileOffset(tif, td->td_nstrips - 1); |
8162 | 3.36k | uint64_t filesize = TIFFGetFileSize(tif); |
8163 | 3.36k | uint64_t last_bytecount = |
8164 | 3.36k | TIFFGetStrileByteCount(tif, td->td_nstrips - 1); |
8165 | 3.36k | if (last_offset > filesize || last_bytecount > filesize - last_offset) |
8166 | 3.36k | { |
8167 | 3.36k | return; |
8168 | 3.36k | } |
8169 | 3.36k | } |
8170 | | |
8171 | 8.68k | allocChoppedUpStripArrays(tif, nstrips, stripbytes, rowsperstrip); |
8172 | 8.68k | } |
8173 | | |
8174 | | TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW |
8175 | | static uint64_t _TIFFUnsanitizedAddUInt64AndInt(uint64_t a, int b) |
8176 | 279M | { |
8177 | 279M | return a + (uint64_t)b; |
8178 | 279M | } |
8179 | | |
8180 | | /* Read the value of [Strip|Tile]Offset or [Strip|Tile]ByteCount around |
8181 | | * strip/tile of number strile. Also fetch the neighbouring values using a |
8182 | | * 4096 byte page size. |
8183 | | */ |
8184 | | static int _TIFFPartialReadStripArray(TIFF *tif, TIFFDirEntry *dirent, |
8185 | | int strile, uint64_t *panVals) |
8186 | 1.24M | { |
8187 | 1.24M | static const char module[] = "_TIFFPartialReadStripArray"; |
8188 | 2.72M | #define IO_CACHE_PAGE_SIZE 4096 |
8189 | | |
8190 | 1.24M | size_t sizeofval; |
8191 | 1.24M | const int bSwab = (tif->tif_flags & TIFF_SWAB) != 0; |
8192 | 1.24M | int sizeofvalint; |
8193 | 1.24M | uint64_t nBaseOffset; |
8194 | 1.24M | uint64_t nOffset; |
8195 | 1.24M | uint64_t nOffsetStartPage; |
8196 | 1.24M | uint64_t nOffsetEndPage; |
8197 | 1.24M | tmsize_t nToRead; |
8198 | 1.24M | tmsize_t nRead; |
8199 | 1.24M | uint64_t nLastStripOffset; |
8200 | 1.24M | int iStartBefore; |
8201 | 1.24M | int i; |
8202 | 1.24M | const uint32_t arraySize = tif->tif_dir.td_stripoffsetbyteallocsize; |
8203 | 1.24M | unsigned char buffer[2 * IO_CACHE_PAGE_SIZE]; |
8204 | | |
8205 | 1.24M | assert(dirent->tdir_count > 4); |
8206 | | |
8207 | 1.24M | if (dirent->tdir_type == TIFF_SHORT) |
8208 | 121k | { |
8209 | 121k | sizeofval = sizeof(uint16_t); |
8210 | 121k | } |
8211 | 1.12M | else if (dirent->tdir_type == TIFF_LONG) |
8212 | 212k | { |
8213 | 212k | sizeofval = sizeof(uint32_t); |
8214 | 212k | } |
8215 | 907k | else if (dirent->tdir_type == TIFF_LONG8) |
8216 | 51.2k | { |
8217 | 51.2k | sizeofval = sizeof(uint64_t); |
8218 | 51.2k | } |
8219 | 856k | else if (dirent->tdir_type == TIFF_SLONG8) |
8220 | 521k | { |
8221 | | /* Non conformant but used by some images as in */ |
8222 | | /* https://github.com/OSGeo/gdal/issues/2165 */ |
8223 | 521k | sizeofval = sizeof(int64_t); |
8224 | 521k | } |
8225 | 334k | else |
8226 | 334k | { |
8227 | 334k | TIFFErrorExtR(tif, module, |
8228 | 334k | "Invalid type for [Strip|Tile][Offset/ByteCount] tag"); |
8229 | 334k | panVals[strile] = 0; |
8230 | 334k | return 0; |
8231 | 334k | } |
8232 | 907k | sizeofvalint = (int)(sizeofval); |
8233 | | |
8234 | 907k | if (tif->tif_flags & TIFF_BIGTIFF) |
8235 | 554 | { |
8236 | 554 | uint64_t offset = dirent->tdir_offset.toff_long8; |
8237 | 554 | if (bSwab) |
8238 | 63 | TIFFSwabLong8(&offset); |
8239 | 554 | nBaseOffset = offset; |
8240 | 554 | } |
8241 | 906k | else |
8242 | 906k | { |
8243 | 906k | uint32_t offset = dirent->tdir_offset.toff_long; |
8244 | 906k | if (bSwab) |
8245 | 1.34k | TIFFSwabLong(&offset); |
8246 | 906k | nBaseOffset = offset; |
8247 | 906k | } |
8248 | | /* To avoid later unsigned integer overflows */ |
8249 | 907k | if (nBaseOffset > (uint64_t)INT64_MAX) |
8250 | 200 | { |
8251 | 200 | TIFFErrorExtR(tif, module, "Cannot read offset/size for strile %d", |
8252 | 200 | strile); |
8253 | 200 | panVals[strile] = 0; |
8254 | 200 | return 0; |
8255 | 200 | } |
8256 | 906k | nOffset = nBaseOffset + (uint64_t)sizeofval * (uint64_t)strile; |
8257 | 906k | nOffsetStartPage = (nOffset / IO_CACHE_PAGE_SIZE) * IO_CACHE_PAGE_SIZE; |
8258 | 906k | nOffsetEndPage = nOffsetStartPage + IO_CACHE_PAGE_SIZE; |
8259 | | |
8260 | 906k | if (nOffset + sizeofval > nOffsetEndPage) |
8261 | 8.39k | nOffsetEndPage += IO_CACHE_PAGE_SIZE; |
8262 | 906k | #undef IO_CACHE_PAGE_SIZE |
8263 | | |
8264 | 906k | nLastStripOffset = nBaseOffset + (uint64_t)arraySize * sizeofval; |
8265 | 906k | if (nLastStripOffset < nOffsetEndPage) |
8266 | 237k | nOffsetEndPage = nLastStripOffset; |
8267 | 906k | if (nOffsetStartPage >= nOffsetEndPage) |
8268 | 0 | { |
8269 | 0 | TIFFErrorExtR(tif, module, "Cannot read offset/size for strile %d", |
8270 | 0 | strile); |
8271 | 0 | panVals[strile] = 0; |
8272 | 0 | return 0; |
8273 | 0 | } |
8274 | 906k | if (!SeekOK(tif, nOffsetStartPage)) |
8275 | 0 | { |
8276 | 0 | panVals[strile] = 0; |
8277 | 0 | return 0; |
8278 | 0 | } |
8279 | | |
8280 | 906k | nToRead = (tmsize_t)(nOffsetEndPage - nOffsetStartPage); |
8281 | 906k | nRead = TIFFReadFile(tif, buffer, nToRead); |
8282 | 906k | if (nRead < nToRead) |
8283 | 282k | { |
8284 | 282k | TIFFErrorExtR(tif, module, |
8285 | 282k | "Cannot read offset/size for strile around ~%d", strile); |
8286 | 282k | return 0; |
8287 | 282k | } |
8288 | 624k | iStartBefore = -(int)((nOffset - nOffsetStartPage) / sizeofval); |
8289 | 624k | if (strile + iStartBefore < 0) |
8290 | 145k | iStartBefore = -strile; |
8291 | 624k | for (i = iStartBefore; |
8292 | 279M | (uint32_t)(strile + i) < arraySize && |
8293 | 279M | _TIFFUnsanitizedAddUInt64AndInt(nOffset, (i + 1) * sizeofvalint) <= |
8294 | 279M | nOffsetEndPage; |
8295 | 278M | ++i) |
8296 | 278M | { |
8297 | 278M | if (dirent->tdir_type == TIFF_SHORT) |
8298 | 6.86M | { |
8299 | 6.86M | uint16_t val; |
8300 | 6.86M | memcpy(&val, |
8301 | 6.86M | buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint, |
8302 | 6.86M | sizeof(val)); |
8303 | 6.86M | if (bSwab) |
8304 | 6.34k | TIFFSwabShort(&val); |
8305 | 6.86M | panVals[strile + i] = val; |
8306 | 6.86M | } |
8307 | 272M | else if (dirent->tdir_type == TIFF_LONG) |
8308 | 2.18M | { |
8309 | 2.18M | uint32_t val; |
8310 | 2.18M | memcpy(&val, |
8311 | 2.18M | buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint, |
8312 | 2.18M | sizeof(val)); |
8313 | 2.18M | if (bSwab) |
8314 | 4.33k | TIFFSwabLong(&val); |
8315 | 2.18M | panVals[strile + i] = val; |
8316 | 2.18M | } |
8317 | 269M | else if (dirent->tdir_type == TIFF_LONG8) |
8318 | 12.1M | { |
8319 | 12.1M | uint64_t val; |
8320 | 12.1M | memcpy(&val, |
8321 | 12.1M | buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint, |
8322 | 12.1M | sizeof(val)); |
8323 | 12.1M | if (bSwab) |
8324 | 95 | TIFFSwabLong8(&val); |
8325 | 12.1M | panVals[strile + i] = val; |
8326 | 12.1M | } |
8327 | 257M | else /* if( dirent->tdir_type == TIFF_SLONG8 ) */ |
8328 | 257M | { |
8329 | | /* Non conformant data type */ |
8330 | 257M | int64_t val; |
8331 | 257M | memcpy(&val, |
8332 | 257M | buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint, |
8333 | 257M | sizeof(val)); |
8334 | 257M | if (bSwab) |
8335 | 73 | TIFFSwabLong8((uint64_t *)&val); |
8336 | 257M | panVals[strile + i] = (uint64_t)val; |
8337 | 257M | } |
8338 | 278M | } |
8339 | 624k | return 1; |
8340 | 906k | } |
8341 | | |
8342 | | static int _TIFFFetchStrileValue(TIFF *tif, uint32_t strile, |
8343 | | TIFFDirEntry *dirent, uint64_t **parray) |
8344 | 5.80M | { |
8345 | 5.80M | static const char module[] = "_TIFFFetchStrileValue"; |
8346 | 5.80M | TIFFDirectory *td = &tif->tif_dir; |
8347 | 5.80M | if (strile >= dirent->tdir_count) |
8348 | 4.10k | { |
8349 | 4.10k | return 0; |
8350 | 4.10k | } |
8351 | 5.79M | if (strile >= td->td_stripoffsetbyteallocsize) |
8352 | 221k | { |
8353 | 221k | uint32_t nStripArrayAllocBefore = td->td_stripoffsetbyteallocsize; |
8354 | 221k | uint32_t nStripArrayAllocNew; |
8355 | 221k | uint64_t nArraySize64; |
8356 | 221k | size_t nArraySize; |
8357 | 221k | uint64_t *offsetArray; |
8358 | 221k | uint64_t *bytecountArray; |
8359 | | |
8360 | 221k | if (strile > 1000000) |
8361 | 363 | { |
8362 | 363 | uint64_t filesize = TIFFGetFileSize(tif); |
8363 | | /* Avoid excessive memory allocation attempt */ |
8364 | | /* For such a big blockid we need at least a TIFF_LONG per strile */ |
8365 | | /* for the offset array. */ |
8366 | 363 | if (strile > filesize / sizeof(uint32_t)) |
8367 | 363 | { |
8368 | 363 | TIFFErrorExtR(tif, module, "File too short"); |
8369 | 363 | return 0; |
8370 | 363 | } |
8371 | 363 | } |
8372 | | |
8373 | 220k | if (td->td_stripoffsetbyteallocsize == 0 && |
8374 | 220k | td->td_nstrips < 1024 * 1024) |
8375 | 219k | { |
8376 | 219k | nStripArrayAllocNew = td->td_nstrips; |
8377 | 219k | } |
8378 | 1.12k | else |
8379 | 1.12k | { |
8380 | 1.12k | #define TIFF_MAX(a, b) (((a) > (b)) ? (a) : (b)) |
8381 | 1.12k | #define TIFF_MIN(a, b) (((a) < (b)) ? (a) : (b)) |
8382 | 1.12k | nStripArrayAllocNew = TIFF_MAX(strile + 1, 1024U * 512U); |
8383 | 1.12k | if (nStripArrayAllocNew < 0xFFFFFFFFU / 2) |
8384 | 1.12k | nStripArrayAllocNew *= 2; |
8385 | 1.12k | nStripArrayAllocNew = TIFF_MIN(nStripArrayAllocNew, td->td_nstrips); |
8386 | 1.12k | } |
8387 | 220k | assert(strile < nStripArrayAllocNew); |
8388 | 220k | nArraySize64 = (uint64_t)sizeof(uint64_t) * nStripArrayAllocNew; |
8389 | 220k | nArraySize = (size_t)(nArraySize64); |
8390 | | #if SIZEOF_SIZE_T == 4 |
8391 | | if (nArraySize != nArraySize64) |
8392 | | { |
8393 | | TIFFErrorExtR(tif, module, |
8394 | | "Cannot allocate strip offset and bytecount arrays"); |
8395 | | return 0; |
8396 | | } |
8397 | | #endif |
8398 | 220k | offsetArray = (uint64_t *)(_TIFFreallocExt(tif, td->td_stripoffset_p, |
8399 | 220k | (tmsize_t)nArraySize)); |
8400 | 220k | bytecountArray = (uint64_t *)(_TIFFreallocExt( |
8401 | 220k | tif, td->td_stripbytecount_p, (tmsize_t)nArraySize)); |
8402 | 220k | if (offsetArray) |
8403 | 220k | td->td_stripoffset_p = offsetArray; |
8404 | 220k | if (bytecountArray) |
8405 | 220k | td->td_stripbytecount_p = bytecountArray; |
8406 | 220k | if (offsetArray && bytecountArray) |
8407 | 220k | { |
8408 | 220k | td->td_stripoffsetbyteallocsize = nStripArrayAllocNew; |
8409 | | /* Initialize new entries to ~0 / -1 */ |
8410 | | /* coverity[overrun-buffer-arg] */ |
8411 | 220k | memset(td->td_stripoffset_p + nStripArrayAllocBefore, 0xFF, |
8412 | 220k | (td->td_stripoffsetbyteallocsize - nStripArrayAllocBefore) * |
8413 | 220k | sizeof(uint64_t)); |
8414 | | /* coverity[overrun-buffer-arg] */ |
8415 | 220k | memset(td->td_stripbytecount_p + nStripArrayAllocBefore, 0xFF, |
8416 | 220k | (td->td_stripoffsetbyteallocsize - nStripArrayAllocBefore) * |
8417 | 220k | sizeof(uint64_t)); |
8418 | 220k | } |
8419 | 0 | else |
8420 | 0 | { |
8421 | 0 | TIFFErrorExtR(tif, module, |
8422 | 0 | "Cannot allocate strip offset and bytecount arrays"); |
8423 | 0 | _TIFFfreeExt(tif, td->td_stripoffset_p); |
8424 | 0 | td->td_stripoffset_p = NULL; |
8425 | 0 | _TIFFfreeExt(tif, td->td_stripbytecount_p); |
8426 | 0 | td->td_stripbytecount_p = NULL; |
8427 | 0 | td->td_stripoffsetbyteallocsize = 0; |
8428 | 0 | } |
8429 | 220k | } |
8430 | 5.79M | if (*parray == NULL || strile >= td->td_stripoffsetbyteallocsize) |
8431 | 0 | return 0; |
8432 | | |
8433 | 5.79M | if (~((*parray)[strile]) == 0) |
8434 | 1.24M | { |
8435 | 1.24M | if (!_TIFFPartialReadStripArray(tif, dirent, (int)strile, *parray)) |
8436 | 616k | { |
8437 | 616k | (*parray)[strile] = 0; |
8438 | 616k | return 0; |
8439 | 616k | } |
8440 | 1.24M | } |
8441 | | |
8442 | 5.18M | return 1; |
8443 | 5.79M | } |
8444 | | |
8445 | | static uint64_t _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32_t strile, |
8446 | | TIFFDirEntry *dirent, |
8447 | | uint64_t **parray, |
8448 | | int *pbErr) |
8449 | 32.9M | { |
8450 | 32.9M | TIFFDirectory *td = &tif->tif_dir; |
8451 | 32.9M | if (pbErr) |
8452 | 19.5M | *pbErr = 0; |
8453 | | |
8454 | 32.9M | if (strile >= td->td_nstrips) |
8455 | 0 | { |
8456 | 0 | if (pbErr) |
8457 | 0 | *pbErr = 1; |
8458 | 0 | return 0; |
8459 | 0 | } |
8460 | | |
8461 | | /* Avoid the "dirent->tdir_count <= 4" code path for one of |
8462 | | * StripOffsets/StripByteCounts, and the other code path for the other one, |
8463 | | * which will lead to inconsistencies and potential out-of-bounds reads. |
8464 | | */ |
8465 | 32.9M | if ((td->td_stripoffset_entry.tdir_count <= 4) != |
8466 | 32.9M | (td->td_stripbytecount_entry.tdir_count <= 4)) |
8467 | 414k | { |
8468 | 414k | TIFFErrorExtR(tif, "_TIFFGetStrileOffsetOrByteCountValue", |
8469 | 414k | "Inconsistent directory count between StripOffsets and " |
8470 | 414k | "StripByteCounts"); |
8471 | 414k | if (pbErr) |
8472 | 27.8k | *pbErr = 1; |
8473 | 414k | return 0; |
8474 | 414k | } |
8475 | | |
8476 | 32.5M | if ((tif->tif_flags & TIFF_DEFERSTRILELOAD) && |
8477 | 31.4M | !(tif->tif_flags & TIFF_CHOPPEDUPARRAYS)) |
8478 | 31.1M | { |
8479 | 31.1M | if (!(tif->tif_flags & TIFF_LAZYSTRILELOAD_ASKED) || |
8480 | | /* If the values may fit in the toff_long/toff_long8 member */ |
8481 | | /* then use _TIFFFillStriles to simplify _TIFFFetchStrileValue */ |
8482 | 31.1M | dirent->tdir_count <= 4) |
8483 | 25.3M | { |
8484 | 25.3M | if (!_TIFFFillStriles(tif)) |
8485 | 36.1k | { |
8486 | 36.1k | if (pbErr) |
8487 | 14.0k | *pbErr = 1; |
8488 | | /* Do not return, as we want this function to always */ |
8489 | | /* return the same value if called several times with */ |
8490 | | /* the same arguments */ |
8491 | 36.1k | } |
8492 | 25.3M | } |
8493 | 5.80M | else |
8494 | 5.80M | { |
8495 | 5.80M | if (!_TIFFFetchStrileValue(tif, strile, dirent, parray)) |
8496 | 621k | { |
8497 | 621k | if (pbErr) |
8498 | 63.7k | *pbErr = 1; |
8499 | 621k | return 0; |
8500 | 621k | } |
8501 | 5.80M | } |
8502 | 31.1M | } |
8503 | 31.8M | if (*parray == NULL) |
8504 | 24.2k | { |
8505 | 24.2k | if (pbErr) |
8506 | 11.5k | *pbErr = 1; |
8507 | 24.2k | return 0; |
8508 | 24.2k | } |
8509 | 31.8M | return (*parray)[strile]; |
8510 | 31.8M | } |
8511 | | |
8512 | | /* Return the value of the TileOffsets/StripOffsets array for the specified |
8513 | | * tile/strile */ |
8514 | | uint64_t TIFFGetStrileOffset(TIFF *tif, uint32_t strile) |
8515 | 2.48M | { |
8516 | 2.48M | return TIFFGetStrileOffsetWithErr(tif, strile, NULL); |
8517 | 2.48M | } |
8518 | | |
8519 | | /* Return the value of the TileOffsets/StripOffsets array for the specified |
8520 | | * tile/strile */ |
8521 | | uint64_t TIFFGetStrileOffsetWithErr(TIFF *tif, uint32_t strile, int *pbErr) |
8522 | 17.5M | { |
8523 | 17.5M | TIFFDirectory *td = &tif->tif_dir; |
8524 | 17.5M | return _TIFFGetStrileOffsetOrByteCountValue(tif, strile, |
8525 | 17.5M | &(td->td_stripoffset_entry), |
8526 | 17.5M | &(td->td_stripoffset_p), pbErr); |
8527 | 17.5M | } |
8528 | | |
8529 | | /* Return the value of the TileByteCounts/StripByteCounts array for the |
8530 | | * specified tile/strile */ |
8531 | | uint64_t TIFFGetStrileByteCount(TIFF *tif, uint32_t strile) |
8532 | 10.9M | { |
8533 | 10.9M | return TIFFGetStrileByteCountWithErr(tif, strile, NULL); |
8534 | 10.9M | } |
8535 | | |
8536 | | /* Return the value of the TileByteCounts/StripByteCounts array for the |
8537 | | * specified tile/strile */ |
8538 | | uint64_t TIFFGetStrileByteCountWithErr(TIFF *tif, uint32_t strile, int *pbErr) |
8539 | 15.3M | { |
8540 | 15.3M | TIFFDirectory *td = &tif->tif_dir; |
8541 | 15.3M | return _TIFFGetStrileOffsetOrByteCountValue( |
8542 | 15.3M | tif, strile, &(td->td_stripbytecount_entry), &(td->td_stripbytecount_p), |
8543 | 15.3M | pbErr); |
8544 | 15.3M | } |
8545 | | |
8546 | 27.1M | int _TIFFFillStriles(TIFF *tif) { return _TIFFFillStrilesInternal(tif, 1); } |
8547 | | |
8548 | | static int _TIFFFillStrilesInternal(TIFF *tif, int loadStripByteCount) |
8549 | 27.3M | { |
8550 | 27.3M | TIFFDirectory *td = &tif->tif_dir; |
8551 | 27.3M | int return_value = 1; |
8552 | | |
8553 | | /* Do not do anything if TIFF_DEFERSTRILELOAD is not set */ |
8554 | 27.3M | if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) || |
8555 | 25.5M | (tif->tif_flags & TIFF_CHOPPEDUPARRAYS) != 0) |
8556 | 1.79M | return 1; |
8557 | | |
8558 | 25.5M | if ((tif->tif_flags & TIFF_LAZYSTRILELOAD_ASKED) && |
8559 | 25.5M | !(tif->tif_flags & TIFF_LAZYSTRILELOAD_DONE)) |
8560 | 256k | { |
8561 | | /* In case of lazy loading, reload completely the arrays */ |
8562 | 256k | _TIFFfreeExt(tif, td->td_stripoffset_p); |
8563 | 256k | _TIFFfreeExt(tif, td->td_stripbytecount_p); |
8564 | 256k | td->td_stripoffset_p = NULL; |
8565 | 256k | td->td_stripbytecount_p = NULL; |
8566 | 256k | td->td_stripoffsetbyteallocsize = 0; |
8567 | 256k | tif->tif_flags |= TIFF_LAZYSTRILELOAD_DONE; |
8568 | 256k | } |
8569 | | |
8570 | | /* If stripoffset array is already loaded, exit with success */ |
8571 | 25.5M | if (td->td_stripoffset_p != NULL) |
8572 | 25.3M | return 1; |
8573 | | |
8574 | | /* If tdir_count was canceled, then we already got there, but in error */ |
8575 | 278k | if (td->td_stripoffset_entry.tdir_count == 0) |
8576 | 30.2k | return 0; |
8577 | | |
8578 | 248k | if (!TIFFFetchStripThing(tif, &(td->td_stripoffset_entry), td->td_nstrips, |
8579 | 248k | &td->td_stripoffset_p)) |
8580 | 6.68k | { |
8581 | 6.68k | return_value = 0; |
8582 | 6.68k | } |
8583 | | |
8584 | 248k | if (loadStripByteCount && |
8585 | 71.6k | !TIFFFetchStripThing(tif, &(td->td_stripbytecount_entry), |
8586 | 71.6k | td->td_nstrips, &td->td_stripbytecount_p)) |
8587 | 3.66k | { |
8588 | 3.66k | return_value = 0; |
8589 | 3.66k | } |
8590 | | |
8591 | 248k | _TIFFmemset(&(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry)); |
8592 | 248k | _TIFFmemset(&(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry)); |
8593 | | |
8594 | | #ifdef STRIPBYTECOUNTSORTED_UNUSED |
8595 | | if (tif->tif_dir.td_nstrips > 1 && return_value == 1) |
8596 | | { |
8597 | | uint32_t strip; |
8598 | | |
8599 | | tif->tif_dir.td_stripbytecountsorted = 1; |
8600 | | for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) |
8601 | | { |
8602 | | if (tif->tif_dir.td_stripoffset_p[strip - 1] > |
8603 | | tif->tif_dir.td_stripoffset_p[strip]) |
8604 | | { |
8605 | | tif->tif_dir.td_stripbytecountsorted = 0; |
8606 | | break; |
8607 | | } |
8608 | | } |
8609 | | } |
8610 | | #endif |
8611 | | |
8612 | 248k | return return_value; |
8613 | 278k | } |