Coverage Report

Created: 2022-10-31 07:00

/src/ghostpdl/tiff/libtiff/tif_read.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright (c) 1988-1997 Sam Leffler
3
 * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4
 *
5
 * Permission to use, copy, modify, distribute, and sell this software and 
6
 * its documentation for any purpose is hereby granted without fee, provided
7
 * that (i) the above copyright notices and this permission notice appear in
8
 * all copies of the software and related documentation, and (ii) the names of
9
 * Sam Leffler and Silicon Graphics may not be used in any advertising or
10
 * publicity relating to the software without the specific, prior written
11
 * permission of Sam Leffler and Silicon Graphics.
12
 * 
13
 * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, 
14
 * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY 
15
 * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.  
16
 * 
17
 * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18
 * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19
 * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20
 * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF 
21
 * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE 
22
 * OF THIS SOFTWARE.
23
 */
24
25
/*
26
 * TIFF Library.
27
 * Scanline-oriented Read Support
28
 */
29
#include "tiffiop.h"
30
#include <stdio.h>
31
32
int TIFFFillStrip(TIFF* tif, uint32_t strip);
33
int TIFFFillTile(TIFF* tif, uint32_t tile);
34
static int TIFFStartStrip(TIFF* tif, uint32_t strip);
35
static int TIFFStartTile(TIFF* tif, uint32_t tile);
36
static int TIFFCheckRead(TIFF*, int);
37
static tmsize_t
38
TIFFReadRawStrip1(TIFF* tif, uint32_t strip, void* buf, tmsize_t size, const char* module);
39
static tmsize_t
40
TIFFReadRawTile1(TIFF* tif, uint32_t tile, void* buf, tmsize_t size, const char* module);
41
42
0
#define NOSTRIP ((uint32_t)(-1))       /* undefined state */
43
0
#define NOTILE ((uint32_t)(-1))         /* undefined state */
44
45
0
#define INITIAL_THRESHOLD (1024 * 1024)
46
0
#define THRESHOLD_MULTIPLIER 10
47
0
#define MAX_THRESHOLD (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * INITIAL_THRESHOLD)
48
49
0
#define TIFF_INT64_MAX ((((int64_t)0x7FFFFFFF) << 32) | 0xFFFFFFFF)
50
51
/* Read 'size' bytes in tif_rawdata buffer starting at offset 'rawdata_offset'
52
 * Returns 1 in case of success, 0 otherwise. */
53
static int TIFFReadAndRealloc(TIFF* tif, tmsize_t size,
54
                              tmsize_t rawdata_offset,
55
                              int is_strip, uint32_t strip_or_tile,
56
                              const char* module )
57
0
{
58
0
#if SIZEOF_SIZE_T == 8
59
0
        tmsize_t threshold = INITIAL_THRESHOLD;
60
0
#endif
61
0
        tmsize_t already_read = 0;
62
63
64
#if SIZEOF_SIZE_T != 8
65
        /* On 32 bit processes, if the request is large enough, check against */
66
        /* file size */
67
        if( size > 1000 * 1000 * 1000 )
68
        {
69
            uint64_t filesize = TIFFGetFileSize(tif);
70
            if((uint64_t)size >= filesize )
71
            {
72
                TIFFErrorExt(tif->tif_clientdata, module,
73
                             "Chunk size requested is larger than file size.");
74
                return 0;
75
            }
76
        }
77
#endif
78
79
        /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */
80
        /* so as to avoid allocating too much memory in case the file is too */
81
        /* short. We could ask for the file size, but this might be */
82
        /* expensive with some I/O layers (think of reading a gzipped file) */
83
        /* Restrict to 64 bit processes, so as to avoid reallocs() */
84
        /* on 32 bit processes where virtual memory is scarce.  */
85
0
        while( already_read < size )
86
0
        {
87
0
            tmsize_t bytes_read;
88
0
            tmsize_t to_read = size - already_read;
89
0
#if SIZEOF_SIZE_T == 8
90
0
            if( to_read >= threshold && threshold < MAX_THRESHOLD &&
91
0
                already_read + to_read + rawdata_offset > tif->tif_rawdatasize )
92
0
            {
93
0
                to_read = threshold;
94
0
                threshold *= THRESHOLD_MULTIPLIER;
95
0
            }
96
0
#endif
97
0
            if (already_read + to_read + rawdata_offset > tif->tif_rawdatasize) {
98
0
                uint8_t* new_rawdata;
99
0
                assert((tif->tif_flags & TIFF_MYBUFFER) != 0);
100
0
                tif->tif_rawdatasize = (tmsize_t)TIFFroundup_64(
101
0
                        (uint64_t)already_read + to_read + rawdata_offset, 1024);
102
0
                if (tif->tif_rawdatasize==0) {
103
0
                    TIFFErrorExt(tif->tif_clientdata, module,
104
0
                                "Invalid buffer size");
105
0
                    return 0;
106
0
                }
107
0
                new_rawdata = (uint8_t*) _TIFFrealloc(
108
0
                                tif->tif_rawdata, tif->tif_rawdatasize);
109
0
                if( new_rawdata == 0 )
110
0
                {
111
0
                    TIFFErrorExt(tif->tif_clientdata, module,
112
0
                        "No space for data buffer at scanline %"PRIu32,
113
0
                        tif->tif_row);
114
0
                    _TIFFfree(tif->tif_rawdata);
115
0
                    tif->tif_rawdata = 0;
116
0
                    tif->tif_rawdatasize = 0;
117
0
                    return 0;
118
0
                }
119
0
                tif->tif_rawdata = new_rawdata;
120
0
            }
121
0
            if( tif->tif_rawdata == NULL )
122
0
            {
123
                /* should not happen in practice but helps CoverityScan */
124
0
                return 0;
125
0
            }
126
127
0
            bytes_read = TIFFReadFile(tif,
128
0
                tif->tif_rawdata + rawdata_offset + already_read, to_read);
129
0
            already_read += bytes_read;
130
0
            if (bytes_read != to_read) {
131
0
                memset( tif->tif_rawdata + rawdata_offset + already_read, 0,
132
0
                        tif->tif_rawdatasize - rawdata_offset - already_read );
133
0
                if( is_strip )
134
0
                {
135
0
                    TIFFErrorExt(tif->tif_clientdata, module,
136
0
                        "Read error at scanline %"PRIu32"; got %"TIFF_SSIZE_FORMAT" bytes, "
137
0
                        "expected %"TIFF_SSIZE_FORMAT,
138
0
                                        tif->tif_row,
139
0
                                        already_read,
140
0
                                        size);
141
0
                }
142
0
                else
143
0
                {
144
0
                    TIFFErrorExt(tif->tif_clientdata, module,
145
0
                        "Read error at row %"PRIu32", col %"PRIu32", tile %"PRIu32"; "
146
0
                        "got %"TIFF_SSIZE_FORMAT" bytes, expected %"TIFF_SSIZE_FORMAT"",
147
0
                                        tif->tif_row,
148
0
                                        tif->tif_col,
149
0
                                        strip_or_tile,
150
0
                                        already_read,
151
0
                                        size);
152
0
                }
153
0
                return 0;
154
0
            }
155
0
        }
156
0
        return 1;
157
0
}
158
159
160
static int
161
TIFFFillStripPartial( TIFF *tif, int strip, tmsize_t read_ahead, int restart )
162
0
{
163
0
  static const char module[] = "TIFFFillStripPartial";
164
0
  register TIFFDirectory *td = &tif->tif_dir;
165
0
        tmsize_t unused_data;
166
0
        uint64_t read_offset;
167
0
        tmsize_t to_read;
168
0
        tmsize_t read_ahead_mod;
169
        /* tmsize_t bytecountm; */
170
171
        /*
172
         * Expand raw data buffer, if needed, to hold data
173
         * strip coming from file (perhaps should set upper
174
         * bound on the size of a buffer we'll use?).
175
         */
176
177
        /* bytecountm=(tmsize_t) TIFFGetStrileByteCount(tif, strip); */
178
179
        /* Not completely sure where the * 2 comes from, but probably for */
180
        /* an exponentional growth strategy of tif_rawdatasize */
181
0
        if( read_ahead < TIFF_TMSIZE_T_MAX / 2 )
182
0
                read_ahead_mod = read_ahead * 2;
183
0
        else
184
0
                read_ahead_mod = read_ahead;
185
0
        if (read_ahead_mod > tif->tif_rawdatasize) {
186
0
                assert( restart );
187
                
188
0
                tif->tif_curstrip = NOSTRIP;
189
0
                if ((tif->tif_flags & TIFF_MYBUFFER) == 0) {
190
0
                        TIFFErrorExt(tif->tif_clientdata, module,
191
0
                                     "Data buffer too small to hold part of strip %d",
192
0
                                     strip);
193
0
                        return (0);
194
0
                }
195
0
        }
196
197
0
        if( restart )
198
0
        {
199
0
                tif->tif_rawdataloaded = 0;
200
0
                tif->tif_rawdataoff = 0;
201
0
        }
202
203
        /*
204
        ** If we are reading more data, move any unused data to the
205
        ** start of the buffer.
206
        */
207
0
        if( tif->tif_rawdataloaded > 0 )
208
0
                unused_data = tif->tif_rawdataloaded - (tif->tif_rawcp - tif->tif_rawdata);
209
0
        else
210
0
                unused_data = 0;
211
        
212
0
        if( unused_data > 0 )
213
0
        {
214
0
    assert((tif->tif_flags&TIFF_BUFFERMMAP)==0);
215
0
                memmove( tif->tif_rawdata, tif->tif_rawcp, unused_data );
216
0
        }
217
218
        /*
219
        ** Seek to the point in the file where more data should be read.
220
        */
221
0
        read_offset = TIFFGetStrileOffset(tif, strip)
222
0
                + tif->tif_rawdataoff + tif->tif_rawdataloaded;
223
224
0
        if (!SeekOK(tif, read_offset)) {
225
0
                TIFFErrorExt(tif->tif_clientdata, module,
226
0
                             "Seek error at scanline %"PRIu32", strip %d",
227
0
                             tif->tif_row, strip);
228
0
                return 0;
229
0
        }
230
231
        /*
232
        ** How much do we want to read?
233
        */
234
0
        if( read_ahead_mod > tif->tif_rawdatasize )
235
0
                to_read = read_ahead_mod - unused_data;
236
0
        else
237
0
                to_read = tif->tif_rawdatasize - unused_data;
238
0
        if((uint64_t) to_read > TIFFGetStrileByteCount(tif, strip)
239
0
                                - tif->tif_rawdataoff - tif->tif_rawdataloaded )
240
0
        {
241
0
                to_read = (tmsize_t) TIFFGetStrileByteCount(tif, strip)
242
0
                        - tif->tif_rawdataoff - tif->tif_rawdataloaded;
243
0
        }
244
245
0
  assert((tif->tif_flags&TIFF_BUFFERMMAP)==0);
246
0
        if( !TIFFReadAndRealloc( tif, to_read, unused_data,
247
0
                                 1, /* is_strip */
248
0
                                 0, /* strip_or_tile */
249
0
                                 module) )
250
0
        {
251
0
                return 0;
252
0
        }
253
254
0
        tif->tif_rawdataoff = tif->tif_rawdataoff + tif->tif_rawdataloaded - unused_data ;
255
0
        tif->tif_rawdataloaded = unused_data + to_read;
256
257
0
        tif->tif_rawcc = tif->tif_rawdataloaded;
258
0
        tif->tif_rawcp = tif->tif_rawdata;
259
                        
260
0
        if (!isFillOrder(tif, td->td_fillorder) &&
261
0
            (tif->tif_flags & TIFF_NOBITREV) == 0) {
262
0
    assert((tif->tif_flags&TIFF_BUFFERMMAP)==0);
263
0
                TIFFReverseBits(tif->tif_rawdata + unused_data, to_read );
264
0
  }
265
266
        /*
267
        ** When starting a strip from the beginning we need to
268
        ** restart the decoder.
269
        */
270
0
        if( restart )
271
0
        {
272
273
#ifdef JPEG_SUPPORT
274
            /* A bit messy since breaks the codec abstraction. Ultimately */
275
            /* there should be a function pointer for that, but it seems */
276
            /* only JPEG is affected. */
277
            /* For JPEG, if there are multiple scans (can generally be known */
278
            /* with the  read_ahead used), we need to read the whole strip */
279
            if( tif->tif_dir.td_compression==COMPRESSION_JPEG &&
280
                (uint64_t)tif->tif_rawcc < TIFFGetStrileByteCount(tif, strip) )
281
            {
282
                if( TIFFJPEGIsFullStripRequired(tif) )
283
                {
284
                    return TIFFFillStrip(tif, strip);
285
                }
286
            }
287
#endif
288
289
0
            return TIFFStartStrip(tif, strip);
290
0
        }
291
0
        else
292
0
        {
293
0
                return 1;
294
0
        }
295
0
}
296
297
/*
298
 * Seek to a random row+sample in a file.
299
 *
300
 * Only used by TIFFReadScanline, and is only used on
301
 * strip organized files.  We do some tricky stuff to try
302
 * and avoid reading the whole compressed raw data for big
303
 * strips.
304
 */
305
static int
306
TIFFSeek(TIFF* tif, uint32_t row, uint16_t sample )
307
0
{
308
0
  register TIFFDirectory *td = &tif->tif_dir;
309
0
  uint32_t strip;
310
0
        int    whole_strip;
311
0
  tmsize_t read_ahead = 0;
312
313
        /*
314
        ** Establish what strip we are working from.
315
        */
316
0
  if (row >= td->td_imagelength) { /* out of range */
317
0
    TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
318
0
        "%"PRIu32": Row out of range, max %"PRIu32"",
319
0
        row,
320
0
        td->td_imagelength);
321
0
    return (0);
322
0
  }
323
0
  if (td->td_planarconfig == PLANARCONFIG_SEPARATE) {
324
0
    if (sample >= td->td_samplesperpixel) {
325
0
      TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
326
0
          "%"PRIu16": Sample out of range, max %"PRIu16"",
327
0
          sample, td->td_samplesperpixel);
328
0
      return (0);
329
0
    }
330
0
    strip = (uint32_t)sample * td->td_stripsperimage + row / td->td_rowsperstrip;
331
0
  } else
332
0
    strip = row / td->td_rowsperstrip;
333
334
        /*
335
         * Do we want to treat this strip as one whole chunk or
336
         * read it a few lines at a time?
337
         */
338
#if defined(CHUNKY_STRIP_READ_SUPPORT)
339
        whole_strip = TIFFGetStrileByteCount(tif, strip) < 10
340
                || isMapped(tif);
341
        if( td->td_compression == COMPRESSION_LERC ||
342
            td->td_compression == COMPRESSION_JBIG )
343
        {
344
            /* Ideally plugins should have a way to declare they don't support
345
             * chunk strip */
346
            whole_strip = 1;
347
        }
348
#else
349
0
        whole_strip = 1;
350
0
#endif
351
        
352
0
        if( !whole_strip )
353
0
        {
354
                /* 16 is for YCbCr mode where we may need to read 16 */
355
                /* lines at a time to get a decompressed line, and 5000 */
356
                /* is some constant value, for example for JPEG tables */
357
0
                if( tif->tif_scanlinesize < TIFF_TMSIZE_T_MAX / 16 &&
358
0
                    tif->tif_scanlinesize * 16 < TIFF_TMSIZE_T_MAX - 5000 )
359
0
                {
360
0
                        read_ahead = tif->tif_scanlinesize * 16 + 5000;
361
0
                }
362
0
                else
363
0
                {
364
0
                        read_ahead = tif->tif_scanlinesize;
365
0
                }
366
0
        }
367
368
        /*
369
         * If we haven't loaded this strip, do so now, possibly
370
         * only reading the first part.
371
         */
372
0
  if (strip != tif->tif_curstrip) { /* different strip, refill */
373
                
374
0
                if( whole_strip )
375
0
                {
376
0
                        if (!TIFFFillStrip(tif, strip))
377
0
                                return (0);
378
0
                }
379
0
                else
380
0
                {
381
0
                        if( !TIFFFillStripPartial(tif,strip,read_ahead,1) )
382
0
                                return 0;
383
0
                }
384
0
  }
385
386
        /*
387
        ** If we already have some data loaded, do we need to read some more?
388
        */
389
0
        else if( !whole_strip )
390
0
        {
391
0
                if( ((tif->tif_rawdata + tif->tif_rawdataloaded) - tif->tif_rawcp) < read_ahead 
392
0
                    && (uint64_t) tif->tif_rawdataoff + tif->tif_rawdataloaded < TIFFGetStrileByteCount(tif, strip) )
393
0
                {
394
0
                        if( !TIFFFillStripPartial(tif,strip,read_ahead,0) )
395
0
                                return 0;
396
0
                }
397
0
        }
398
399
0
        if (row < tif->tif_row) {
400
    /*
401
     * Moving backwards within the same strip: backup
402
     * to the start and then decode forward (below).
403
     *
404
     * NB: If you're planning on lots of random access within a
405
     * strip, it's better to just read and decode the entire
406
     * strip, and then access the decoded data in a random fashion.
407
     */
408
409
0
                if( tif->tif_rawdataoff != 0 )
410
0
                {
411
0
                        if( !TIFFFillStripPartial(tif,strip,read_ahead,1) )
412
0
                                return 0;
413
0
                }
414
0
                else
415
0
                {
416
0
                        if (!TIFFStartStrip(tif, strip))
417
0
                                return (0);
418
0
                }
419
0
  }
420
        
421
0
  if (row != tif->tif_row) {
422
    /*
423
     * Seek forward to the desired row.
424
     */
425
426
                /* TODO: Will this really work with partial buffers? */
427
                
428
0
    if (!(*tif->tif_seek)(tif, row - tif->tif_row))
429
0
      return (0);
430
0
    tif->tif_row = row;
431
0
  }
432
433
0
  return (1);
434
0
}
435
436
int
437
TIFFReadScanline(TIFF* tif, void* buf, uint32_t row, uint16_t sample)
438
0
{
439
0
  int e;
440
441
0
  if (!TIFFCheckRead(tif, 0))
442
0
    return (-1);
443
0
  if( (e = TIFFSeek(tif, row, sample)) != 0) {
444
    /*
445
     * Decompress desired row into user buffer.
446
     */
447
0
    e = (*tif->tif_decoderow)
448
0
        (tif, (uint8_t*) buf, tif->tif_scanlinesize, sample);
449
450
    /* we are now poised at the beginning of the next row */
451
0
    tif->tif_row = row + 1;
452
453
0
    if (e)
454
0
      (*tif->tif_postdecode)(tif, (uint8_t*) buf,
455
0
          tif->tif_scanlinesize);  
456
0
  }
457
0
  return (e > 0 ? 1 : -1);
458
0
}
459
460
/*
461
 * Calculate the strip size according to the number of
462
 * rows in the strip (check for truncated last strip on any
463
 * of the separations).
464
 */
465
static tmsize_t TIFFReadEncodedStripGetStripSize(TIFF* tif, uint32_t strip, uint16_t* pplane)
466
0
{
467
0
  static const char module[] = "TIFFReadEncodedStrip";
468
0
  TIFFDirectory *td = &tif->tif_dir;
469
0
  uint32_t rowsperstrip;
470
0
  uint32_t stripsperplane;
471
0
  uint32_t stripinplane;
472
0
  uint32_t rows;
473
0
  tmsize_t stripsize;
474
0
  if (!TIFFCheckRead(tif,0))
475
0
    return((tmsize_t)(-1));
476
0
  if (strip>=td->td_nstrips)
477
0
  {
478
0
    TIFFErrorExt(tif->tif_clientdata,module,
479
0
        "%"PRIu32": Strip out of range, max %"PRIu32, strip,
480
0
        td->td_nstrips);
481
0
    return((tmsize_t)(-1));
482
0
  }
483
484
0
  rowsperstrip=td->td_rowsperstrip;
485
0
  if (rowsperstrip>td->td_imagelength)
486
0
    rowsperstrip=td->td_imagelength;
487
0
  stripsperplane= TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip);
488
0
  stripinplane=(strip%stripsperplane);
489
0
  if( pplane ) *pplane=(uint16_t)(strip / stripsperplane);
490
0
  rows=td->td_imagelength-stripinplane*rowsperstrip;
491
0
  if (rows>rowsperstrip)
492
0
    rows=rowsperstrip;
493
0
  stripsize=TIFFVStripSize(tif,rows);
494
0
  if (stripsize==0)
495
0
    return((tmsize_t)(-1));
496
0
  return stripsize;
497
0
}
498
499
/*
500
 * Read a strip of data and decompress the specified
501
 * amount into the user-supplied buffer.
502
 */
503
tmsize_t
504
TIFFReadEncodedStrip(TIFF* tif, uint32_t strip, void* buf, tmsize_t size)
505
0
{
506
0
  static const char module[] = "TIFFReadEncodedStrip";
507
0
  TIFFDirectory *td = &tif->tif_dir;
508
0
  tmsize_t stripsize;
509
0
  uint16_t plane;
510
511
0
  stripsize=TIFFReadEncodedStripGetStripSize(tif, strip, &plane);
512
0
  if (stripsize==((tmsize_t)(-1)))
513
0
    return((tmsize_t)(-1));
514
515
    /* shortcut to avoid an extra memcpy() */
516
0
    if( td->td_compression == COMPRESSION_NONE &&
517
0
        size!=(tmsize_t)(-1) && size >= stripsize &&
518
0
        !isMapped(tif) &&
519
0
        ((tif->tif_flags&TIFF_NOREADRAW)==0) )
520
0
    {
521
0
        if (TIFFReadRawStrip1(tif, strip, buf, stripsize, module) != stripsize)
522
0
            return ((tmsize_t)(-1));
523
524
0
        if (!isFillOrder(tif, td->td_fillorder) &&
525
0
            (tif->tif_flags & TIFF_NOBITREV) == 0)
526
0
            TIFFReverseBits(buf,stripsize);
527
528
0
        (*tif->tif_postdecode)(tif,buf,stripsize);
529
0
        return (stripsize);
530
0
    }
531
532
0
  if ((size!=(tmsize_t)(-1))&&(size<stripsize))
533
0
    stripsize=size;
534
0
  if (!TIFFFillStrip(tif,strip))
535
0
    return((tmsize_t)(-1));
536
0
  if ((*tif->tif_decodestrip)(tif,buf,stripsize,plane)<=0)
537
0
    return((tmsize_t)(-1));
538
0
  (*tif->tif_postdecode)(tif,buf,stripsize);
539
0
  return(stripsize);
540
0
}
541
542
/* Variant of TIFFReadEncodedStrip() that does 
543
 * * if *buf == NULL, *buf = _TIFFmalloc(bufsizetoalloc) only after TIFFFillStrip() has
544
 *   succeeded. This avoid excessive memory allocation in case of truncated
545
 *   file.
546
 * * calls regular TIFFReadEncodedStrip() if *buf != NULL
547
 */
548
tmsize_t
549
_TIFFReadEncodedStripAndAllocBuffer(TIFF* tif, uint32_t strip,
550
                                    void **buf, tmsize_t bufsizetoalloc,
551
                                    tmsize_t size_to_read)
552
0
{
553
0
    tmsize_t this_stripsize;
554
0
    uint16_t plane;
555
556
0
    if( *buf != NULL )
557
0
    {
558
0
        return TIFFReadEncodedStrip(tif, strip, *buf, size_to_read);
559
0
    }
560
561
0
    this_stripsize=TIFFReadEncodedStripGetStripSize(tif, strip, &plane);
562
0
    if (this_stripsize==((tmsize_t)(-1)))
563
0
            return((tmsize_t)(-1));
564
565
0
    if ((size_to_read!=(tmsize_t)(-1))&&(size_to_read<this_stripsize))
566
0
            this_stripsize=size_to_read;
567
0
    if (!TIFFFillStrip(tif,strip))
568
0
            return((tmsize_t)(-1));
569
570
0
    *buf = _TIFFmalloc(bufsizetoalloc);
571
0
    if (*buf == NULL) {
572
0
            TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for strip buffer");
573
0
            return((tmsize_t)(-1));
574
0
    }
575
0
    _TIFFmemset(*buf, 0, bufsizetoalloc);
576
577
0
    if ((*tif->tif_decodestrip)(tif,*buf,this_stripsize,plane)<=0)
578
0
            return((tmsize_t)(-1));
579
0
    (*tif->tif_postdecode)(tif,*buf,this_stripsize);
580
0
    return(this_stripsize);
581
582
583
0
}
584
585
static tmsize_t
586
TIFFReadRawStrip1(TIFF* tif, uint32_t strip, void* buf, tmsize_t size,
587
                  const char* module)
588
0
{
589
0
  assert((tif->tif_flags&TIFF_NOREADRAW)==0);
590
0
  if (!isMapped(tif)) {
591
0
    tmsize_t cc;
592
593
0
    if (!SeekOK(tif, TIFFGetStrileOffset(tif, strip))) {
594
0
      TIFFErrorExt(tif->tif_clientdata, module,
595
0
          "Seek error at scanline %"PRIu32", strip %"PRIu32,
596
0
          tif->tif_row, strip);
597
0
      return ((tmsize_t)(-1));
598
0
    }
599
0
    cc = TIFFReadFile(tif, buf, size);
600
0
    if (cc != size) {
601
0
      TIFFErrorExt(tif->tif_clientdata, module,
602
0
    "Read error at scanline %"PRIu32"; got %"TIFF_SSIZE_FORMAT" bytes, expected %"TIFF_SSIZE_FORMAT,
603
0
             tif->tif_row,
604
0
             cc,
605
0
             size);
606
0
      return ((tmsize_t)(-1));
607
0
    }
608
0
  } else {
609
0
    tmsize_t ma = 0;
610
0
    tmsize_t n;
611
0
    if ((TIFFGetStrileOffset(tif, strip) > (uint64_t)TIFF_TMSIZE_T_MAX) ||
612
0
            ((ma=(tmsize_t)TIFFGetStrileOffset(tif, strip))>tif->tif_size))
613
0
                {
614
0
                    n=0;
615
0
                }
616
0
                else if( ma > TIFF_TMSIZE_T_MAX - size )
617
0
                {
618
0
                    n=0;
619
0
                }
620
0
                else
621
0
                {
622
0
                    tmsize_t mb=ma+size;
623
0
                    if (mb>tif->tif_size)
624
0
                            n=tif->tif_size-ma;
625
0
                    else
626
0
                            n=size;
627
0
                }
628
0
    if (n!=size) {
629
0
      TIFFErrorExt(tif->tif_clientdata, module,
630
0
  "Read error at scanline %"PRIu32", strip %"PRIu32"; got %"TIFF_SSIZE_FORMAT" bytes, expected %"TIFF_SSIZE_FORMAT,
631
0
             tif->tif_row,
632
0
             strip,
633
0
             n,
634
0
             size);
635
0
      return ((tmsize_t)(-1));
636
0
    }
637
0
    _TIFFmemcpy(buf, tif->tif_base + ma,
638
0
          size);
639
0
  }
640
0
  return (size);
641
0
}
642
643
static tmsize_t
644
TIFFReadRawStripOrTile2(TIFF* tif, uint32_t strip_or_tile, int is_strip,
645
                        tmsize_t size, const char* module)
646
0
{
647
0
        assert( !isMapped(tif) );
648
0
        assert((tif->tif_flags&TIFF_NOREADRAW)==0);
649
650
0
        if (!SeekOK(tif, TIFFGetStrileOffset(tif, strip_or_tile))) {
651
0
            if( is_strip )
652
0
            {
653
0
                TIFFErrorExt(tif->tif_clientdata, module,
654
0
                    "Seek error at scanline %"PRIu32", strip %"PRIu32,
655
0
                    tif->tif_row,
656
0
                    strip_or_tile);
657
0
            }
658
0
            else
659
0
            {
660
0
                TIFFErrorExt(tif->tif_clientdata, module,
661
0
                    "Seek error at row %"PRIu32", col %"PRIu32", tile %"PRIu32,
662
0
                    tif->tif_row,
663
0
                    tif->tif_col,
664
0
                    strip_or_tile);
665
0
            }
666
0
            return ((tmsize_t)(-1));
667
0
        }
668
669
0
        if( !TIFFReadAndRealloc( tif, size, 0, is_strip,
670
0
                                 strip_or_tile, module ) )
671
0
        {
672
0
            return ((tmsize_t)(-1));
673
0
        }
674
675
0
        return (size);
676
0
}
677
678
/*
679
 * Read a strip of data from the file.
680
 */
681
tmsize_t
682
TIFFReadRawStrip(TIFF* tif, uint32_t strip, void* buf, tmsize_t size)
683
0
{
684
0
  static const char module[] = "TIFFReadRawStrip";
685
0
  TIFFDirectory *td = &tif->tif_dir;
686
0
  uint64_t bytecount64;
687
0
  tmsize_t bytecountm;
688
689
0
  if (!TIFFCheckRead(tif, 0))
690
0
    return ((tmsize_t)(-1));
691
0
  if (strip >= td->td_nstrips) {
692
0
    TIFFErrorExt(tif->tif_clientdata, module,
693
0
         "%"PRIu32": Strip out of range, max %"PRIu32,
694
0
         strip,
695
0
         td->td_nstrips);
696
0
    return ((tmsize_t)(-1));
697
0
  }
698
0
  if (tif->tif_flags&TIFF_NOREADRAW)
699
0
  {
700
0
    TIFFErrorExt(tif->tif_clientdata, module,
701
0
        "Compression scheme does not support access to raw uncompressed data");
702
0
    return ((tmsize_t)(-1));
703
0
  }
704
0
  bytecount64 = TIFFGetStrileByteCount(tif, strip);
705
0
  if (size != (tmsize_t)(-1) && (uint64_t)size <= bytecount64)
706
0
    bytecountm = size;
707
0
  else
708
0
    bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module);
709
0
  if( bytecountm == 0 ) {
710
0
    return ((tmsize_t)(-1));
711
0
  }
712
0
  return (TIFFReadRawStrip1(tif, strip, buf, bytecountm, module));
713
0
}
714
715
TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
716
static uint64_t NoSanitizeSubUInt64(uint64_t a, uint64_t b)
717
0
{
718
0
    return a - b;
719
0
}
720
721
/*
722
 * Read the specified strip and setup for decoding. The data buffer is
723
 * expanded, as necessary, to hold the strip's data.
724
 */
725
int
726
TIFFFillStrip(TIFF* tif, uint32_t strip)
727
0
{
728
0
  static const char module[] = "TIFFFillStrip";
729
0
  TIFFDirectory *td = &tif->tif_dir;
730
731
0
  if ((tif->tif_flags&TIFF_NOREADRAW)==0)
732
0
  {
733
0
    uint64_t bytecount = TIFFGetStrileByteCount(tif, strip);
734
0
    if( bytecount == 0 || bytecount > (uint64_t)TIFF_INT64_MAX ) {
735
0
      TIFFErrorExt(tif->tif_clientdata, module,
736
0
        "Invalid strip byte count %"PRIu64", strip %"PRIu32,
737
0
             bytecount,
738
0
             strip);
739
0
      return (0);
740
0
    }
741
742
    /* To avoid excessive memory allocations: */
743
    /* Byte count should normally not be larger than a number of */
744
    /* times the uncompressed size plus some margin */
745
0
                if( bytecount > 1024 * 1024 )
746
0
                {
747
      /* 10 and 4096 are just values that could be adjusted. */
748
      /* Hopefully they are safe enough for all codecs */
749
0
      tmsize_t stripsize = TIFFStripSize(tif);
750
0
      if( stripsize != 0 &&
751
0
          (bytecount - 4096) / 10 > (uint64_t)stripsize  )
752
0
      {
753
0
        uint64_t newbytecount = (uint64_t)stripsize * 10 + 4096;
754
0
        if( newbytecount == 0 || newbytecount > (uint64_t)TIFF_INT64_MAX )
755
0
        {
756
0
          TIFFErrorExt(tif->tif_clientdata, module,
757
0
            "Too large strip byte count %"PRIu64", strip %"PRIu32". Limiting to %"PRIu64,
758
0
               bytecount,
759
0
               strip,
760
0
               newbytecount);
761
0
          bytecount = newbytecount;
762
0
        }
763
0
      }
764
0
    }
765
766
0
    if (isMapped(tif)) {
767
      /*
768
       * We must check for overflow, potentially causing
769
       * an OOB read. Instead of simple
770
       *
771
       *  TIFFGetStrileOffset(tif, strip)+bytecount > tif->tif_size
772
       *
773
       * comparison (which can overflow) we do the following
774
       * two comparisons:
775
       */
776
0
      if (bytecount > (uint64_t)tif->tif_size ||
777
0
          TIFFGetStrileOffset(tif, strip) > (uint64_t)tif->tif_size - bytecount) {
778
        /*
779
         * This error message might seem strange, but
780
         * it's what would happen if a read were done
781
         * instead.
782
         */
783
0
        TIFFErrorExt(tif->tif_clientdata, module,
784
785
0
          "Read error on strip %"PRIu32"; "
786
0
                    "got %"PRIu64" bytes, expected %"PRIu64,
787
0
          strip,
788
0
          NoSanitizeSubUInt64(tif->tif_size, TIFFGetStrileOffset(tif, strip)),
789
0
          bytecount);
790
0
        tif->tif_curstrip = NOSTRIP;
791
0
        return (0);
792
0
      }
793
0
    }
794
795
0
    if (isMapped(tif) &&
796
0
        (isFillOrder(tif, td->td_fillorder)
797
0
        || (tif->tif_flags & TIFF_NOBITREV))) {
798
      /*
799
       * The image is mapped into memory and we either don't
800
       * need to flip bits or the compression routine is
801
       * going to handle this operation itself.  In this
802
       * case, avoid copying the raw data and instead just
803
       * reference the data from the memory mapped file
804
       * image.  This assumes that the decompression
805
       * routines do not modify the contents of the raw data
806
       * buffer (if they try to, the application will get a
807
       * fault since the file is mapped read-only).
808
       */
809
0
      if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {
810
0
        _TIFFfree(tif->tif_rawdata);
811
0
        tif->tif_rawdata = NULL;
812
0
        tif->tif_rawdatasize = 0;
813
0
      }
814
0
      tif->tif_flags &= ~TIFF_MYBUFFER;
815
0
      tif->tif_rawdatasize = (tmsize_t)bytecount;
816
0
      tif->tif_rawdata = tif->tif_base + (tmsize_t)TIFFGetStrileOffset(tif, strip);
817
0
                        tif->tif_rawdataoff = 0;
818
0
                        tif->tif_rawdataloaded = (tmsize_t) bytecount;
819
820
      /* 
821
       * When we have tif_rawdata reference directly into the memory mapped file
822
       * we need to be pretty careful about how we use the rawdata.  It is not
823
       * a general purpose working buffer as it normally otherwise is.  So we
824
       * keep track of this fact to avoid using it improperly.
825
       */
826
0
      tif->tif_flags |= TIFF_BUFFERMMAP;
827
0
    } else {
828
      /*
829
       * Expand raw data buffer, if needed, to hold data
830
       * strip coming from file (perhaps should set upper
831
       * bound on the size of a buffer we'll use?).
832
       */
833
0
      tmsize_t bytecountm;
834
0
      bytecountm=(tmsize_t)bytecount;
835
0
      if ((uint64_t)bytecountm != bytecount)
836
0
      {
837
0
        TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
838
0
        return(0);
839
0
      }
840
0
      if (bytecountm > tif->tif_rawdatasize) {
841
0
        tif->tif_curstrip = NOSTRIP;
842
0
        if ((tif->tif_flags & TIFF_MYBUFFER) == 0) {
843
0
          TIFFErrorExt(tif->tif_clientdata, module,
844
0
              "Data buffer too small to hold strip %"PRIu32,
845
0
              strip);
846
0
          return (0);
847
0
        }
848
0
      }
849
0
      if (tif->tif_flags&TIFF_BUFFERMMAP) {
850
0
        tif->tif_curstrip = NOSTRIP;
851
0
        tif->tif_rawdata = NULL;
852
0
        tif->tif_rawdatasize = 0;
853
0
        tif->tif_flags &= ~TIFF_BUFFERMMAP;
854
0
      }
855
856
0
      if( isMapped(tif) )
857
0
      {
858
0
        if (bytecountm > tif->tif_rawdatasize &&
859
0
            !TIFFReadBufferSetup(tif, 0, bytecountm))
860
0
        {
861
0
          return (0);
862
0
        }
863
0
        if (TIFFReadRawStrip1(tif, strip, tif->tif_rawdata,
864
0
            bytecountm, module) != bytecountm)
865
0
        {
866
0
          return (0);
867
0
        }
868
0
      }
869
0
      else
870
0
      {
871
0
        if (TIFFReadRawStripOrTile2(tif, strip, 1,
872
0
            bytecountm, module) != bytecountm)
873
0
        {
874
0
          return (0);
875
0
        }
876
0
      }
877
878
879
0
                        tif->tif_rawdataoff = 0;
880
0
                        tif->tif_rawdataloaded = bytecountm;
881
                        
882
0
      if (!isFillOrder(tif, td->td_fillorder) &&
883
0
          (tif->tif_flags & TIFF_NOBITREV) == 0)
884
0
        TIFFReverseBits(tif->tif_rawdata, bytecountm);
885
0
                }
886
0
  }
887
0
  return (TIFFStartStrip(tif, strip));
888
0
}
889
890
/*
891
 * Tile-oriented Read Support
892
 * Contributed by Nancy Cam (Silicon Graphics).
893
 */
894
895
/*
896
 * Read and decompress a tile of data.  The
897
 * tile is selected by the (x,y,z,s) coordinates.
898
 */
899
tmsize_t
900
TIFFReadTile(TIFF* tif, void* buf, uint32_t x, uint32_t y, uint32_t z, uint16_t s)
901
0
{
902
0
  if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
903
0
    return ((tmsize_t)(-1));
904
0
  return (TIFFReadEncodedTile(tif,
905
0
      TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));
906
0
}
907
908
/*
909
 * Read a tile of data and decompress the specified
910
 * amount into the user-supplied buffer.
911
 */
912
tmsize_t
913
TIFFReadEncodedTile(TIFF* tif, uint32_t tile, void* buf, tmsize_t size)
914
0
{
915
0
  static const char module[] = "TIFFReadEncodedTile";
916
0
  TIFFDirectory *td = &tif->tif_dir;
917
0
  tmsize_t tilesize = tif->tif_tilesize;
918
919
0
  if (!TIFFCheckRead(tif, 1))
920
0
    return ((tmsize_t)(-1));
921
0
  if (tile >= td->td_nstrips) {
922
0
    TIFFErrorExt(tif->tif_clientdata, module,
923
0
        "%"PRIu32": Tile out of range, max %"PRIu32,
924
0
        tile, td->td_nstrips);
925
0
    return ((tmsize_t)(-1));
926
0
  }
927
928
    /* shortcut to avoid an extra memcpy() */
929
0
    if( td->td_compression == COMPRESSION_NONE &&
930
0
        size!=(tmsize_t)(-1) && size >= tilesize &&
931
0
        !isMapped(tif) &&
932
0
        ((tif->tif_flags&TIFF_NOREADRAW)==0) )
933
0
    {
934
0
        if (TIFFReadRawTile1(tif, tile, buf, tilesize, module) != tilesize)
935
0
            return ((tmsize_t)(-1));
936
937
0
        if (!isFillOrder(tif, td->td_fillorder) &&
938
0
            (tif->tif_flags & TIFF_NOBITREV) == 0)
939
0
            TIFFReverseBits(buf,tilesize);
940
941
0
        (*tif->tif_postdecode)(tif,buf,tilesize);
942
0
        return (tilesize);
943
0
    }
944
945
0
  if (size == (tmsize_t)(-1))
946
0
    size = tilesize;
947
0
  else if (size > tilesize)
948
0
    size = tilesize;
949
0
  if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
950
0
                                                          (uint8_t*) buf, size, (uint16_t)(tile / td->td_stripsperimage))) {
951
0
    (*tif->tif_postdecode)(tif, (uint8_t*) buf, size);
952
0
    return (size);
953
0
  } else
954
0
    return ((tmsize_t)(-1));
955
0
}
956
957
/* Variant of TIFFReadTile() that does 
958
 * * if *buf == NULL, *buf = _TIFFmalloc(bufsizetoalloc) only after TIFFFillTile() has
959
 *   succeeded. This avoid excessive memory allocation in case of truncated
960
 *   file.
961
 * * calls regular TIFFReadEncodedTile() if *buf != NULL
962
 */
963
tmsize_t
964
_TIFFReadTileAndAllocBuffer(TIFF* tif,
965
                            void **buf, tmsize_t bufsizetoalloc,
966
                            uint32_t x, uint32_t y, uint32_t z, uint16_t s)
967
0
{
968
0
    if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
969
0
            return ((tmsize_t)(-1));
970
0
    return (_TIFFReadEncodedTileAndAllocBuffer(tif,
971
0
                                               TIFFComputeTile(tif, x, y, z, s),
972
0
                                               buf, bufsizetoalloc,
973
0
                                               (tmsize_t)(-1)));
974
0
}
975
976
/* Variant of TIFFReadEncodedTile() that does 
977
 * * if *buf == NULL, *buf = _TIFFmalloc(bufsizetoalloc) only after TIFFFillTile() has
978
 *   succeeded. This avoid excessive memory allocation in case of truncated
979
 *   file.
980
 * * calls regular TIFFReadEncodedTile() if *buf != NULL
981
 */
982
tmsize_t
983
_TIFFReadEncodedTileAndAllocBuffer(TIFF* tif, uint32_t tile,
984
                                   void **buf, tmsize_t bufsizetoalloc,
985
                                   tmsize_t size_to_read)
986
0
{
987
0
    static const char module[] = "_TIFFReadEncodedTileAndAllocBuffer";
988
0
    TIFFDirectory *td = &tif->tif_dir;
989
0
    tmsize_t tilesize = tif->tif_tilesize;
990
991
0
    if( *buf != NULL )
992
0
    {
993
0
        return TIFFReadEncodedTile(tif, tile, *buf, size_to_read);
994
0
    }
995
996
0
    if (!TIFFCheckRead(tif, 1))
997
0
            return ((tmsize_t)(-1));
998
0
    if (tile >= td->td_nstrips) {
999
0
            TIFFErrorExt(tif->tif_clientdata, module,
1000
0
                "%"PRIu32": Tile out of range, max %"PRIu32,
1001
0
                tile, td->td_nstrips);
1002
0
            return ((tmsize_t)(-1));
1003
0
    }
1004
1005
0
    if (!TIFFFillTile(tif,tile))
1006
0
            return((tmsize_t)(-1));
1007
1008
0
    *buf = _TIFFmalloc(bufsizetoalloc);
1009
0
    if (*buf == NULL) {
1010
0
            TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif),
1011
0
                         "No space for tile buffer");
1012
0
            return((tmsize_t)(-1));
1013
0
    }
1014
0
    _TIFFmemset(*buf, 0, bufsizetoalloc);
1015
1016
0
    if (size_to_read == (tmsize_t)(-1))
1017
0
        size_to_read = tilesize;
1018
0
    else if (size_to_read > tilesize)
1019
0
        size_to_read = tilesize;
1020
0
    if( (*tif->tif_decodetile)(tif,
1021
0
                               (uint8_t*) *buf, size_to_read, (uint16_t)(tile / td->td_stripsperimage))) {
1022
0
        (*tif->tif_postdecode)(tif, (uint8_t*) *buf, size_to_read);
1023
0
        return (size_to_read);
1024
0
    } else
1025
0
        return ((tmsize_t)(-1));
1026
0
}
1027
1028
static tmsize_t
1029
TIFFReadRawTile1(TIFF* tif, uint32_t tile, void* buf, tmsize_t size, const char* module)
1030
0
{
1031
0
  assert((tif->tif_flags&TIFF_NOREADRAW)==0);
1032
0
  if (!isMapped(tif)) {
1033
0
    tmsize_t cc;
1034
1035
0
    if (!SeekOK(tif, TIFFGetStrileOffset(tif, tile))) {
1036
0
      TIFFErrorExt(tif->tif_clientdata, module,
1037
0
          "Seek error at row %"PRIu32", col %"PRIu32", tile %"PRIu32,
1038
0
          tif->tif_row,
1039
0
          tif->tif_col,
1040
0
          tile);
1041
0
      return ((tmsize_t)(-1));
1042
0
    }
1043
0
    cc = TIFFReadFile(tif, buf, size);
1044
0
    if (cc != size) {
1045
0
      TIFFErrorExt(tif->tif_clientdata, module,
1046
0
  "Read error at row %"PRIu32", col %"PRIu32"; got %"TIFF_SSIZE_FORMAT" bytes, expected %"TIFF_SSIZE_FORMAT,
1047
0
             tif->tif_row,
1048
0
             tif->tif_col,
1049
0
             cc,
1050
0
             size);
1051
0
      return ((tmsize_t)(-1));
1052
0
    }
1053
0
  } else {
1054
0
    tmsize_t ma,mb;
1055
0
    tmsize_t n;
1056
0
    ma=(tmsize_t)TIFFGetStrileOffset(tif, tile);
1057
0
    mb=ma+size;
1058
0
    if ((TIFFGetStrileOffset(tif, tile) > (uint64_t)TIFF_TMSIZE_T_MAX) || (ma > tif->tif_size))
1059
0
      n=0;
1060
0
    else if ((mb<ma)||(mb<size)||(mb>tif->tif_size))
1061
0
      n=tif->tif_size-ma;
1062
0
    else
1063
0
      n=size;
1064
0
    if (n!=size) {
1065
0
      TIFFErrorExt(tif->tif_clientdata, module,
1066
0
"Read error at row %"PRIu32", col %"PRIu32", tile %"PRIu32"; got %"TIFF_SSIZE_FORMAT" bytes, expected %"TIFF_SSIZE_FORMAT,
1067
0
             tif->tif_row,
1068
0
             tif->tif_col,
1069
0
             tile,
1070
0
             n,
1071
0
             size);
1072
0
      return ((tmsize_t)(-1));
1073
0
    }
1074
0
    _TIFFmemcpy(buf, tif->tif_base + ma, size);
1075
0
  }
1076
0
  return (size);
1077
0
}
1078
1079
/*
1080
 * Read a tile of data from the file.
1081
 */
1082
tmsize_t
1083
TIFFReadRawTile(TIFF* tif, uint32_t tile, void* buf, tmsize_t size)
1084
0
{
1085
0
  static const char module[] = "TIFFReadRawTile";
1086
0
  TIFFDirectory *td = &tif->tif_dir;
1087
0
  uint64_t bytecount64;
1088
0
  tmsize_t bytecountm;
1089
1090
0
  if (!TIFFCheckRead(tif, 1))
1091
0
    return ((tmsize_t)(-1));
1092
0
  if (tile >= td->td_nstrips) {
1093
0
    TIFFErrorExt(tif->tif_clientdata, module,
1094
0
        "%"PRIu32": Tile out of range, max %"PRIu32,
1095
0
        tile, td->td_nstrips);
1096
0
    return ((tmsize_t)(-1));
1097
0
  }
1098
0
  if (tif->tif_flags&TIFF_NOREADRAW)
1099
0
  {
1100
0
    TIFFErrorExt(tif->tif_clientdata, module,
1101
0
    "Compression scheme does not support access to raw uncompressed data");
1102
0
    return ((tmsize_t)(-1));
1103
0
  }
1104
0
  bytecount64 = TIFFGetStrileByteCount(tif, tile);
1105
0
  if (size != (tmsize_t)(-1) && (uint64_t)size <= bytecount64)
1106
0
    bytecountm = size;
1107
0
  else
1108
0
    bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module);
1109
0
  if( bytecountm == 0 ) {
1110
0
    return ((tmsize_t)(-1));
1111
0
  }
1112
0
  return (TIFFReadRawTile1(tif, tile, buf, bytecountm, module));
1113
0
}
1114
1115
/*
1116
 * Read the specified tile and setup for decoding. The data buffer is
1117
 * expanded, as necessary, to hold the tile's data.
1118
 */
1119
int
1120
TIFFFillTile(TIFF* tif, uint32_t tile)
1121
0
{
1122
0
  static const char module[] = "TIFFFillTile";
1123
0
  TIFFDirectory *td = &tif->tif_dir;
1124
1125
0
  if ((tif->tif_flags&TIFF_NOREADRAW)==0)
1126
0
  {
1127
0
    uint64_t bytecount = TIFFGetStrileByteCount(tif, tile);
1128
0
    if( bytecount == 0 || bytecount > (uint64_t)TIFF_INT64_MAX ) {
1129
0
      TIFFErrorExt(tif->tif_clientdata, module,
1130
0
        "%"PRIu64": Invalid tile byte count, tile %"PRIu32,
1131
0
             bytecount,
1132
0
             tile);
1133
0
      return (0);
1134
0
    }
1135
1136
    /* To avoid excessive memory allocations: */
1137
    /* Byte count should normally not be larger than a number of */
1138
    /* times the uncompressed size plus some margin */
1139
0
                if( bytecount > 1024 * 1024 )
1140
0
                {
1141
      /* 10 and 4096 are just values that could be adjusted. */
1142
      /* Hopefully they are safe enough for all codecs */
1143
0
      tmsize_t stripsize = TIFFTileSize(tif);
1144
0
      if( stripsize != 0 &&
1145
0
          (bytecount - 4096) / 10 > (uint64_t)stripsize  )
1146
0
      {
1147
0
        uint64_t newbytecount = (uint64_t)stripsize * 10 + 4096;
1148
0
        if( newbytecount == 0 || newbytecount > (uint64_t)TIFF_INT64_MAX )
1149
0
        {
1150
0
          TIFFErrorExt(tif->tif_clientdata, module,
1151
0
            "Too large tile byte count %"PRIu64", tile %"PRIu32". Limiting to %"PRIu64,
1152
0
               bytecount,
1153
0
               tile,
1154
0
               newbytecount);
1155
0
          bytecount = newbytecount;
1156
0
        }
1157
0
      }
1158
0
    }
1159
1160
0
    if (isMapped(tif)) {
1161
      /*
1162
       * We must check for overflow, potentially causing
1163
       * an OOB read. Instead of simple
1164
       *
1165
       *  TIFFGetStrileOffset(tif, tile)+bytecount > tif->tif_size
1166
       *
1167
       * comparison (which can overflow) we do the following
1168
       * two comparisons:
1169
       */
1170
0
      if (bytecount > (uint64_t)tif->tif_size ||
1171
0
          TIFFGetStrileOffset(tif, tile) > (uint64_t)tif->tif_size - bytecount) {
1172
0
        tif->tif_curtile = NOTILE;
1173
0
        return (0);
1174
0
      }
1175
0
    }
1176
1177
0
    if (isMapped(tif) &&
1178
0
        (isFillOrder(tif, td->td_fillorder)
1179
0
         || (tif->tif_flags & TIFF_NOBITREV))) {
1180
      /*
1181
       * The image is mapped into memory and we either don't
1182
       * need to flip bits or the compression routine is
1183
       * going to handle this operation itself.  In this
1184
       * case, avoid copying the raw data and instead just
1185
       * reference the data from the memory mapped file
1186
       * image.  This assumes that the decompression
1187
       * routines do not modify the contents of the raw data
1188
       * buffer (if they try to, the application will get a
1189
       * fault since the file is mapped read-only).
1190
       */
1191
0
      if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {
1192
0
        _TIFFfree(tif->tif_rawdata);
1193
0
        tif->tif_rawdata = NULL;
1194
0
        tif->tif_rawdatasize = 0;
1195
0
      }
1196
0
      tif->tif_flags &= ~TIFF_MYBUFFER;
1197
1198
0
      tif->tif_rawdatasize = (tmsize_t)bytecount;
1199
0
      tif->tif_rawdata =
1200
0
        tif->tif_base + (tmsize_t)TIFFGetStrileOffset(tif, tile);
1201
0
                        tif->tif_rawdataoff = 0;
1202
0
                        tif->tif_rawdataloaded = (tmsize_t) bytecount;
1203
0
      tif->tif_flags |= TIFF_BUFFERMMAP;
1204
0
    } else {
1205
      /*
1206
       * Expand raw data buffer, if needed, to hold data
1207
       * tile coming from file (perhaps should set upper
1208
       * bound on the size of a buffer we'll use?).
1209
       */
1210
0
      tmsize_t bytecountm;
1211
0
      bytecountm=(tmsize_t)bytecount;
1212
0
      if ((uint64_t)bytecountm != bytecount)
1213
0
      {
1214
0
        TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
1215
0
        return(0);
1216
0
      }
1217
0
      if (bytecountm > tif->tif_rawdatasize) {
1218
0
        tif->tif_curtile = NOTILE;
1219
0
        if ((tif->tif_flags & TIFF_MYBUFFER) == 0) {
1220
0
          TIFFErrorExt(tif->tif_clientdata, module,
1221
0
              "Data buffer too small to hold tile %"PRIu32,
1222
0
              tile);
1223
0
          return (0);
1224
0
        }
1225
0
      }
1226
0
      if (tif->tif_flags&TIFF_BUFFERMMAP) {
1227
0
        tif->tif_curtile = NOTILE;
1228
0
        tif->tif_rawdata = NULL;
1229
0
        tif->tif_rawdatasize = 0;
1230
0
        tif->tif_flags &= ~TIFF_BUFFERMMAP;
1231
0
      }
1232
1233
0
      if( isMapped(tif) )
1234
0
      {
1235
0
        if (bytecountm > tif->tif_rawdatasize &&
1236
0
            !TIFFReadBufferSetup(tif, 0, bytecountm))
1237
0
        {
1238
0
          return (0);
1239
0
        }
1240
0
        if (TIFFReadRawTile1(tif, tile, tif->tif_rawdata,
1241
0
            bytecountm, module) != bytecountm)
1242
0
        {
1243
0
          return (0);
1244
0
        }
1245
0
      }
1246
0
      else
1247
0
      {
1248
0
        if (TIFFReadRawStripOrTile2(tif, tile, 0,
1249
0
            bytecountm, module) != bytecountm)
1250
0
        {
1251
0
          return (0);
1252
0
        }
1253
0
      }
1254
1255
1256
0
                        tif->tif_rawdataoff = 0;
1257
0
                        tif->tif_rawdataloaded = bytecountm;
1258
                        
1259
0
      if (tif->tif_rawdata != NULL &&
1260
0
                            !isFillOrder(tif, td->td_fillorder) &&
1261
0
          (tif->tif_flags & TIFF_NOBITREV) == 0)
1262
0
        TIFFReverseBits(tif->tif_rawdata,
1263
0
                                                tif->tif_rawdataloaded);
1264
0
    }
1265
0
  }
1266
0
  return (TIFFStartTile(tif, tile));
1267
0
}
1268
1269
/*
1270
 * Setup the raw data buffer in preparation for
1271
 * reading a strip of raw data.  If the buffer
1272
 * is specified as zero, then a buffer of appropriate
1273
 * size is allocated by the library.  Otherwise,
1274
 * the client must guarantee that the buffer is
1275
 * large enough to hold any individual strip of
1276
 * raw data.
1277
 */
1278
int
1279
TIFFReadBufferSetup(TIFF* tif, void* bp, tmsize_t size)
1280
0
{
1281
0
  static const char module[] = "TIFFReadBufferSetup";
1282
1283
0
  assert((tif->tif_flags&TIFF_NOREADRAW)==0);
1284
0
  tif->tif_flags &= ~TIFF_BUFFERMMAP;
1285
1286
0
  if (tif->tif_rawdata) {
1287
0
    if (tif->tif_flags & TIFF_MYBUFFER)
1288
0
      _TIFFfree(tif->tif_rawdata);
1289
0
    tif->tif_rawdata = NULL;
1290
0
    tif->tif_rawdatasize = 0;
1291
0
  }
1292
0
  if (bp) {
1293
0
    tif->tif_rawdatasize = size;
1294
0
    tif->tif_rawdata = (uint8_t*) bp;
1295
0
    tif->tif_flags &= ~TIFF_MYBUFFER;
1296
0
  } else {
1297
0
    tif->tif_rawdatasize = (tmsize_t)TIFFroundup_64((uint64_t)size, 1024);
1298
0
    if (tif->tif_rawdatasize==0) {
1299
0
        TIFFErrorExt(tif->tif_clientdata, module,
1300
0
         "Invalid buffer size");
1301
0
        return (0);
1302
0
    }
1303
    /* Initialize to zero to avoid uninitialized buffers in case of */
1304
                /* short reads (http://bugzilla.maptools.org/show_bug.cgi?id=2651) */
1305
0
    tif->tif_rawdata = (uint8_t*) _TIFFcalloc(1, tif->tif_rawdatasize);
1306
0
    tif->tif_flags |= TIFF_MYBUFFER;
1307
0
  }
1308
0
  if (tif->tif_rawdata == NULL) {
1309
0
    TIFFErrorExt(tif->tif_clientdata, module,
1310
0
        "No space for data buffer at scanline %"PRIu32,
1311
0
        tif->tif_row);
1312
0
    tif->tif_rawdatasize = 0;
1313
0
    return (0);
1314
0
  }
1315
0
  return (1);
1316
0
}
1317
1318
/*
1319
 * Set state to appear as if a
1320
 * strip has just been read in.
1321
 */
1322
static int
1323
TIFFStartStrip(TIFF* tif, uint32_t strip)
1324
0
{
1325
0
  TIFFDirectory *td = &tif->tif_dir;
1326
1327
0
  if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
1328
0
    if (!(*tif->tif_setupdecode)(tif))
1329
0
      return (0);
1330
0
    tif->tif_flags |= TIFF_CODERSETUP;
1331
0
  }
1332
0
  tif->tif_curstrip = strip;
1333
0
  tif->tif_row = (strip % td->td_stripsperimage) * td->td_rowsperstrip;
1334
0
        tif->tif_flags &= ~TIFF_BUF4WRITE;
1335
1336
0
  if (tif->tif_flags&TIFF_NOREADRAW)
1337
0
  {
1338
0
    tif->tif_rawcp = NULL;
1339
0
    tif->tif_rawcc = 0;  
1340
0
  }
1341
0
  else
1342
0
  {
1343
0
    tif->tif_rawcp = tif->tif_rawdata;
1344
0
    if( tif->tif_rawdataloaded > 0 )
1345
0
      tif->tif_rawcc = tif->tif_rawdataloaded;
1346
0
    else
1347
0
      tif->tif_rawcc = (tmsize_t)TIFFGetStrileByteCount(tif, strip);
1348
0
  }
1349
0
  if ((*tif->tif_predecode)(tif,
1350
0
      (uint16_t)(strip / td->td_stripsperimage)) == 0 ) {
1351
            /* Needed for example for scanline access, if tif_predecode */
1352
            /* fails, and we try to read the same strip again. Without invalidating */
1353
            /* tif_curstrip, we'd call tif_decoderow() on a possibly invalid */
1354
            /* codec state. */
1355
0
            tif->tif_curstrip = NOSTRIP;
1356
0
            return 0;
1357
0
        }
1358
0
        return 1;
1359
0
}
1360
1361
/*
1362
 * Set state to appear as if a
1363
 * tile has just been read in.
1364
 */
1365
static int
1366
TIFFStartTile(TIFF* tif, uint32_t tile)
1367
0
{
1368
0
        static const char module[] = "TIFFStartTile";
1369
0
  TIFFDirectory *td = &tif->tif_dir;
1370
0
        uint32_t howmany32;
1371
1372
0
  if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
1373
0
    if (!(*tif->tif_setupdecode)(tif))
1374
0
      return (0);
1375
0
    tif->tif_flags |= TIFF_CODERSETUP;
1376
0
  }
1377
0
  tif->tif_curtile = tile;
1378
0
        howmany32=TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth);
1379
0
        if (howmany32 == 0) {
1380
0
                 TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
1381
0
                return 0;
1382
0
        }
1383
0
  tif->tif_row = (tile % howmany32) * td->td_tilelength;
1384
0
        howmany32=TIFFhowmany_32(td->td_imagelength, td->td_tilelength);
1385
0
        if (howmany32 == 0) {
1386
0
                TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
1387
0
                return 0;
1388
0
        }
1389
0
  tif->tif_col = (tile % howmany32) * td->td_tilewidth;
1390
0
        tif->tif_flags &= ~TIFF_BUF4WRITE;
1391
0
  if (tif->tif_flags&TIFF_NOREADRAW)
1392
0
  {
1393
0
    tif->tif_rawcp = NULL;
1394
0
    tif->tif_rawcc = 0;
1395
0
  }
1396
0
  else
1397
0
  {
1398
0
    tif->tif_rawcp = tif->tif_rawdata;
1399
0
    if( tif->tif_rawdataloaded > 0 )
1400
0
      tif->tif_rawcc = tif->tif_rawdataloaded;
1401
0
    else
1402
0
      tif->tif_rawcc = (tmsize_t)TIFFGetStrileByteCount(tif, tile);
1403
0
  }
1404
0
  return ((*tif->tif_predecode)(tif,
1405
0
      (uint16_t)(tile / td->td_stripsperimage)));
1406
0
}
1407
1408
static int
1409
TIFFCheckRead(TIFF* tif, int tiles)
1410
0
{
1411
0
  if (tif->tif_mode == O_WRONLY) {
1412
0
    TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "File not open for reading");
1413
0
    return (0);
1414
0
  }
1415
0
  if (tiles ^ isTiled(tif)) {
1416
0
    TIFFErrorExt(tif->tif_clientdata, tif->tif_name, tiles ?
1417
0
        "Can not read tiles from a striped image" :
1418
0
        "Can not read scanlines from a tiled image");
1419
0
    return (0);
1420
0
  }
1421
0
  return (1);
1422
0
}
1423
1424
/* Use the provided input buffer (inbuf, insize) and decompress it into
1425
 * (outbuf, outsize).
1426
 * This function replaces the use of TIFFReadEncodedStrip()/TIFFReadEncodedTile()
1427
 * when the user can provide the buffer for the input data, for example when
1428
 * he wants to avoid libtiff to read the strile offset/count values from the
1429
 * [Strip|Tile][Offsets/ByteCounts] array.
1430
 * inbuf content must be writable (if bit reversal is needed)
1431
 * Returns 1 in case of success, 0 otherwise.
1432
 */
1433
int      TIFFReadFromUserBuffer(TIFF* tif, uint32_t strile,
1434
                                void* inbuf, tmsize_t insize,
1435
                                void* outbuf, tmsize_t outsize)
1436
0
{
1437
0
    static const char module[] = "TIFFReadFromUserBuffer";
1438
0
    TIFFDirectory *td = &tif->tif_dir;
1439
0
    int ret = 1;
1440
0
    uint32_t old_tif_flags = tif->tif_flags;
1441
0
    tmsize_t old_rawdatasize = tif->tif_rawdatasize;
1442
0
    void* old_rawdata = tif->tif_rawdata;
1443
1444
0
    if (tif->tif_mode == O_WRONLY) {
1445
0
        TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "File not open for reading");
1446
0
        return 0;
1447
0
    }
1448
0
    if (tif->tif_flags&TIFF_NOREADRAW)
1449
0
    {
1450
0
        TIFFErrorExt(tif->tif_clientdata, module,
1451
0
                "Compression scheme does not support access to raw uncompressed data");
1452
0
        return 0;
1453
0
    }
1454
1455
0
    tif->tif_flags &= ~TIFF_MYBUFFER;
1456
0
    tif->tif_flags |= TIFF_BUFFERMMAP;
1457
0
    tif->tif_rawdatasize = insize;
1458
0
    tif->tif_rawdata = inbuf;
1459
0
    tif->tif_rawdataoff = 0;
1460
0
    tif->tif_rawdataloaded = insize;
1461
1462
0
    if (!isFillOrder(tif, td->td_fillorder) &&
1463
0
        (tif->tif_flags & TIFF_NOBITREV) == 0)
1464
0
    {
1465
0
        TIFFReverseBits(inbuf, insize);
1466
0
    }
1467
1468
0
    if( TIFFIsTiled(tif) )
1469
0
    {
1470
0
        if( !TIFFStartTile(tif, strile) ||
1471
0
            !(*tif->tif_decodetile)(tif, (uint8_t*) outbuf, outsize,
1472
0
                                    (uint16_t)(strile / td->td_stripsperimage)) )
1473
0
        {
1474
0
            ret = 0;
1475
0
        }
1476
0
    }
1477
0
    else
1478
0
    {
1479
0
        uint32_t rowsperstrip=td->td_rowsperstrip;
1480
0
        uint32_t stripsperplane;
1481
0
        if (rowsperstrip>td->td_imagelength)
1482
0
            rowsperstrip=td->td_imagelength;
1483
0
        stripsperplane= TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip);
1484
0
        if( !TIFFStartStrip(tif, strile) ||
1485
0
            !(*tif->tif_decodestrip)(tif, (uint8_t*) outbuf, outsize,
1486
0
                                     (uint16_t)(strile / stripsperplane)) )
1487
0
        {
1488
0
            ret = 0;
1489
0
        }
1490
0
    }
1491
0
    if( ret )
1492
0
    {
1493
0
        (*tif->tif_postdecode)(tif, (uint8_t*) outbuf, outsize);
1494
0
    }
1495
1496
0
    if (!isFillOrder(tif, td->td_fillorder) &&
1497
0
        (tif->tif_flags & TIFF_NOBITREV) == 0)
1498
0
    {
1499
0
        TIFFReverseBits(inbuf, insize);
1500
0
    }
1501
1502
0
    tif->tif_flags = old_tif_flags;
1503
0
    tif->tif_rawdatasize = old_rawdatasize;
1504
0
    tif->tif_rawdata = old_rawdata;
1505
0
    tif->tif_rawdataoff = 0;
1506
0
    tif->tif_rawdataloaded = 0;
1507
1508
0
    return ret;
1509
0
}
1510
1511
void
1512
_TIFFNoPostDecode(TIFF* tif, uint8_t* buf, tmsize_t cc)
1513
2.66M
{
1514
2.66M
    (void) tif; (void) buf; (void) cc;
1515
2.66M
}
1516
1517
void
1518
_TIFFSwab16BitData(TIFF* tif, uint8_t* buf, tmsize_t cc)
1519
0
{
1520
0
    (void) tif;
1521
0
    assert((cc & 1) == 0);
1522
0
    TIFFSwabArrayOfShort((uint16_t*) buf, cc / 2);
1523
0
}
1524
1525
void
1526
_TIFFSwab24BitData(TIFF* tif, uint8_t* buf, tmsize_t cc)
1527
0
{
1528
0
    (void) tif;
1529
0
    assert((cc % 3) == 0);
1530
0
    TIFFSwabArrayOfTriples((uint8_t*) buf, cc / 3);
1531
0
}
1532
1533
void
1534
_TIFFSwab32BitData(TIFF* tif, uint8_t* buf, tmsize_t cc)
1535
0
{
1536
0
    (void) tif;
1537
0
    assert((cc & 3) == 0);
1538
0
    TIFFSwabArrayOfLong((uint32_t*) buf, cc / 4);
1539
0
}
1540
1541
void
1542
_TIFFSwab64BitData(TIFF* tif, uint8_t* buf, tmsize_t cc)
1543
0
{
1544
0
    (void) tif;
1545
0
    assert((cc & 7) == 0);
1546
0
    TIFFSwabArrayOfDouble((double*) buf, cc/8);
1547
0
}
1548
1549
/* vim: set ts=8 sts=8 sw=8 noet: */
1550
/*
1551
 * Local Variables:
1552
 * mode: c
1553
 * c-basic-offset: 8
1554
 * fill-column: 78
1555
 * End:
1556
 */