Coverage Report

Created: 2025-07-23 08:18

/src/libtiff/libtiff/tif_dir.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright (c) 1988-1997 Sam Leffler
3
 * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4
 *
5
 * Permission to use, copy, modify, distribute, and sell this software and
6
 * its documentation for any purpose is hereby granted without fee, provided
7
 * that (i) the above copyright notices and this permission notice appear in
8
 * all copies of the software and related documentation, and (ii) the names of
9
 * Sam Leffler and Silicon Graphics may not be used in any advertising or
10
 * publicity relating to the software without the specific, prior written
11
 * permission of Sam Leffler and Silicon Graphics.
12
 *
13
 * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14
 * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15
 * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16
 *
17
 * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18
 * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19
 * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20
 * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21
 * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22
 * OF THIS SOFTWARE.
23
 */
24
25
/*
26
 * TIFF Library.
27
 *
28
 * Directory Tag Get & Set Routines.
29
 * (and also some miscellaneous stuff)
30
 */
31
#include "tiffiop.h"
32
#include <float.h> /*--: for Rational2Double */
33
#include <limits.h>
34
35
/*
36
 * These are used in the backwards compatibility code...
37
 */
38
4
#define DATATYPE_VOID 0   /* !untyped data */
39
11
#define DATATYPE_INT 1    /* !signed integer data */
40
4
#define DATATYPE_UINT 2   /* !unsigned integer data */
41
3
#define DATATYPE_IEEEFP 3 /* !IEEE floating point data */
42
43
static void setByteArray(TIFF *tif, void **vpp, const void *vp, size_t nmemb,
44
                         size_t elem_size)
45
138k
{
46
138k
    if (*vpp)
47
3.12k
    {
48
3.12k
        _TIFFfreeExt(tif, *vpp);
49
3.12k
        *vpp = 0;
50
3.12k
    }
51
138k
    if (vp)
52
137k
    {
53
137k
        tmsize_t bytes = _TIFFMultiplySSize(NULL, nmemb, elem_size, NULL);
54
137k
        if (bytes)
55
137k
            *vpp = (void *)_TIFFmallocExt(tif, bytes);
56
137k
        if (*vpp)
57
137k
            _TIFFmemcpy(*vpp, vp, bytes);
58
137k
    }
59
138k
}
60
void _TIFFsetByteArray(void **vpp, const void *vp, uint32_t n)
61
0
{
62
0
    setByteArray(NULL, vpp, vp, n, 1);
63
0
}
64
void _TIFFsetByteArrayExt(TIFF *tif, void **vpp, const void *vp, uint32_t n)
65
507
{
66
507
    setByteArray(tif, vpp, vp, n, 1);
67
507
}
68
69
static void _TIFFsetNString(TIFF *tif, char **cpp, const char *cp, uint32_t n)
70
104
{
71
104
    setByteArray(tif, (void **)cpp, cp, n, 1);
72
104
}
73
74
void _TIFFsetShortArray(uint16_t **wpp, const uint16_t *wp, uint32_t n)
75
0
{
76
0
    setByteArray(NULL, (void **)wpp, wp, n, sizeof(uint16_t));
77
0
}
78
void _TIFFsetShortArrayExt(TIFF *tif, uint16_t **wpp, const uint16_t *wp,
79
                           uint32_t n)
80
32.3k
{
81
32.3k
    setByteArray(tif, (void **)wpp, wp, n, sizeof(uint16_t));
82
32.3k
}
83
84
void _TIFFsetLongArray(uint32_t **lpp, const uint32_t *lp, uint32_t n)
85
0
{
86
0
    setByteArray(NULL, (void **)lpp, lp, n, sizeof(uint32_t));
87
0
}
88
void _TIFFsetLongArrayExt(TIFF *tif, uint32_t **lpp, const uint32_t *lp,
89
                          uint32_t n)
90
0
{
91
0
    setByteArray(tif, (void **)lpp, lp, n, sizeof(uint32_t));
92
0
}
93
94
static void _TIFFsetLong8Array(TIFF *tif, uint64_t **lpp, const uint64_t *lp,
95
                               uint32_t n)
96
255
{
97
255
    setByteArray(tif, (void **)lpp, lp, n, sizeof(uint64_t));
98
255
}
99
100
void _TIFFsetFloatArray(float **fpp, const float *fp, uint32_t n)
101
0
{
102
0
    setByteArray(NULL, (void **)fpp, fp, n, sizeof(float));
103
0
}
104
void _TIFFsetFloatArrayExt(TIFF *tif, float **fpp, const float *fp, uint32_t n)
105
6.76k
{
106
6.76k
    setByteArray(tif, (void **)fpp, fp, n, sizeof(float));
107
6.76k
}
108
109
void _TIFFsetDoubleArray(double **dpp, const double *dp, uint32_t n)
110
0
{
111
0
    setByteArray(NULL, (void **)dpp, dp, n, sizeof(double));
112
0
}
113
void _TIFFsetDoubleArrayExt(TIFF *tif, double **dpp, const double *dp,
114
                            uint32_t n)
115
1.41k
{
116
1.41k
    setByteArray(tif, (void **)dpp, dp, n, sizeof(double));
117
1.41k
}
118
119
static void setDoubleArrayOneValue(TIFF *tif, double **vpp, double value,
120
                                   size_t nmemb)
121
0
{
122
0
    if (*vpp)
123
0
        _TIFFfreeExt(tif, *vpp);
124
0
    *vpp = _TIFFmallocExt(tif, nmemb * sizeof(double));
125
0
    if (*vpp)
126
0
    {
127
0
        while (nmemb--)
128
0
            ((double *)*vpp)[nmemb] = value;
129
0
    }
130
0
}
131
132
/*
133
 * Install extra samples information.
134
 */
135
static int setExtraSamples(TIFF *tif, va_list ap, uint32_t *v)
136
13.6k
{
137
/* XXX: Unassociated alpha data == 999 is a known Corel Draw bug, see below */
138
13.6k
#define EXTRASAMPLE_COREL_UNASSALPHA 999
139
140
13.6k
    uint16_t *va;
141
13.6k
    uint32_t i;
142
13.6k
    TIFFDirectory *td = &tif->tif_dir;
143
13.6k
    static const char module[] = "setExtraSamples";
144
145
13.6k
    *v = (uint16_t)va_arg(ap, uint16_vap);
146
13.6k
    if ((uint16_t)*v > td->td_samplesperpixel)
147
40
        return 0;
148
13.6k
    va = va_arg(ap, uint16_t *);
149
13.6k
    if (*v > 0 && va == NULL) /* typically missing param */
150
0
        return 0;
151
28.0k
    for (i = 0; i < *v; i++)
152
14.5k
    {
153
14.5k
        if (va[i] > EXTRASAMPLE_UNASSALPHA)
154
66
        {
155
            /*
156
             * XXX: Corel Draw is known to produce incorrect
157
             * ExtraSamples tags which must be patched here if we
158
             * want to be able to open some of the damaged TIFF
159
             * files:
160
             */
161
66
            if (va[i] == EXTRASAMPLE_COREL_UNASSALPHA)
162
4
                va[i] = EXTRASAMPLE_UNASSALPHA;
163
62
            else
164
62
                return 0;
165
66
        }
166
14.5k
    }
167
168
13.5k
    if (td->td_transferfunction[0] != NULL &&
169
13.5k
        (td->td_samplesperpixel - *v > 1) &&
170
13.5k
        !(td->td_samplesperpixel - td->td_extrasamples > 1))
171
0
    {
172
0
        TIFFWarningExtR(tif, module,
173
0
                        "ExtraSamples tag value is changing, "
174
0
                        "but TransferFunction was read with a different value. "
175
0
                        "Canceling it");
176
0
        TIFFClrFieldBit(tif, FIELD_TRANSFERFUNCTION);
177
0
        _TIFFfreeExt(tif, td->td_transferfunction[0]);
178
0
        td->td_transferfunction[0] = NULL;
179
0
    }
180
181
13.5k
    td->td_extrasamples = (uint16_t)*v;
182
13.5k
    _TIFFsetShortArrayExt(tif, &td->td_sampleinfo, va, td->td_extrasamples);
183
13.5k
    return 1;
184
185
13.6k
#undef EXTRASAMPLE_COREL_UNASSALPHA
186
13.6k
}
187
188
/*
189
 * Count ink names separated by \0.  Returns
190
 * zero if the ink names are not as expected.
191
 */
192
static uint16_t countInkNamesString(TIFF *tif, uint32_t slen, const char *s)
193
122
{
194
122
    uint16_t i = 0;
195
196
122
    if (slen > 0)
197
104
    {
198
104
        const char *ep = s + slen;
199
104
        const char *cp = s;
200
104
        do
201
1.52k
        {
202
2.85k
            for (; cp < ep && *cp != '\0'; cp++)
203
1.33k
            {
204
1.33k
            }
205
1.52k
            if (cp >= ep)
206
0
                goto bad;
207
1.52k
            cp++; /* skip \0 */
208
1.52k
            i++;
209
1.52k
        } while (cp < ep);
210
104
        return (i);
211
104
    }
212
18
bad:
213
18
    TIFFErrorExtR(tif, "TIFFSetField",
214
18
                  "%s: Invalid InkNames value; no null at given buffer end "
215
18
                  "location %" PRIu32 ", after %" PRIu16 " ink",
216
18
                  tif->tif_name, slen, i);
217
18
    return (0);
218
122
}
219
220
static int _TIFFVSetField(TIFF *tif, uint32_t tag, va_list ap)
221
1.40M
{
222
1.40M
    static const char module[] = "_TIFFVSetField";
223
224
1.40M
    TIFFDirectory *td = &tif->tif_dir;
225
1.40M
    int status = 1;
226
1.40M
    uint32_t v32, v;
227
1.40M
    double dblval;
228
1.40M
    char *s;
229
1.40M
    const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
230
1.40M
    uint32_t standard_tag = tag;
231
1.40M
    if (fip == NULL) /* cannot happen since OkToChangeTag() already checks it */
232
0
        return 0;
233
    /*
234
     * We want to force the custom code to be used for custom
235
     * fields even if the tag happens to match a well known
236
     * one - important for reinterpreted handling of standard
237
     * tag values in custom directories (i.e. EXIF)
238
     */
239
1.40M
    if (fip->field_bit == FIELD_CUSTOM)
240
188k
    {
241
188k
        standard_tag = 0;
242
188k
    }
243
244
1.40M
    switch (standard_tag)
245
1.40M
    {
246
11.1k
        case TIFFTAG_SUBFILETYPE:
247
11.1k
            td->td_subfiletype = (uint32_t)va_arg(ap, uint32_t);
248
11.1k
            break;
249
119k
        case TIFFTAG_IMAGEWIDTH:
250
119k
            td->td_imagewidth = (uint32_t)va_arg(ap, uint32_t);
251
119k
            break;
252
114k
        case TIFFTAG_IMAGELENGTH:
253
114k
            td->td_imagelength = (uint32_t)va_arg(ap, uint32_t);
254
114k
            break;
255
85.8k
        case TIFFTAG_BITSPERSAMPLE:
256
85.8k
            td->td_bitspersample = (uint16_t)va_arg(ap, uint16_vap);
257
            /*
258
             * If the data require post-decoding processing to byte-swap
259
             * samples, set it up here.  Note that since tags are required
260
             * to be ordered, compression code can override this behavior
261
             * in the setup method if it wants to roll the post decoding
262
             * work in with its normal work.
263
             */
264
85.8k
            if (tif->tif_flags & TIFF_SWAB)
265
862
            {
266
862
                if (td->td_bitspersample == 8)
267
488
                    tif->tif_postdecode = _TIFFNoPostDecode;
268
374
                else if (td->td_bitspersample == 16)
269
65
                    tif->tif_postdecode = _TIFFSwab16BitData;
270
309
                else if (td->td_bitspersample == 24)
271
29
                    tif->tif_postdecode = _TIFFSwab24BitData;
272
280
                else if (td->td_bitspersample == 32)
273
57
                    tif->tif_postdecode = _TIFFSwab32BitData;
274
223
                else if (td->td_bitspersample == 64)
275
39
                    tif->tif_postdecode = _TIFFSwab64BitData;
276
184
                else if (td->td_bitspersample == 128) /* two 64's */
277
3
                    tif->tif_postdecode = _TIFFSwab64BitData;
278
862
            }
279
85.8k
            break;
280
288k
        case TIFFTAG_COMPRESSION:
281
288k
            v = (uint16_t)va_arg(ap, uint16_vap);
282
            /*
283
             * If we're changing the compression scheme, notify the
284
             * previous module so that it can cleanup any state it's
285
             * setup.
286
             */
287
288k
            if (TIFFFieldSet(tif, FIELD_COMPRESSION))
288
129k
            {
289
129k
                if ((uint32_t)td->td_compression == v)
290
34.9k
                    break;
291
94.9k
                (*tif->tif_cleanup)(tif);
292
94.9k
                tif->tif_flags &= ~TIFF_CODERSETUP;
293
94.9k
            }
294
            /*
295
             * Setup new compression routine state.
296
             */
297
253k
            if ((status = TIFFSetCompressionScheme(tif, v)) != 0)
298
253k
                td->td_compression = (uint16_t)v;
299
0
            else
300
0
                status = 0;
301
253k
            break;
302
107k
        case TIFFTAG_PHOTOMETRIC:
303
107k
            td->td_photometric = (uint16_t)va_arg(ap, uint16_vap);
304
107k
            break;
305
52
        case TIFFTAG_THRESHHOLDING:
306
52
            td->td_threshholding = (uint16_t)va_arg(ap, uint16_vap);
307
52
            break;
308
5.76k
        case TIFFTAG_FILLORDER:
309
5.76k
            v = (uint16_t)va_arg(ap, uint16_vap);
310
5.76k
            if (v != FILLORDER_LSB2MSB && v != FILLORDER_MSB2LSB)
311
73
                goto badvalue;
312
5.69k
            td->td_fillorder = (uint16_t)v;
313
5.69k
            break;
314
10.2k
        case TIFFTAG_ORIENTATION:
315
10.2k
            v = (uint16_t)va_arg(ap, uint16_vap);
316
10.2k
            if (v < ORIENTATION_TOPLEFT || ORIENTATION_LEFTBOT < v)
317
37
                goto badvalue;
318
10.1k
            else
319
10.1k
                td->td_orientation = (uint16_t)v;
320
10.1k
            break;
321
86.0k
        case TIFFTAG_SAMPLESPERPIXEL:
322
86.0k
            v = (uint16_t)va_arg(ap, uint16_vap);
323
86.0k
            if (v == 0)
324
4
                goto badvalue;
325
86.0k
            if (v != td->td_samplesperpixel)
326
59.8k
            {
327
                /* See http://bugzilla.maptools.org/show_bug.cgi?id=2500 */
328
59.8k
                if (td->td_sminsamplevalue != NULL)
329
3
                {
330
3
                    TIFFWarningExtR(tif, module,
331
3
                                    "SamplesPerPixel tag value is changing, "
332
3
                                    "but SMinSampleValue tag was read with a "
333
3
                                    "different value. Canceling it");
334
3
                    TIFFClrFieldBit(tif, FIELD_SMINSAMPLEVALUE);
335
3
                    _TIFFfreeExt(tif, td->td_sminsamplevalue);
336
3
                    td->td_sminsamplevalue = NULL;
337
3
                }
338
59.8k
                if (td->td_smaxsamplevalue != NULL)
339
4
                {
340
4
                    TIFFWarningExtR(tif, module,
341
4
                                    "SamplesPerPixel tag value is changing, "
342
4
                                    "but SMaxSampleValue tag was read with a "
343
4
                                    "different value. Canceling it");
344
4
                    TIFFClrFieldBit(tif, FIELD_SMAXSAMPLEVALUE);
345
4
                    _TIFFfreeExt(tif, td->td_smaxsamplevalue);
346
4
                    td->td_smaxsamplevalue = NULL;
347
4
                }
348
                /* Test if 3 transfer functions instead of just one are now
349
                   needed See http://bugzilla.maptools.org/show_bug.cgi?id=2820
350
                 */
351
59.8k
                if (td->td_transferfunction[0] != NULL &&
352
59.8k
                    (v - td->td_extrasamples > 1) &&
353
59.8k
                    !(td->td_samplesperpixel - td->td_extrasamples > 1))
354
3
                {
355
3
                    TIFFWarningExtR(tif, module,
356
3
                                    "SamplesPerPixel tag value is changing, "
357
3
                                    "but TransferFunction was read with a "
358
3
                                    "different value. Canceling it");
359
3
                    TIFFClrFieldBit(tif, FIELD_TRANSFERFUNCTION);
360
3
                    _TIFFfreeExt(tif, td->td_transferfunction[0]);
361
3
                    td->td_transferfunction[0] = NULL;
362
3
                }
363
59.8k
            }
364
86.0k
            td->td_samplesperpixel = (uint16_t)v;
365
86.0k
            break;
366
73.0k
        case TIFFTAG_ROWSPERSTRIP:
367
73.0k
            v32 = (uint32_t)va_arg(ap, uint32_t);
368
73.0k
            if (v32 == 0)
369
9
                goto badvalue32;
370
73.0k
            td->td_rowsperstrip = v32;
371
73.0k
            if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS))
372
72.8k
            {
373
72.8k
                td->td_tilelength = v32;
374
72.8k
                td->td_tilewidth = td->td_imagewidth;
375
72.8k
            }
376
73.0k
            break;
377
322
        case TIFFTAG_MINSAMPLEVALUE:
378
322
            td->td_minsamplevalue = (uint16_t)va_arg(ap, uint16_vap);
379
322
            break;
380
1.06k
        case TIFFTAG_MAXSAMPLEVALUE:
381
1.06k
            td->td_maxsamplevalue = (uint16_t)va_arg(ap, uint16_vap);
382
1.06k
            break;
383
578
        case TIFFTAG_SMINSAMPLEVALUE:
384
578
            if (tif->tif_flags & TIFF_PERSAMPLE)
385
578
                _TIFFsetDoubleArrayExt(tif, &td->td_sminsamplevalue,
386
578
                                       va_arg(ap, double *),
387
578
                                       td->td_samplesperpixel);
388
0
            else
389
0
                setDoubleArrayOneValue(tif, &td->td_sminsamplevalue,
390
0
                                       va_arg(ap, double),
391
0
                                       td->td_samplesperpixel);
392
578
            break;
393
841
        case TIFFTAG_SMAXSAMPLEVALUE:
394
841
            if (tif->tif_flags & TIFF_PERSAMPLE)
395
841
                _TIFFsetDoubleArrayExt(tif, &td->td_smaxsamplevalue,
396
841
                                       va_arg(ap, double *),
397
841
                                       td->td_samplesperpixel);
398
0
            else
399
0
                setDoubleArrayOneValue(tif, &td->td_smaxsamplevalue,
400
0
                                       va_arg(ap, double),
401
0
                                       td->td_samplesperpixel);
402
841
            break;
403
6.38k
        case TIFFTAG_XRESOLUTION:
404
6.38k
            dblval = va_arg(ap, double);
405
6.38k
            if (dblval != dblval || dblval < 0)
406
44
                goto badvaluedouble;
407
6.33k
            td->td_xresolution = _TIFFClampDoubleToFloat(dblval);
408
6.33k
            break;
409
6.45k
        case TIFFTAG_YRESOLUTION:
410
6.45k
            dblval = va_arg(ap, double);
411
6.45k
            if (dblval != dblval || dblval < 0)
412
75
                goto badvaluedouble;
413
6.37k
            td->td_yresolution = _TIFFClampDoubleToFloat(dblval);
414
6.37k
            break;
415
158k
        case TIFFTAG_PLANARCONFIG:
416
158k
            v = (uint16_t)va_arg(ap, uint16_vap);
417
158k
            if (v != PLANARCONFIG_CONTIG && v != PLANARCONFIG_SEPARATE)
418
27
                goto badvalue;
419
158k
            td->td_planarconfig = (uint16_t)v;
420
158k
            break;
421
870
        case TIFFTAG_XPOSITION:
422
870
            td->td_xposition = _TIFFClampDoubleToFloat(va_arg(ap, double));
423
870
            break;
424
375
        case TIFFTAG_YPOSITION:
425
375
            td->td_yposition = _TIFFClampDoubleToFloat(va_arg(ap, double));
426
375
            break;
427
6.31k
        case TIFFTAG_RESOLUTIONUNIT:
428
6.31k
            v = (uint16_t)va_arg(ap, uint16_vap);
429
6.31k
            if (v < RESUNIT_NONE || RESUNIT_CENTIMETER < v)
430
67
                goto badvalue;
431
6.24k
            td->td_resolutionunit = (uint16_t)v;
432
6.24k
            break;
433
20.2k
        case TIFFTAG_PAGENUMBER:
434
20.2k
            td->td_pagenumber[0] = (uint16_t)va_arg(ap, uint16_vap);
435
20.2k
            td->td_pagenumber[1] = (uint16_t)va_arg(ap, uint16_vap);
436
20.2k
            break;
437
28
        case TIFFTAG_HALFTONEHINTS:
438
28
            td->td_halftonehints[0] = (uint16_t)va_arg(ap, uint16_vap);
439
28
            td->td_halftonehints[1] = (uint16_t)va_arg(ap, uint16_vap);
440
28
            break;
441
2.51k
        case TIFFTAG_COLORMAP:
442
2.51k
            v32 = (uint32_t)(1L << td->td_bitspersample);
443
2.51k
            _TIFFsetShortArrayExt(tif, &td->td_colormap[0],
444
2.51k
                                  va_arg(ap, uint16_t *), v32);
445
2.51k
            _TIFFsetShortArrayExt(tif, &td->td_colormap[1],
446
2.51k
                                  va_arg(ap, uint16_t *), v32);
447
2.51k
            _TIFFsetShortArrayExt(tif, &td->td_colormap[2],
448
2.51k
                                  va_arg(ap, uint16_t *), v32);
449
2.51k
            break;
450
13.6k
        case TIFFTAG_EXTRASAMPLES:
451
13.6k
            if (!setExtraSamples(tif, ap, &v))
452
102
                goto badvalue;
453
13.5k
            break;
454
13.5k
        case TIFFTAG_MATTEING:
455
40
            td->td_extrasamples = (((uint16_t)va_arg(ap, uint16_vap)) != 0);
456
40
            if (td->td_extrasamples)
457
12
            {
458
12
                uint16_t sv = EXTRASAMPLE_ASSOCALPHA;
459
12
                _TIFFsetShortArrayExt(tif, &td->td_sampleinfo, &sv, 1);
460
12
            }
461
40
            break;
462
13.5k
        case TIFFTAG_TILEWIDTH:
463
13.5k
            v32 = (uint32_t)va_arg(ap, uint32_t);
464
13.5k
            if (v32 % 16)
465
11.7k
            {
466
11.7k
                if (tif->tif_mode != O_RDONLY)
467
0
                    goto badvalue32;
468
11.7k
                TIFFWarningExtR(
469
11.7k
                    tif, tif->tif_name,
470
11.7k
                    "Nonstandard tile width %" PRIu32 ", convert file", v32);
471
11.7k
            }
472
13.5k
            td->td_tilewidth = v32;
473
13.5k
            tif->tif_flags |= TIFF_ISTILED;
474
13.5k
            break;
475
11.7k
        case TIFFTAG_TILELENGTH:
476
11.7k
            v32 = (uint32_t)va_arg(ap, uint32_t);
477
11.7k
            if (v32 % 16)
478
10.0k
            {
479
10.0k
                if (tif->tif_mode != O_RDONLY)
480
0
                    goto badvalue32;
481
10.0k
                TIFFWarningExtR(
482
10.0k
                    tif, tif->tif_name,
483
10.0k
                    "Nonstandard tile length %" PRIu32 ", convert file", v32);
484
10.0k
            }
485
11.7k
            td->td_tilelength = v32;
486
11.7k
            tif->tif_flags |= TIFF_ISTILED;
487
11.7k
            break;
488
177
        case TIFFTAG_TILEDEPTH:
489
177
            v32 = (uint32_t)va_arg(ap, uint32_t);
490
177
            if (v32 == 0)
491
3
                goto badvalue32;
492
174
            td->td_tiledepth = v32;
493
174
            break;
494
25
        case TIFFTAG_DATATYPE:
495
25
            v = (uint16_t)va_arg(ap, uint16_vap);
496
25
            switch (v)
497
25
            {
498
4
                case DATATYPE_VOID:
499
4
                    v = SAMPLEFORMAT_VOID;
500
4
                    break;
501
11
                case DATATYPE_INT:
502
11
                    v = SAMPLEFORMAT_INT;
503
11
                    break;
504
4
                case DATATYPE_UINT:
505
4
                    v = SAMPLEFORMAT_UINT;
506
4
                    break;
507
3
                case DATATYPE_IEEEFP:
508
3
                    v = SAMPLEFORMAT_IEEEFP;
509
3
                    break;
510
3
                default:
511
3
                    goto badvalue;
512
25
            }
513
22
            td->td_sampleformat = (uint16_t)v;
514
22
            break;
515
65.3k
        case TIFFTAG_SAMPLEFORMAT:
516
65.3k
            v = (uint16_t)va_arg(ap, uint16_vap);
517
65.3k
            if (v < SAMPLEFORMAT_UINT || SAMPLEFORMAT_COMPLEXIEEEFP < v)
518
28
                goto badvalue;
519
65.3k
            td->td_sampleformat = (uint16_t)v;
520
521
            /*  Try to fix up the SWAB function for complex data. */
522
65.3k
            if (td->td_sampleformat == SAMPLEFORMAT_COMPLEXINT &&
523
65.3k
                td->td_bitspersample == 32 &&
524
65.3k
                tif->tif_postdecode == _TIFFSwab32BitData)
525
3
                tif->tif_postdecode = _TIFFSwab16BitData;
526
65.3k
            else if ((td->td_sampleformat == SAMPLEFORMAT_COMPLEXINT ||
527
65.3k
                      td->td_sampleformat == SAMPLEFORMAT_COMPLEXIEEEFP) &&
528
65.3k
                     td->td_bitspersample == 64 &&
529
65.3k
                     tif->tif_postdecode == _TIFFSwab64BitData)
530
3
                tif->tif_postdecode = _TIFFSwab32BitData;
531
65.3k
            break;
532
32
        case TIFFTAG_IMAGEDEPTH:
533
32
            td->td_imagedepth = (uint32_t)va_arg(ap, uint32_t);
534
32
            break;
535
255
        case TIFFTAG_SUBIFD:
536
255
            if ((tif->tif_flags & TIFF_INSUBIFD) == 0)
537
255
            {
538
255
                td->td_nsubifd = (uint16_t)va_arg(ap, uint16_vap);
539
255
                _TIFFsetLong8Array(tif, &td->td_subifd,
540
255
                                   (uint64_t *)va_arg(ap, uint64_t *),
541
255
                                   (uint32_t)td->td_nsubifd);
542
255
            }
543
0
            else
544
0
            {
545
0
                TIFFErrorExtR(tif, module, "%s: Sorry, cannot nest SubIFDs",
546
0
                              tif->tif_name);
547
0
                status = 0;
548
0
            }
549
255
            break;
550
84
        case TIFFTAG_YCBCRPOSITIONING:
551
84
            td->td_ycbcrpositioning = (uint16_t)va_arg(ap, uint16_vap);
552
84
            break;
553
1.12k
        case TIFFTAG_YCBCRSUBSAMPLING:
554
1.12k
            td->td_ycbcrsubsampling[0] = (uint16_t)va_arg(ap, uint16_vap);
555
1.12k
            td->td_ycbcrsubsampling[1] = (uint16_t)va_arg(ap, uint16_vap);
556
1.12k
            break;
557
19
        case TIFFTAG_TRANSFERFUNCTION:
558
19
        {
559
19
            uint32_t i;
560
19
            v = (td->td_samplesperpixel - td->td_extrasamples) > 1 ? 3 : 1;
561
46
            for (i = 0; i < v; i++)
562
27
                _TIFFsetShortArrayExt(tif, &td->td_transferfunction[i],
563
27
                                      va_arg(ap, uint16_t *),
564
27
                                      1U << td->td_bitspersample);
565
19
            break;
566
65.3k
        }
567
6.76k
        case TIFFTAG_REFERENCEBLACKWHITE:
568
            /* XXX should check for null range */
569
6.76k
            _TIFFsetFloatArrayExt(tif, &td->td_refblackwhite,
570
6.76k
                                  va_arg(ap, float *), 6);
571
6.76k
            break;
572
122
        case TIFFTAG_INKNAMES:
573
122
        {
574
122
            v = (uint16_t)va_arg(ap, uint16_vap);
575
122
            s = va_arg(ap, char *);
576
122
            uint16_t ninksinstring;
577
122
            ninksinstring = countInkNamesString(tif, v, s);
578
122
            status = ninksinstring > 0;
579
122
            if (ninksinstring > 0)
580
104
            {
581
104
                _TIFFsetNString(tif, &td->td_inknames, s, v);
582
104
                td->td_inknameslen = v;
583
                /* Set NumberOfInks to the value ninksinstring */
584
104
                if (TIFFFieldSet(tif, FIELD_NUMBEROFINKS))
585
7
                {
586
7
                    if (td->td_numberofinks != ninksinstring)
587
4
                    {
588
4
                        TIFFErrorExtR(
589
4
                            tif, module,
590
4
                            "Warning %s; Tag %s:\n  Value %" PRIu16
591
4
                            " of NumberOfInks is different from the number of "
592
4
                            "inks %" PRIu16
593
4
                            ".\n  -> NumberOfInks value adapted to %" PRIu16 "",
594
4
                            tif->tif_name, fip->field_name, td->td_numberofinks,
595
4
                            ninksinstring, ninksinstring);
596
4
                        td->td_numberofinks = ninksinstring;
597
4
                    }
598
7
                }
599
97
                else
600
97
                {
601
97
                    td->td_numberofinks = ninksinstring;
602
97
                    TIFFSetFieldBit(tif, FIELD_NUMBEROFINKS);
603
97
                }
604
104
                if (TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL))
605
19
                {
606
19
                    if (td->td_numberofinks != td->td_samplesperpixel)
607
15
                    {
608
15
                        TIFFErrorExtR(tif, module,
609
15
                                      "Warning %s; Tag %s:\n  Value %" PRIu16
610
15
                                      " of NumberOfInks is different from the "
611
15
                                      "SamplesPerPixel value %" PRIu16 "",
612
15
                                      tif->tif_name, fip->field_name,
613
15
                                      td->td_numberofinks,
614
15
                                      td->td_samplesperpixel);
615
15
                    }
616
19
                }
617
104
            }
618
122
        }
619
122
        break;
620
36
        case TIFFTAG_NUMBEROFINKS:
621
36
            v = (uint16_t)va_arg(ap, uint16_vap);
622
            /* If InkNames already set also NumberOfInks is set accordingly and
623
             * should be equal */
624
36
            if (TIFFFieldSet(tif, FIELD_INKNAMES))
625
6
            {
626
6
                if (v != td->td_numberofinks)
627
3
                {
628
3
                    TIFFErrorExtR(
629
3
                        tif, module,
630
3
                        "Error %s; Tag %s:\n  It is not possible to set the "
631
3
                        "value %" PRIu32
632
3
                        " for NumberOfInks\n  which is different from the "
633
3
                        "number of inks in the InkNames tag (%" PRIu16 ")",
634
3
                        tif->tif_name, fip->field_name, v, td->td_numberofinks);
635
                    /* Do not set / overwrite number of inks already set by
636
                     * InkNames case accordingly. */
637
3
                    status = 0;
638
3
                }
639
6
            }
640
30
            else
641
30
            {
642
30
                td->td_numberofinks = (uint16_t)v;
643
30
                if (TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL))
644
16
                {
645
16
                    if (td->td_numberofinks != td->td_samplesperpixel)
646
10
                    {
647
10
                        TIFFErrorExtR(tif, module,
648
10
                                      "Warning %s; Tag %s:\n  Value %" PRIu32
649
10
                                      " of NumberOfInks is different from the "
650
10
                                      "SamplesPerPixel value %" PRIu16 "",
651
10
                                      tif->tif_name, fip->field_name, v,
652
10
                                      td->td_samplesperpixel);
653
10
                    }
654
16
                }
655
30
            }
656
36
            break;
657
0
        case TIFFTAG_PERSAMPLE:
658
0
            v = (uint16_t)va_arg(ap, uint16_vap);
659
0
            if (v == PERSAMPLE_MULTI)
660
0
                tif->tif_flags |= TIFF_PERSAMPLE;
661
0
            else
662
0
                tif->tif_flags &= ~TIFF_PERSAMPLE;
663
0
            break;
664
188k
        default:
665
188k
        {
666
188k
            TIFFTagValue *tv;
667
188k
            int tv_size, iCustom;
668
669
            /*
670
             * This can happen if multiple images are open with different
671
             * codecs which have private tags.  The global tag information
672
             * table may then have tags that are valid for one file but not
673
             * the other. If the client tries to set a tag that is not valid
674
             * for the image's codec then we'll arrive here.  This
675
             * happens, for example, when tiffcp is used to convert between
676
             * compression schemes and codec-specific tags are blindly copied.
677
             *
678
             * This also happens when a FIELD_IGNORE tag is written.
679
             */
680
188k
            if (fip->field_bit == FIELD_IGNORE)
681
0
            {
682
0
                TIFFErrorExtR(
683
0
                    tif, module,
684
0
                    "%s: Ignored %stag \"%s\" (not supported by libtiff)",
685
0
                    tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
686
0
                    fip->field_name);
687
0
                status = 0;
688
0
                break;
689
0
            }
690
188k
            if (fip->field_bit != FIELD_CUSTOM)
691
0
            {
692
0
                TIFFErrorExtR(
693
0
                    tif, module,
694
0
                    "%s: Invalid %stag \"%s\" (not supported by codec)",
695
0
                    tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
696
0
                    fip->field_name);
697
0
                status = 0;
698
0
                break;
699
0
            }
700
701
            /*
702
             * Find the existing entry for this custom value.
703
             */
704
188k
            tv = NULL;
705
2.02M
            for (iCustom = 0; iCustom < td->td_customValueCount; iCustom++)
706
1.83M
            {
707
1.83M
                if (td->td_customValues[iCustom].info->field_tag == tag)
708
0
                {
709
0
                    tv = td->td_customValues + iCustom;
710
0
                    if (tv->value != NULL)
711
0
                    {
712
0
                        _TIFFfreeExt(tif, tv->value);
713
0
                        tv->value = NULL;
714
0
                    }
715
0
                    break;
716
0
                }
717
1.83M
            }
718
719
            /*
720
             * Grow the custom list if the entry was not found.
721
             */
722
188k
            if (tv == NULL)
723
188k
            {
724
188k
                TIFFTagValue *new_customValues;
725
726
188k
                new_customValues = (TIFFTagValue *)_TIFFreallocExt(
727
188k
                    tif, td->td_customValues,
728
188k
                    sizeof(TIFFTagValue) * (td->td_customValueCount + 1));
729
188k
                if (!new_customValues)
730
0
                {
731
0
                    TIFFErrorExtR(tif, module,
732
0
                                  "%s: Failed to allocate space for list of "
733
0
                                  "custom values",
734
0
                                  tif->tif_name);
735
0
                    status = 0;
736
0
                    goto end;
737
0
                }
738
739
188k
                td->td_customValueCount++;
740
188k
                td->td_customValues = new_customValues;
741
742
188k
                tv = td->td_customValues + (td->td_customValueCount - 1);
743
188k
                tv->info = fip;
744
188k
                tv->value = NULL;
745
188k
                tv->count = 0;
746
188k
            }
747
748
            /*
749
             * Set custom value ... save a copy of the custom tag value.
750
             */
751
            /*--: Rational2Double: For Rationals evaluate "set_get_field_type"
752
             * to determine internal storage size. */
753
188k
            tv_size = TIFFFieldSetGetSize(fip);
754
188k
            if (tv_size == 0)
755
0
            {
756
0
                status = 0;
757
0
                TIFFErrorExtR(tif, module, "%s: Bad field type %d for \"%s\"",
758
0
                              tif->tif_name, fip->field_type, fip->field_name);
759
0
                goto end;
760
0
            }
761
762
188k
            if (fip->field_type == TIFF_ASCII)
763
97.4k
            {
764
97.4k
                uint32_t ma;
765
97.4k
                const char *mb;
766
97.4k
                if (fip->field_passcount)
767
18.7k
                {
768
18.7k
                    assert(fip->field_writecount == TIFF_VARIABLE2);
769
18.7k
                    ma = (uint32_t)va_arg(ap, uint32_t);
770
18.7k
                    mb = (const char *)va_arg(ap, const char *);
771
18.7k
                }
772
78.6k
                else
773
78.6k
                {
774
78.6k
                    mb = (const char *)va_arg(ap, const char *);
775
78.6k
                    size_t len = strlen(mb) + 1;
776
78.6k
                    if (len >= 0x80000000U)
777
0
                    {
778
0
                        status = 0;
779
0
                        TIFFErrorExtR(tif, module,
780
0
                                      "%s: Too long string value for \"%s\". "
781
0
                                      "Maximum supported is 2147483647 bytes",
782
0
                                      tif->tif_name, fip->field_name);
783
0
                        goto end;
784
0
                    }
785
78.6k
                    ma = (uint32_t)len;
786
78.6k
                }
787
97.4k
                tv->count = ma;
788
97.4k
                setByteArray(tif, &tv->value, mb, ma, 1);
789
97.4k
            }
790
91.3k
            else
791
91.3k
            {
792
91.3k
                if (fip->field_passcount)
793
83.3k
                {
794
83.3k
                    if (fip->field_writecount == TIFF_VARIABLE2)
795
80.4k
                        tv->count = (uint32_t)va_arg(ap, uint32_t);
796
2.92k
                    else
797
2.92k
                        tv->count = (int)va_arg(ap, int);
798
83.3k
                }
799
7.94k
                else if (fip->field_writecount == TIFF_VARIABLE ||
800
7.94k
                         fip->field_writecount == TIFF_VARIABLE2)
801
0
                    tv->count = 1;
802
7.94k
                else if (fip->field_writecount == TIFF_SPP)
803
0
                    tv->count = td->td_samplesperpixel;
804
7.94k
                else
805
7.94k
                    tv->count = fip->field_writecount;
806
807
91.3k
                if (tv->count == 0)
808
3.80k
                {
809
3.80k
                    TIFFWarningExtR(tif, module,
810
3.80k
                                    "%s: Null count for \"%s\" (type "
811
3.80k
                                    "%d, writecount %d, passcount %d)",
812
3.80k
                                    tif->tif_name, fip->field_name,
813
3.80k
                                    fip->field_type, fip->field_writecount,
814
3.80k
                                    fip->field_passcount);
815
3.80k
                    break;
816
3.80k
                }
817
818
87.5k
                tv->value = _TIFFCheckMalloc(tif, tv->count, tv_size,
819
87.5k
                                             "custom tag binary object");
820
87.5k
                if (!tv->value)
821
0
                {
822
0
                    status = 0;
823
0
                    goto end;
824
0
                }
825
826
87.5k
                if (fip->field_tag == TIFFTAG_DOTRANGE &&
827
87.5k
                    strcmp(fip->field_name, "DotRange") == 0)
828
28
                {
829
                    /* TODO: This is an evil exception and should not have been
830
                       handled this way ... likely best if we move it into
831
                       the directory structure with an explicit field in
832
                       libtiff 4.1 and assign it a FIELD_ value */
833
28
                    uint16_t v2[2];
834
28
                    v2[0] = (uint16_t)va_arg(ap, int);
835
28
                    v2[1] = (uint16_t)va_arg(ap, int);
836
28
                    _TIFFmemcpy(tv->value, &v2, 4);
837
28
                }
838
839
87.4k
                else if (fip->field_passcount ||
840
87.4k
                         fip->field_writecount == TIFF_VARIABLE ||
841
87.4k
                         fip->field_writecount == TIFF_VARIABLE2 ||
842
87.4k
                         fip->field_writecount == TIFF_SPP || tv->count > 1)
843
81.2k
                {
844
                    /*--: Rational2Double: For Rationals tv_size is set above to
845
                     * 4 or 8 according to fip->set_get_field_type! */
846
81.2k
                    _TIFFmemcpy(tv->value, va_arg(ap, void *),
847
81.2k
                                tv->count * tv_size);
848
                    /* Test here for too big values for LONG8, SLONG8 in
849
                     * ClassicTIFF and delete custom field from custom list */
850
81.2k
                    if (!(tif->tif_flags & TIFF_BIGTIFF))
851
80.9k
                    {
852
80.9k
                        if (tv->info->field_type == TIFF_LONG8)
853
340
                        {
854
340
                            uint64_t *pui64 = (uint64_t *)tv->value;
855
1.29k
                            for (int i = 0; i < tv->count; i++)
856
1.24k
                            {
857
1.24k
                                if (pui64[i] > 0xffffffffu)
858
286
                                {
859
286
                                    TIFFErrorExtR(
860
286
                                        tif, module,
861
286
                                        "%s: Bad LONG8 value %" PRIu64
862
286
                                        " at %d. array position for \"%s\" tag "
863
286
                                        "%d in ClassicTIFF. Tag won't be "
864
286
                                        "written to file",
865
286
                                        tif->tif_name, pui64[i], i,
866
286
                                        fip->field_name, tag);
867
286
                                    goto badvalueifd8long8;
868
286
                                }
869
1.24k
                            }
870
340
                        }
871
80.6k
                        else if (tv->info->field_type == TIFF_SLONG8)
872
757
                        {
873
757
                            int64_t *pi64 = (int64_t *)tv->value;
874
1.84k
                            for (int i = 0; i < tv->count; i++)
875
1.71k
                            {
876
1.71k
                                if (pi64[i] > 2147483647 ||
877
1.71k
                                    pi64[i] < (-2147483647 - 1))
878
628
                                {
879
628
                                    TIFFErrorExtR(
880
628
                                        tif, module,
881
628
                                        "%s: Bad SLONG8 value %" PRIi64
882
628
                                        " at %d. array position for \"%s\" tag "
883
628
                                        "%d in ClassicTIFF. Tag won't be "
884
628
                                        "written to file",
885
628
                                        tif->tif_name, pi64[i], i,
886
628
                                        fip->field_name, tag);
887
628
                                    goto badvalueifd8long8;
888
628
                                }
889
1.71k
                            }
890
757
                        }
891
80.9k
                    }
892
81.2k
                }
893
6.20k
                else
894
6.20k
                {
895
6.20k
                    char *val = (char *)tv->value;
896
6.20k
                    assert(tv->count == 1);
897
898
6.20k
                    switch (fip->field_type)
899
6.20k
                    {
900
117
                        case TIFF_BYTE:
901
117
                        case TIFF_UNDEFINED:
902
117
                        {
903
117
                            uint8_t v2 = (uint8_t)va_arg(ap, int);
904
117
                            _TIFFmemcpy(val, &v2, tv_size);
905
117
                        }
906
117
                        break;
907
0
                        case TIFF_SBYTE:
908
0
                        {
909
0
                            int8_t v2 = (int8_t)va_arg(ap, int);
910
0
                            _TIFFmemcpy(val, &v2, tv_size);
911
0
                        }
912
0
                        break;
913
3.70k
                        case TIFF_SHORT:
914
3.70k
                        {
915
3.70k
                            uint16_t v2 = (uint16_t)va_arg(ap, int);
916
3.70k
                            _TIFFmemcpy(val, &v2, tv_size);
917
3.70k
                        }
918
3.70k
                        break;
919
0
                        case TIFF_SSHORT:
920
0
                        {
921
0
                            int16_t v2 = (int16_t)va_arg(ap, int);
922
0
                            _TIFFmemcpy(val, &v2, tv_size);
923
0
                        }
924
0
                        break;
925
299
                        case TIFF_LONG:
926
299
                        case TIFF_IFD:
927
299
                        {
928
299
                            uint32_t v2 = va_arg(ap, uint32_t);
929
299
                            _TIFFmemcpy(val, &v2, tv_size);
930
299
                        }
931
299
                        break;
932
0
                        case TIFF_SLONG:
933
0
                        {
934
0
                            int32_t v2 = va_arg(ap, int32_t);
935
0
                            _TIFFmemcpy(val, &v2, tv_size);
936
0
                        }
937
0
                        break;
938
0
                        case TIFF_LONG8:
939
682
                        case TIFF_IFD8:
940
682
                        {
941
682
                            uint64_t v2 = va_arg(ap, uint64_t);
942
682
                            _TIFFmemcpy(val, &v2, tv_size);
943
                            /* Test here for too big values for ClassicTIFF and
944
                             * delete custom field from custom list */
945
682
                            if (!(tif->tif_flags & TIFF_BIGTIFF) &&
946
682
                                (v2 > 0xffffffffu))
947
65
                            {
948
65
                                TIFFErrorExtR(
949
65
                                    tif, module,
950
65
                                    "%s: Bad LONG8 or IFD8 value %" PRIu64
951
65
                                    " for \"%s\" tag %d in ClassicTIFF. Tag "
952
65
                                    "won't be written to file",
953
65
                                    tif->tif_name, v2, fip->field_name, tag);
954
65
                                goto badvalueifd8long8;
955
65
                            }
956
682
                        }
957
617
                        break;
958
617
                        case TIFF_SLONG8:
959
0
                        {
960
0
                            int64_t v2 = va_arg(ap, int64_t);
961
0
                            _TIFFmemcpy(val, &v2, tv_size);
962
                            /* Test here for too big values for ClassicTIFF and
963
                             * delete custom field from custom list */
964
0
                            if (!(tif->tif_flags & TIFF_BIGTIFF) &&
965
0
                                ((v2 > 2147483647) || (v2 < (-2147483647 - 1))))
966
0
                            {
967
0
                                TIFFErrorExtR(
968
0
                                    tif, module,
969
0
                                    "%s: Bad SLONG8 value %" PRIi64
970
0
                                    " for \"%s\" tag %d in ClassicTIFF. Tag "
971
0
                                    "won't be written to file",
972
0
                                    tif->tif_name, v2, fip->field_name, tag);
973
0
                                goto badvalueifd8long8;
974
0
                            }
975
0
                        }
976
0
                        break;
977
1.00k
                        case TIFF_RATIONAL:
978
1.30k
                        case TIFF_SRATIONAL:
979
                            /*-- Rational2Double: For Rationals tv_size is set
980
                             * above to 4 or 8 according to
981
                             * fip->set_get_field_type!
982
                             */
983
1.30k
                            {
984
1.30k
                                if (tv_size == 8)
985
0
                                {
986
0
                                    double v2 = va_arg(ap, double);
987
0
                                    _TIFFmemcpy(val, &v2, tv_size);
988
0
                                }
989
1.30k
                                else
990
1.30k
                                {
991
                                    /*-- default should be tv_size == 4 */
992
1.30k
                                    float v3 = (float)va_arg(ap, double);
993
1.30k
                                    _TIFFmemcpy(val, &v3, tv_size);
994
                                    /*-- ToDo: After Testing, this should be
995
                                     * removed and tv_size==4 should be set as
996
                                     * default. */
997
1.30k
                                    if (tv_size != 4)
998
0
                                    {
999
0
                                        TIFFErrorExtR(tif, module,
1000
0
                                                      "Rational2Double: "
1001
0
                                                      ".set_get_field_type "
1002
0
                                                      "in not 4 but %d",
1003
0
                                                      tv_size);
1004
0
                                    }
1005
1.30k
                                }
1006
1.30k
                            }
1007
1.30k
                            break;
1008
51
                        case TIFF_FLOAT:
1009
51
                        {
1010
51
                            float v2 =
1011
51
                                _TIFFClampDoubleToFloat(va_arg(ap, double));
1012
51
                            _TIFFmemcpy(val, &v2, tv_size);
1013
51
                        }
1014
51
                        break;
1015
46
                        case TIFF_DOUBLE:
1016
46
                        {
1017
46
                            double v2 = va_arg(ap, double);
1018
46
                            _TIFFmemcpy(val, &v2, tv_size);
1019
46
                        }
1020
46
                        break;
1021
0
                        default:
1022
0
                            _TIFFmemset(val, 0, tv_size);
1023
0
                            status = 0;
1024
0
                            break;
1025
6.20k
                    }
1026
6.20k
                }
1027
87.5k
            }
1028
188k
        }
1029
1.40M
    }
1030
1.40M
    if (status)
1031
1.40M
    {
1032
1.40M
        const TIFFField *fip2 = TIFFFieldWithTag(tif, tag);
1033
1.40M
        if (fip2)
1034
1.40M
            TIFFSetFieldBit(tif, fip2->field_bit);
1035
1.40M
        tif->tif_flags |= TIFF_DIRTYDIRECT;
1036
1.40M
    }
1037
1038
1.40M
end:
1039
1.40M
    va_end(ap);
1040
1.40M
    return (status);
1041
341
badvalue:
1042
341
{
1043
341
    const TIFFField *fip2 = TIFFFieldWithTag(tif, tag);
1044
341
    TIFFErrorExtR(tif, module, "%s: Bad value %" PRIu32 " for \"%s\" tag",
1045
341
                  tif->tif_name, v, fip2 ? fip2->field_name : "Unknown");
1046
341
    va_end(ap);
1047
341
}
1048
341
    return (0);
1049
12
badvalue32:
1050
12
{
1051
12
    const TIFFField *fip2 = TIFFFieldWithTag(tif, tag);
1052
12
    TIFFErrorExtR(tif, module, "%s: Bad value %" PRIu32 " for \"%s\" tag",
1053
12
                  tif->tif_name, v32, fip2 ? fip2->field_name : "Unknown");
1054
12
    va_end(ap);
1055
12
}
1056
12
    return (0);
1057
119
badvaluedouble:
1058
119
{
1059
119
    const TIFFField *fip2 = TIFFFieldWithTag(tif, tag);
1060
119
    TIFFErrorExtR(tif, module, "%s: Bad value %f for \"%s\" tag", tif->tif_name,
1061
119
                  dblval, fip2 ? fip2->field_name : "Unknown");
1062
119
    va_end(ap);
1063
119
}
1064
119
    return (0);
1065
979
badvalueifd8long8:
1066
979
{
1067
    /* Error message issued already above. */
1068
979
    TIFFTagValue *tv2 = NULL;
1069
979
    int iCustom2, iC2;
1070
    /* Find the existing entry for this custom value. */
1071
7.59k
    for (iCustom2 = 0; iCustom2 < td->td_customValueCount; iCustom2++)
1072
7.59k
    {
1073
7.59k
        if (td->td_customValues[iCustom2].info->field_tag == tag)
1074
979
        {
1075
979
            tv2 = td->td_customValues + (iCustom2);
1076
979
            break;
1077
979
        }
1078
7.59k
    }
1079
979
    if (tv2 != NULL)
1080
979
    {
1081
        /* Remove custom field from custom list */
1082
979
        if (tv2->value != NULL)
1083
979
        {
1084
979
            _TIFFfreeExt(tif, tv2->value);
1085
979
            tv2->value = NULL;
1086
979
        }
1087
        /* Shorten list and close gap in customValues list.
1088
         * Re-allocation of td_customValues not necessary here. */
1089
979
        td->td_customValueCount--;
1090
979
        for (iC2 = iCustom2; iC2 < td->td_customValueCount; iC2++)
1091
0
        {
1092
0
            td->td_customValues[iC2] = td->td_customValues[iC2 + 1];
1093
0
        }
1094
979
    }
1095
0
    else
1096
0
    {
1097
0
        assert(0);
1098
0
    }
1099
979
    va_end(ap);
1100
979
}
1101
0
    return (0);
1102
979
} /*-- _TIFFVSetField() --*/
1103
1104
/*
1105
 * Return 1/0 according to whether or not
1106
 * it is permissible to set the tag's value.
1107
 * Note that we allow ImageLength to be changed
1108
 * so that we can append and extend to images.
1109
 * Any other tag may not be altered once writing
1110
 * has commenced, unless its value has no effect
1111
 * on the format of the data that is written.
1112
 */
1113
static int OkToChangeTag(TIFF *tif, uint32_t tag)
1114
1.49M
{
1115
1.49M
    const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
1116
1.49M
    if (!fip)
1117
4
    { /* unknown tag */
1118
4
        TIFFErrorExtR(tif, "TIFFSetField", "%s: Unknown %stag %" PRIu32,
1119
4
                      tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "", tag);
1120
4
        return (0);
1121
4
    }
1122
1.49M
    if (tag != TIFFTAG_IMAGELENGTH && (tif->tif_flags & TIFF_BEENWRITING) &&
1123
1.49M
        !fip->field_oktochange)
1124
0
    {
1125
        /*
1126
         * Consult info table to see if tag can be changed
1127
         * after we've started writing.  We only allow changes
1128
         * to those tags that don't/shouldn't affect the
1129
         * compression and/or format of the data.
1130
         */
1131
0
        TIFFErrorExtR(tif, "TIFFSetField",
1132
0
                      "%s: Cannot modify tag \"%s\" while writing",
1133
0
                      tif->tif_name, fip->field_name);
1134
0
        return (0);
1135
0
    }
1136
1.49M
    return (1);
1137
1.49M
}
1138
1139
/*
1140
 * Record the value of a field in the
1141
 * internal directory structure.  The
1142
 * field will be written to the file
1143
 * when/if the directory structure is
1144
 * updated.
1145
 */
1146
int TIFFSetField(TIFF *tif, uint32_t tag, ...)
1147
1.49M
{
1148
1.49M
    va_list ap;
1149
1.49M
    int status;
1150
1151
1.49M
    va_start(ap, tag);
1152
1.49M
    status = TIFFVSetField(tif, tag, ap);
1153
1.49M
    va_end(ap);
1154
1.49M
    return (status);
1155
1.49M
}
1156
1157
/*
1158
 * Clear the contents of the field in the internal structure.
1159
 */
1160
int TIFFUnsetField(TIFF *tif, uint32_t tag)
1161
0
{
1162
0
    const TIFFField *fip = TIFFFieldWithTag(tif, tag);
1163
0
    TIFFDirectory *td = &tif->tif_dir;
1164
1165
0
    if (!fip)
1166
0
        return 0;
1167
1168
0
    if (fip->field_bit != FIELD_CUSTOM)
1169
0
        TIFFClrFieldBit(tif, fip->field_bit);
1170
0
    else
1171
0
    {
1172
0
        TIFFTagValue *tv = NULL;
1173
0
        int i;
1174
1175
0
        for (i = 0; i < td->td_customValueCount; i++)
1176
0
        {
1177
1178
0
            tv = td->td_customValues + i;
1179
0
            if (tv->info->field_tag == tag)
1180
0
                break;
1181
0
        }
1182
1183
0
        if (i < td->td_customValueCount)
1184
0
        {
1185
0
            _TIFFfreeExt(tif, tv->value);
1186
0
            for (; i < td->td_customValueCount - 1; i++)
1187
0
            {
1188
0
                td->td_customValues[i] = td->td_customValues[i + 1];
1189
0
            }
1190
0
            td->td_customValueCount--;
1191
0
        }
1192
0
    }
1193
1194
0
    tif->tif_flags |= TIFF_DIRTYDIRECT;
1195
1196
0
    return (1);
1197
0
}
1198
1199
/*
1200
 * Like TIFFSetField, but taking a varargs
1201
 * parameter list.  This routine is useful
1202
 * for building higher-level interfaces on
1203
 * top of the library.
1204
 */
1205
int TIFFVSetField(TIFF *tif, uint32_t tag, va_list ap)
1206
1.49M
{
1207
1.49M
    return OkToChangeTag(tif, tag)
1208
1.49M
               ? (*tif->tif_tagmethods.vsetfield)(tif, tag, ap)
1209
1.49M
               : 0;
1210
1.49M
}
1211
1212
static int _TIFFVGetField(TIFF *tif, uint32_t tag, va_list ap)
1213
4.61M
{
1214
4.61M
    TIFFDirectory *td = &tif->tif_dir;
1215
4.61M
    int ret_val = 1;
1216
4.61M
    uint32_t standard_tag = tag;
1217
4.61M
    const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
1218
4.61M
    if (fip == NULL) /* cannot happen since TIFFGetField() already checks it */
1219
0
        return 0;
1220
1221
    /*
1222
     * We want to force the custom code to be used for custom
1223
     * fields even if the tag happens to match a well known
1224
     * one - important for reinterpreted handling of standard
1225
     * tag values in custom directories (i.e. EXIF)
1226
     */
1227
4.61M
    if (fip->field_bit == FIELD_CUSTOM)
1228
552k
    {
1229
552k
        standard_tag = 0;
1230
552k
    }
1231
1232
4.61M
    switch (standard_tag)
1233
4.61M
    {
1234
0
        case TIFFTAG_SUBFILETYPE:
1235
0
            *va_arg(ap, uint32_t *) = td->td_subfiletype;
1236
0
            break;
1237
339k
        case TIFFTAG_IMAGEWIDTH:
1238
339k
            *va_arg(ap, uint32_t *) = td->td_imagewidth;
1239
339k
            break;
1240
339k
        case TIFFTAG_IMAGELENGTH:
1241
339k
            *va_arg(ap, uint32_t *) = td->td_imagelength;
1242
339k
            break;
1243
277k
        case TIFFTAG_BITSPERSAMPLE:
1244
277k
            *va_arg(ap, uint16_t *) = td->td_bitspersample;
1245
277k
            break;
1246
339k
        case TIFFTAG_COMPRESSION:
1247
339k
            *va_arg(ap, uint16_t *) = td->td_compression;
1248
339k
            break;
1249
886k
        case TIFFTAG_PHOTOMETRIC:
1250
886k
            *va_arg(ap, uint16_t *) = td->td_photometric;
1251
886k
            break;
1252
0
        case TIFFTAG_THRESHHOLDING:
1253
0
            *va_arg(ap, uint16_t *) = td->td_threshholding;
1254
0
            break;
1255
490
        case TIFFTAG_FILLORDER:
1256
490
            *va_arg(ap, uint16_t *) = td->td_fillorder;
1257
490
            break;
1258
65.9k
        case TIFFTAG_ORIENTATION:
1259
65.9k
            *va_arg(ap, uint16_t *) = td->td_orientation;
1260
65.9k
            break;
1261
237k
        case TIFFTAG_SAMPLESPERPIXEL:
1262
237k
            *va_arg(ap, uint16_t *) = td->td_samplesperpixel;
1263
237k
            break;
1264
187k
        case TIFFTAG_ROWSPERSTRIP:
1265
187k
            *va_arg(ap, uint32_t *) = td->td_rowsperstrip;
1266
187k
            break;
1267
276
        case TIFFTAG_MINSAMPLEVALUE:
1268
276
            *va_arg(ap, uint16_t *) = td->td_minsamplevalue;
1269
276
            break;
1270
1.01k
        case TIFFTAG_MAXSAMPLEVALUE:
1271
1.01k
            *va_arg(ap, uint16_t *) = td->td_maxsamplevalue;
1272
1.01k
            break;
1273
24
        case TIFFTAG_SMINSAMPLEVALUE:
1274
24
            if (tif->tif_flags & TIFF_PERSAMPLE)
1275
0
                *va_arg(ap, double **) = td->td_sminsamplevalue;
1276
24
            else
1277
24
            {
1278
                /* libtiff historically treats this as a single value. */
1279
24
                uint16_t i;
1280
24
                double v = td->td_sminsamplevalue[0];
1281
44
                for (i = 1; i < td->td_samplesperpixel; ++i)
1282
20
                    if (td->td_sminsamplevalue[i] < v)
1283
9
                        v = td->td_sminsamplevalue[i];
1284
24
                *va_arg(ap, double *) = v;
1285
24
            }
1286
24
            break;
1287
70
        case TIFFTAG_SMAXSAMPLEVALUE:
1288
70
            if (tif->tif_flags & TIFF_PERSAMPLE)
1289
0
                *va_arg(ap, double **) = td->td_smaxsamplevalue;
1290
70
            else
1291
70
            {
1292
                /* libtiff historically treats this as a single value. */
1293
70
                uint16_t i;
1294
70
                double v = td->td_smaxsamplevalue[0];
1295
80
                for (i = 1; i < td->td_samplesperpixel; ++i)
1296
10
                    if (td->td_smaxsamplevalue[i] > v)
1297
4
                        v = td->td_smaxsamplevalue[i];
1298
70
                *va_arg(ap, double *) = v;
1299
70
            }
1300
70
            break;
1301
2.76k
        case TIFFTAG_XRESOLUTION:
1302
2.76k
            *va_arg(ap, float *) = td->td_xresolution;
1303
2.76k
            break;
1304
2.76k
        case TIFFTAG_YRESOLUTION:
1305
2.76k
            *va_arg(ap, float *) = td->td_yresolution;
1306
2.76k
            break;
1307
339k
        case TIFFTAG_PLANARCONFIG:
1308
339k
            *va_arg(ap, uint16_t *) = td->td_planarconfig;
1309
339k
            break;
1310
0
        case TIFFTAG_XPOSITION:
1311
0
            *va_arg(ap, float *) = td->td_xposition;
1312
0
            break;
1313
0
        case TIFFTAG_YPOSITION:
1314
0
            *va_arg(ap, float *) = td->td_yposition;
1315
0
            break;
1316
2.60k
        case TIFFTAG_RESOLUTIONUNIT:
1317
2.60k
            *va_arg(ap, uint16_t *) = td->td_resolutionunit;
1318
2.60k
            break;
1319
185
        case TIFFTAG_PAGENUMBER:
1320
185
            *va_arg(ap, uint16_t *) = td->td_pagenumber[0];
1321
185
            *va_arg(ap, uint16_t *) = td->td_pagenumber[1];
1322
185
            break;
1323
0
        case TIFFTAG_HALFTONEHINTS:
1324
0
            *va_arg(ap, uint16_t *) = td->td_halftonehints[0];
1325
0
            *va_arg(ap, uint16_t *) = td->td_halftonehints[1];
1326
0
            break;
1327
28.5k
        case TIFFTAG_COLORMAP:
1328
28.5k
            *va_arg(ap, const uint16_t **) = td->td_colormap[0];
1329
28.5k
            *va_arg(ap, const uint16_t **) = td->td_colormap[1];
1330
28.5k
            *va_arg(ap, const uint16_t **) = td->td_colormap[2];
1331
28.5k
            break;
1332
0
        case TIFFTAG_STRIPOFFSETS:
1333
0
        case TIFFTAG_TILEOFFSETS:
1334
0
            _TIFFFillStriles(tif);
1335
0
            *va_arg(ap, const uint64_t **) = td->td_stripoffset_p;
1336
0
            if (td->td_stripoffset_p == NULL)
1337
0
                ret_val = 0;
1338
0
            break;
1339
1.62k
        case TIFFTAG_STRIPBYTECOUNTS:
1340
1.62k
        case TIFFTAG_TILEBYTECOUNTS:
1341
1.62k
            _TIFFFillStriles(tif);
1342
1.62k
            *va_arg(ap, const uint64_t **) = td->td_stripbytecount_p;
1343
1.62k
            if (td->td_stripbytecount_p == NULL)
1344
0
                ret_val = 0;
1345
1.62k
            break;
1346
0
        case TIFFTAG_MATTEING:
1347
0
            *va_arg(ap, uint16_t *) =
1348
0
                (td->td_extrasamples == 1 &&
1349
0
                 td->td_sampleinfo[0] == EXTRASAMPLE_ASSOCALPHA);
1350
0
            break;
1351
37.9k
        case TIFFTAG_EXTRASAMPLES:
1352
37.9k
            *va_arg(ap, uint16_t *) = td->td_extrasamples;
1353
37.9k
            *va_arg(ap, const uint16_t **) = td->td_sampleinfo;
1354
37.9k
            break;
1355
398k
        case TIFFTAG_TILEWIDTH:
1356
398k
            *va_arg(ap, uint32_t *) = td->td_tilewidth;
1357
398k
            break;
1358
398k
        case TIFFTAG_TILELENGTH:
1359
398k
            *va_arg(ap, uint32_t *) = td->td_tilelength;
1360
398k
            break;
1361
0
        case TIFFTAG_TILEDEPTH:
1362
0
            *va_arg(ap, uint32_t *) = td->td_tiledepth;
1363
0
            break;
1364
0
        case TIFFTAG_DATATYPE:
1365
0
            switch (td->td_sampleformat)
1366
0
            {
1367
0
                case SAMPLEFORMAT_UINT:
1368
0
                    *va_arg(ap, uint16_t *) = DATATYPE_UINT;
1369
0
                    break;
1370
0
                case SAMPLEFORMAT_INT:
1371
0
                    *va_arg(ap, uint16_t *) = DATATYPE_INT;
1372
0
                    break;
1373
0
                case SAMPLEFORMAT_IEEEFP:
1374
0
                    *va_arg(ap, uint16_t *) = DATATYPE_IEEEFP;
1375
0
                    break;
1376
0
                case SAMPLEFORMAT_VOID:
1377
0
                    *va_arg(ap, uint16_t *) = DATATYPE_VOID;
1378
0
                    break;
1379
0
            }
1380
0
            break;
1381
28.6k
        case TIFFTAG_SAMPLEFORMAT:
1382
28.6k
            *va_arg(ap, uint16_t *) = td->td_sampleformat;
1383
28.6k
            break;
1384
0
        case TIFFTAG_IMAGEDEPTH:
1385
0
            *va_arg(ap, uint32_t *) = td->td_imagedepth;
1386
0
            break;
1387
0
        case TIFFTAG_SUBIFD:
1388
0
            *va_arg(ap, uint16_t *) = td->td_nsubifd;
1389
0
            *va_arg(ap, const uint64_t **) = td->td_subifd;
1390
0
            break;
1391
0
        case TIFFTAG_YCBCRPOSITIONING:
1392
0
            *va_arg(ap, uint16_t *) = td->td_ycbcrpositioning;
1393
0
            break;
1394
136k
        case TIFFTAG_YCBCRSUBSAMPLING:
1395
136k
            *va_arg(ap, uint16_t *) = td->td_ycbcrsubsampling[0];
1396
136k
            *va_arg(ap, uint16_t *) = td->td_ycbcrsubsampling[1];
1397
136k
            break;
1398
0
        case TIFFTAG_TRANSFERFUNCTION:
1399
0
            *va_arg(ap, const uint16_t **) = td->td_transferfunction[0];
1400
0
            if (td->td_samplesperpixel - td->td_extrasamples > 1)
1401
0
            {
1402
0
                *va_arg(ap, const uint16_t **) = td->td_transferfunction[1];
1403
0
                *va_arg(ap, const uint16_t **) = td->td_transferfunction[2];
1404
0
            }
1405
0
            else
1406
0
            {
1407
0
                *va_arg(ap, const uint16_t **) = NULL;
1408
0
                *va_arg(ap, const uint16_t **) = NULL;
1409
0
            }
1410
0
            break;
1411
5.12k
        case TIFFTAG_REFERENCEBLACKWHITE:
1412
5.12k
            *va_arg(ap, const float **) = td->td_refblackwhite;
1413
5.12k
            break;
1414
0
        case TIFFTAG_INKNAMES:
1415
0
            *va_arg(ap, const char **) = td->td_inknames;
1416
0
            break;
1417
0
        case TIFFTAG_NUMBEROFINKS:
1418
0
            *va_arg(ap, uint16_t *) = td->td_numberofinks;
1419
0
            break;
1420
552k
        default:
1421
552k
        {
1422
552k
            int i;
1423
1424
            /*
1425
             * This can happen if multiple images are open
1426
             * with different codecs which have private
1427
             * tags.  The global tag information table may
1428
             * then have tags that are valid for one file
1429
             * but not the other. If the client tries to
1430
             * get a tag that is not valid for the image's
1431
             * codec then we'll arrive here.
1432
             */
1433
552k
            if (fip->field_bit != FIELD_CUSTOM)
1434
0
            {
1435
0
                TIFFErrorExtR(tif, "_TIFFVGetField",
1436
0
                              "%s: Invalid %stag \"%s\" "
1437
0
                              "(not supported by codec)",
1438
0
                              tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
1439
0
                              fip->field_name);
1440
0
                ret_val = 0;
1441
0
                break;
1442
0
            }
1443
1444
            /*
1445
             * Do we have a custom value?
1446
             */
1447
552k
            ret_val = 0;
1448
1.75M
            for (i = 0; i < td->td_customValueCount; i++)
1449
1.20M
            {
1450
1.20M
                TIFFTagValue *tv = td->td_customValues + i;
1451
1452
1.20M
                if (tv->info->field_tag != tag)
1453
1.20M
                    continue;
1454
1455
3.77k
                if (fip->field_passcount)
1456
131
                {
1457
131
                    if (fip->field_readcount == TIFF_VARIABLE2)
1458
131
                        *va_arg(ap, uint32_t *) = (uint32_t)tv->count;
1459
0
                    else /* Assume TIFF_VARIABLE */
1460
0
                        *va_arg(ap, uint16_t *) = (uint16_t)tv->count;
1461
131
                    *va_arg(ap, const void **) = tv->value;
1462
131
                    ret_val = 1;
1463
131
                }
1464
3.63k
                else if (fip->field_tag == TIFFTAG_DOTRANGE &&
1465
3.63k
                         strcmp(fip->field_name, "DotRange") == 0)
1466
0
                {
1467
                    /* TODO: This is an evil exception and should not have been
1468
                       handled this way ... likely best if we move it into
1469
                       the directory structure with an explicit field in
1470
                       libtiff 4.1 and assign it a FIELD_ value */
1471
0
                    *va_arg(ap, uint16_t *) = ((uint16_t *)tv->value)[0];
1472
0
                    *va_arg(ap, uint16_t *) = ((uint16_t *)tv->value)[1];
1473
0
                    ret_val = 1;
1474
0
                }
1475
3.63k
                else
1476
3.63k
                {
1477
3.63k
                    if (fip->field_type == TIFF_ASCII ||
1478
3.63k
                        fip->field_readcount == TIFF_VARIABLE ||
1479
3.63k
                        fip->field_readcount == TIFF_VARIABLE2 ||
1480
3.63k
                        fip->field_readcount == TIFF_SPP || tv->count > 1)
1481
3.63k
                    {
1482
3.63k
                        *va_arg(ap, void **) = tv->value;
1483
3.63k
                        ret_val = 1;
1484
3.63k
                    }
1485
7
                    else
1486
7
                    {
1487
7
                        char *val = (char *)tv->value;
1488
7
                        assert(tv->count == 1);
1489
7
                        switch (fip->field_type)
1490
7
                        {
1491
0
                            case TIFF_BYTE:
1492
0
                            case TIFF_UNDEFINED:
1493
0
                                *va_arg(ap, uint8_t *) = *(uint8_t *)val;
1494
0
                                ret_val = 1;
1495
0
                                break;
1496
0
                            case TIFF_SBYTE:
1497
0
                                *va_arg(ap, int8_t *) = *(int8_t *)val;
1498
0
                                ret_val = 1;
1499
0
                                break;
1500
7
                            case TIFF_SHORT:
1501
7
                                *va_arg(ap, uint16_t *) = *(uint16_t *)val;
1502
7
                                ret_val = 1;
1503
7
                                break;
1504
0
                            case TIFF_SSHORT:
1505
0
                                *va_arg(ap, int16_t *) = *(int16_t *)val;
1506
0
                                ret_val = 1;
1507
0
                                break;
1508
0
                            case TIFF_LONG:
1509
0
                            case TIFF_IFD:
1510
0
                                *va_arg(ap, uint32_t *) = *(uint32_t *)val;
1511
0
                                ret_val = 1;
1512
0
                                break;
1513
0
                            case TIFF_SLONG:
1514
0
                                *va_arg(ap, int32_t *) = *(int32_t *)val;
1515
0
                                ret_val = 1;
1516
0
                                break;
1517
0
                            case TIFF_LONG8:
1518
0
                            case TIFF_IFD8:
1519
0
                                *va_arg(ap, uint64_t *) = *(uint64_t *)val;
1520
0
                                ret_val = 1;
1521
0
                                break;
1522
0
                            case TIFF_SLONG8:
1523
0
                                *va_arg(ap, int64_t *) = *(int64_t *)val;
1524
0
                                ret_val = 1;
1525
0
                                break;
1526
0
                            case TIFF_RATIONAL:
1527
0
                            case TIFF_SRATIONAL:
1528
0
                            {
1529
                                /*-- Rational2Double: For Rationals evaluate
1530
                                 * "set_get_field_type" to determine internal
1531
                                 * storage size and return value size. */
1532
0
                                int tv_size = TIFFFieldSetGetSize(fip);
1533
0
                                if (tv_size == 8)
1534
0
                                {
1535
0
                                    *va_arg(ap, double *) = *(double *)val;
1536
0
                                    ret_val = 1;
1537
0
                                }
1538
0
                                else
1539
0
                                {
1540
                                    /*-- default should be tv_size == 4  */
1541
0
                                    *va_arg(ap, float *) = *(float *)val;
1542
0
                                    ret_val = 1;
1543
                                    /*-- ToDo: After Testing, this should be
1544
                                     * removed and tv_size==4 should be set as
1545
                                     * default. */
1546
0
                                    if (tv_size != 4)
1547
0
                                    {
1548
0
                                        TIFFErrorExtR(tif, "_TIFFVGetField",
1549
0
                                                      "Rational2Double: "
1550
0
                                                      ".set_get_field_type "
1551
0
                                                      "in not 4 but %d",
1552
0
                                                      tv_size);
1553
0
                                    }
1554
0
                                }
1555
0
                            }
1556
0
                            break;
1557
0
                            case TIFF_FLOAT:
1558
0
                                *va_arg(ap, float *) = *(float *)val;
1559
0
                                ret_val = 1;
1560
0
                                break;
1561
0
                            case TIFF_DOUBLE:
1562
0
                                *va_arg(ap, double *) = *(double *)val;
1563
0
                                ret_val = 1;
1564
0
                                break;
1565
0
                            default:
1566
0
                                ret_val = 0;
1567
0
                                break;
1568
7
                        }
1569
7
                    }
1570
3.63k
                }
1571
3.77k
                break;
1572
3.77k
            }
1573
552k
        }
1574
4.61M
    }
1575
4.61M
    return (ret_val);
1576
4.61M
}
1577
1578
/*
1579
 * Return the value of a field in the
1580
 * internal directory structure.
1581
 */
1582
int TIFFGetField(TIFF *tif, uint32_t tag, ...)
1583
3.31M
{
1584
3.31M
    int status;
1585
3.31M
    va_list ap;
1586
1587
3.31M
    va_start(ap, tag);
1588
3.31M
    status = TIFFVGetField(tif, tag, ap);
1589
3.31M
    va_end(ap);
1590
3.31M
    return (status);
1591
3.31M
}
1592
1593
/*
1594
 * Like TIFFGetField, but taking a varargs
1595
 * parameter list.  This routine is useful
1596
 * for building higher-level interfaces on
1597
 * top of the library.
1598
 */
1599
int TIFFVGetField(TIFF *tif, uint32_t tag, va_list ap)
1600
7.04M
{
1601
7.04M
    const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
1602
7.04M
    return (fip && (isPseudoTag(tag) || TIFFFieldSet(tif, fip->field_bit))
1603
7.04M
                ? (*tif->tif_tagmethods.vgetfield)(tif, tag, ap)
1604
7.04M
                : 0);
1605
7.04M
}
1606
1607
#define CleanupField(member)                                                   \
1608
4.41M
    {                                                                          \
1609
4.41M
        if (td->member)                                                        \
1610
4.41M
        {                                                                      \
1611
339k
            _TIFFfreeExt(tif, td->member);                                     \
1612
339k
            td->member = 0;                                                    \
1613
339k
        }                                                                      \
1614
4.41M
    }
1615
1616
/*
1617
 * Release storage associated with a directory.
1618
 */
1619
void TIFFFreeDirectory(TIFF *tif)
1620
294k
{
1621
294k
    TIFFDirectory *td = &tif->tif_dir;
1622
294k
    int i;
1623
1624
294k
    (*tif->tif_cleanup)(tif);
1625
294k
    _TIFFmemset(td->td_fieldsset, 0, sizeof(td->td_fieldsset));
1626
294k
    CleanupField(td_sminsamplevalue);
1627
294k
    CleanupField(td_smaxsamplevalue);
1628
294k
    CleanupField(td_colormap[0]);
1629
294k
    CleanupField(td_colormap[1]);
1630
294k
    CleanupField(td_colormap[2]);
1631
294k
    CleanupField(td_sampleinfo);
1632
294k
    CleanupField(td_subifd);
1633
294k
    CleanupField(td_inknames);
1634
294k
    CleanupField(td_refblackwhite);
1635
294k
    CleanupField(td_transferfunction[0]);
1636
294k
    CleanupField(td_transferfunction[1]);
1637
294k
    CleanupField(td_transferfunction[2]);
1638
294k
    CleanupField(td_stripoffset_p);
1639
294k
    CleanupField(td_stripbytecount_p);
1640
294k
    td->td_stripoffsetbyteallocsize = 0;
1641
294k
    TIFFClrFieldBit(tif, FIELD_YCBCRSUBSAMPLING);
1642
294k
    TIFFClrFieldBit(tif, FIELD_YCBCRPOSITIONING);
1643
1644
    /* Cleanup custom tag values */
1645
481k
    for (i = 0; i < td->td_customValueCount; i++)
1646
187k
    {
1647
187k
        if (td->td_customValues[i].value)
1648
183k
            _TIFFfreeExt(tif, td->td_customValues[i].value);
1649
187k
    }
1650
1651
294k
    td->td_customValueCount = 0;
1652
294k
    CleanupField(td_customValues);
1653
1654
294k
    _TIFFmemset(&(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry));
1655
294k
    _TIFFmemset(&(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry));
1656
1657
    /* Reset some internal parameters for IFD data size checking. */
1658
294k
    tif->tif_dir.td_dirdatasize_read = 0;
1659
294k
    tif->tif_dir.td_dirdatasize_write = 0;
1660
294k
    if (tif->tif_dir.td_dirdatasize_offsets != NULL)
1661
97.6k
    {
1662
97.6k
        _TIFFfreeExt(tif, tif->tif_dir.td_dirdatasize_offsets);
1663
97.6k
        tif->tif_dir.td_dirdatasize_offsets = NULL;
1664
97.6k
        tif->tif_dir.td_dirdatasize_Noffsets = 0;
1665
97.6k
    }
1666
294k
    tif->tif_dir.td_iswrittentofile = FALSE;
1667
294k
}
1668
#undef CleanupField
1669
1670
/*
1671
 * Client Tag extension support (from Niles Ritter).
1672
 */
1673
static TIFFExtendProc _TIFFextender = (TIFFExtendProc)NULL;
1674
1675
TIFFExtendProc TIFFSetTagExtender(TIFFExtendProc extender)
1676
7
{
1677
7
    TIFFExtendProc prev = _TIFFextender;
1678
7
    _TIFFextender = extender;
1679
7
    return (prev);
1680
7
}
1681
1682
/*
1683
 * Setup for a new directory.  Should we automatically call
1684
 * TIFFWriteDirectory() if the current one is dirty?
1685
 *
1686
 * The newly created directory will not exist on the file till
1687
 * TIFFWriteDirectory(), TIFFFlush() or TIFFClose() is called.
1688
 */
1689
int TIFFCreateDirectory(TIFF *tif)
1690
34.6k
{
1691
    /* Free previously allocated memory and setup default values. */
1692
34.6k
    TIFFFreeDirectory(tif);
1693
34.6k
    TIFFDefaultDirectory(tif);
1694
34.6k
    tif->tif_diroff = 0;
1695
34.6k
    tif->tif_nextdiroff = 0;
1696
34.6k
    tif->tif_curoff = 0;
1697
34.6k
    tif->tif_row = (uint32_t)-1;
1698
34.6k
    tif->tif_curstrip = (uint32_t)-1;
1699
34.6k
    tif->tif_dir.td_iswrittentofile = FALSE;
1700
1701
34.6k
    return 0;
1702
34.6k
}
1703
1704
int TIFFCreateCustomDirectory(TIFF *tif, const TIFFFieldArray *infoarray)
1705
0
{
1706
    /* Free previously allocated memory and setup default values. */
1707
0
    TIFFFreeDirectory(tif);
1708
0
    TIFFDefaultDirectory(tif);
1709
1710
    /*
1711
     * Reset the field definitions to match the application provided list.
1712
     * Hopefully TIFFDefaultDirectory() won't have done anything irreversible
1713
     * based on it's assumption this is an image directory.
1714
     */
1715
0
    _TIFFSetupFields(tif, infoarray);
1716
1717
0
    tif->tif_diroff = 0;
1718
0
    tif->tif_nextdiroff = 0;
1719
0
    tif->tif_curoff = 0;
1720
0
    tif->tif_row = (uint32_t)-1;
1721
0
    tif->tif_curstrip = (uint32_t)-1;
1722
    /* invalidate directory index */
1723
0
    tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
1724
    /* invalidate IFD loop lists */
1725
0
    _TIFFCleanupIFDOffsetAndNumberMaps(tif);
1726
    /* To be able to return from SubIFD or custom-IFD to main-IFD */
1727
0
    tif->tif_setdirectory_force_absolute = TRUE;
1728
1729
0
    return 0;
1730
0
}
1731
1732
int TIFFCreateEXIFDirectory(TIFF *tif)
1733
0
{
1734
0
    const TIFFFieldArray *exifFieldArray;
1735
0
    exifFieldArray = _TIFFGetExifFields();
1736
0
    return TIFFCreateCustomDirectory(tif, exifFieldArray);
1737
0
}
1738
1739
/*
1740
 * Creates the EXIF GPS custom directory
1741
 */
1742
int TIFFCreateGPSDirectory(TIFF *tif)
1743
0
{
1744
0
    const TIFFFieldArray *gpsFieldArray;
1745
0
    gpsFieldArray = _TIFFGetGpsFields();
1746
0
    return TIFFCreateCustomDirectory(tif, gpsFieldArray);
1747
0
}
1748
1749
/*
1750
 * Setup a default directory structure.
1751
 */
1752
int TIFFDefaultDirectory(TIFF *tif)
1753
158k
{
1754
158k
    register TIFFDirectory *td = &tif->tif_dir;
1755
158k
    const TIFFFieldArray *tiffFieldArray;
1756
1757
158k
    tiffFieldArray = _TIFFGetFields();
1758
158k
    _TIFFSetupFields(tif, tiffFieldArray);
1759
1760
158k
    _TIFFmemset(td, 0, sizeof(*td));
1761
158k
    td->td_fillorder = FILLORDER_MSB2LSB;
1762
158k
    td->td_bitspersample = 1;
1763
158k
    td->td_threshholding = THRESHHOLD_BILEVEL;
1764
158k
    td->td_orientation = ORIENTATION_TOPLEFT;
1765
158k
    td->td_samplesperpixel = 1;
1766
158k
    td->td_rowsperstrip = (uint32_t)-1;
1767
158k
    td->td_tilewidth = 0;
1768
158k
    td->td_tilelength = 0;
1769
158k
    td->td_tiledepth = 1;
1770
#ifdef STRIPBYTECOUNTSORTED_UNUSED
1771
    td->td_stripbytecountsorted = 1; /* Our own arrays always sorted. */
1772
#endif
1773
158k
    td->td_resolutionunit = RESUNIT_INCH;
1774
158k
    td->td_sampleformat = SAMPLEFORMAT_UINT;
1775
158k
    td->td_imagedepth = 1;
1776
158k
    td->td_ycbcrsubsampling[0] = 2;
1777
158k
    td->td_ycbcrsubsampling[1] = 2;
1778
158k
    td->td_ycbcrpositioning = YCBCRPOSITION_CENTERED;
1779
158k
    tif->tif_postdecode = _TIFFNoPostDecode;
1780
158k
    tif->tif_foundfield = NULL;
1781
158k
    tif->tif_tagmethods.vsetfield = _TIFFVSetField;
1782
158k
    tif->tif_tagmethods.vgetfield = _TIFFVGetField;
1783
158k
    tif->tif_tagmethods.printdir = NULL;
1784
    /* additional default values */
1785
158k
    td->td_planarconfig = PLANARCONFIG_CONTIG;
1786
158k
    td->td_compression = COMPRESSION_NONE;
1787
158k
    td->td_subfiletype = 0;
1788
158k
    td->td_minsamplevalue = 0;
1789
    /* td_bitspersample=1 is always set in TIFFDefaultDirectory().
1790
     * Therefore, td_maxsamplevalue has to be re-calculated in
1791
     * TIFFGetFieldDefaulted(). */
1792
158k
    td->td_maxsamplevalue = 1; /* Default for td_bitspersample=1 */
1793
158k
    td->td_extrasamples = 0;
1794
158k
    td->td_sampleinfo = NULL;
1795
1796
    /*
1797
     *  Give client code a chance to install their own
1798
     *  tag extensions & methods, prior to compression overloads,
1799
     *  but do some prior cleanup first.
1800
     * (http://trac.osgeo.org/gdal/ticket/5054)
1801
     */
1802
158k
    if (tif->tif_nfieldscompat > 0)
1803
0
    {
1804
0
        uint32_t i;
1805
1806
0
        for (i = 0; i < tif->tif_nfieldscompat; i++)
1807
0
        {
1808
0
            if (tif->tif_fieldscompat[i].allocated_size)
1809
0
                _TIFFfreeExt(tif, tif->tif_fieldscompat[i].fields);
1810
0
        }
1811
0
        _TIFFfreeExt(tif, tif->tif_fieldscompat);
1812
0
        tif->tif_nfieldscompat = 0;
1813
0
        tif->tif_fieldscompat = NULL;
1814
0
    }
1815
158k
    if (_TIFFextender)
1816
158k
        (*_TIFFextender)(tif);
1817
158k
    (void)TIFFSetField(tif, TIFFTAG_COMPRESSION, COMPRESSION_NONE);
1818
    /*
1819
     * NB: The directory is marked dirty as a result of setting
1820
     * up the default compression scheme.  However, this really
1821
     * isn't correct -- we want TIFF_DIRTYDIRECT to be set only
1822
     * if the user does something.  We could just do the setup
1823
     * by hand, but it seems better to use the normal mechanism
1824
     * (i.e. TIFFSetField).
1825
     */
1826
158k
    tif->tif_flags &= ~TIFF_DIRTYDIRECT;
1827
1828
    /*
1829
     * As per http://bugzilla.remotesensing.org/show_bug.cgi?id=19
1830
     * we clear the ISTILED flag when setting up a new directory.
1831
     * Should we also be clearing stuff like INSUBIFD?
1832
     */
1833
158k
    tif->tif_flags &= ~TIFF_ISTILED;
1834
1835
158k
    return (1);
1836
158k
}
1837
1838
static int TIFFAdvanceDirectory(TIFF *tif, uint64_t *nextdiroff, uint64_t *off,
1839
                                tdir_t *nextdirnum)
1840
0
{
1841
0
    static const char module[] = "TIFFAdvanceDirectory";
1842
1843
    /* Add this directory to the directory list, if not already in. */
1844
0
    if (!_TIFFCheckDirNumberAndOffset(tif, *nextdirnum, *nextdiroff))
1845
0
    {
1846
0
        TIFFErrorExtR(tif, module,
1847
0
                      "Starting directory %u at offset 0x%" PRIx64 " (%" PRIu64
1848
0
                      ") might cause an IFD loop",
1849
0
                      *nextdirnum, *nextdiroff, *nextdiroff);
1850
0
        *nextdiroff = 0;
1851
0
        *nextdirnum = 0;
1852
0
        return (0);
1853
0
    }
1854
1855
0
    if (isMapped(tif))
1856
0
    {
1857
0
        uint64_t poff = *nextdiroff;
1858
0
        if (!(tif->tif_flags & TIFF_BIGTIFF))
1859
0
        {
1860
0
            tmsize_t poffa, poffb, poffc, poffd;
1861
0
            uint16_t dircount;
1862
0
            uint32_t nextdir32;
1863
0
            poffa = (tmsize_t)poff;
1864
0
            poffb = poffa + sizeof(uint16_t);
1865
0
            if (((uint64_t)poffa != poff) || (poffb < poffa) ||
1866
0
                (poffb < (tmsize_t)sizeof(uint16_t)) || (poffb > tif->tif_size))
1867
0
            {
1868
0
                TIFFErrorExtR(tif, module,
1869
0
                              "%s:%d: %s: Error fetching directory count",
1870
0
                              __FILE__, __LINE__, tif->tif_name);
1871
0
                *nextdiroff = 0;
1872
0
                return (0);
1873
0
            }
1874
0
            _TIFFmemcpy(&dircount, tif->tif_base + poffa, sizeof(uint16_t));
1875
0
            if (tif->tif_flags & TIFF_SWAB)
1876
0
                TIFFSwabShort(&dircount);
1877
0
            poffc = poffb + dircount * 12;
1878
0
            poffd = poffc + sizeof(uint32_t);
1879
0
            if ((poffc < poffb) || (poffc < dircount * 12) || (poffd < poffc) ||
1880
0
                (poffd < (tmsize_t)sizeof(uint32_t)) || (poffd > tif->tif_size))
1881
0
            {
1882
0
                TIFFErrorExtR(tif, module, "Error fetching directory link");
1883
0
                return (0);
1884
0
            }
1885
0
            if (off != NULL)
1886
0
                *off = (uint64_t)poffc;
1887
0
            _TIFFmemcpy(&nextdir32, tif->tif_base + poffc, sizeof(uint32_t));
1888
0
            if (tif->tif_flags & TIFF_SWAB)
1889
0
                TIFFSwabLong(&nextdir32);
1890
0
            *nextdiroff = nextdir32;
1891
0
        }
1892
0
        else
1893
0
        {
1894
0
            tmsize_t poffa, poffb, poffc, poffd;
1895
0
            uint64_t dircount64;
1896
0
            uint16_t dircount16;
1897
0
            if (poff > (uint64_t)TIFF_TMSIZE_T_MAX - sizeof(uint64_t))
1898
0
            {
1899
0
                TIFFErrorExtR(tif, module,
1900
0
                              "%s:%d: %s: Error fetching directory count",
1901
0
                              __FILE__, __LINE__, tif->tif_name);
1902
0
                return (0);
1903
0
            }
1904
0
            poffa = (tmsize_t)poff;
1905
0
            poffb = poffa + sizeof(uint64_t);
1906
0
            if (poffb > tif->tif_size)
1907
0
            {
1908
0
                TIFFErrorExtR(tif, module,
1909
0
                              "%s:%d: %s: Error fetching directory count",
1910
0
                              __FILE__, __LINE__, tif->tif_name);
1911
0
                return (0);
1912
0
            }
1913
0
            _TIFFmemcpy(&dircount64, tif->tif_base + poffa, sizeof(uint64_t));
1914
0
            if (tif->tif_flags & TIFF_SWAB)
1915
0
                TIFFSwabLong8(&dircount64);
1916
0
            if (dircount64 > 0xFFFF)
1917
0
            {
1918
0
                TIFFErrorExtR(tif, module,
1919
0
                              "Sanity check on directory count failed");
1920
0
                return (0);
1921
0
            }
1922
0
            dircount16 = (uint16_t)dircount64;
1923
0
            if (poffb > TIFF_TMSIZE_T_MAX - (tmsize_t)(dircount16 * 20) -
1924
0
                            (tmsize_t)sizeof(uint64_t))
1925
0
            {
1926
0
                TIFFErrorExtR(tif, module, "Error fetching directory link");
1927
0
                return (0);
1928
0
            }
1929
0
            poffc = poffb + dircount16 * 20;
1930
0
            poffd = poffc + sizeof(uint64_t);
1931
0
            if (poffd > tif->tif_size)
1932
0
            {
1933
0
                TIFFErrorExtR(tif, module, "Error fetching directory link");
1934
0
                return (0);
1935
0
            }
1936
0
            if (off != NULL)
1937
0
                *off = (uint64_t)poffc;
1938
0
            _TIFFmemcpy(nextdiroff, tif->tif_base + poffc, sizeof(uint64_t));
1939
0
            if (tif->tif_flags & TIFF_SWAB)
1940
0
                TIFFSwabLong8(nextdiroff);
1941
0
        }
1942
0
    }
1943
0
    else
1944
0
    {
1945
0
        if (!(tif->tif_flags & TIFF_BIGTIFF))
1946
0
        {
1947
0
            uint16_t dircount;
1948
0
            uint32_t nextdir32;
1949
0
            if (!SeekOK(tif, *nextdiroff) ||
1950
0
                !ReadOK(tif, &dircount, sizeof(uint16_t)))
1951
0
            {
1952
0
                TIFFErrorExtR(tif, module,
1953
0
                              "%s:%d: %s: Error fetching directory count",
1954
0
                              __FILE__, __LINE__, tif->tif_name);
1955
0
                return (0);
1956
0
            }
1957
0
            if (tif->tif_flags & TIFF_SWAB)
1958
0
                TIFFSwabShort(&dircount);
1959
0
            if (off != NULL)
1960
0
                *off = TIFFSeekFile(tif, dircount * 12, SEEK_CUR);
1961
0
            else
1962
0
                (void)TIFFSeekFile(tif, dircount * 12, SEEK_CUR);
1963
0
            if (!ReadOK(tif, &nextdir32, sizeof(uint32_t)))
1964
0
            {
1965
0
                TIFFErrorExtR(tif, module, "%s: Error fetching directory link",
1966
0
                              tif->tif_name);
1967
0
                return (0);
1968
0
            }
1969
0
            if (tif->tif_flags & TIFF_SWAB)
1970
0
                TIFFSwabLong(&nextdir32);
1971
0
            *nextdiroff = nextdir32;
1972
0
        }
1973
0
        else
1974
0
        {
1975
0
            uint64_t dircount64;
1976
0
            uint16_t dircount16;
1977
0
            if (!SeekOK(tif, *nextdiroff) ||
1978
0
                !ReadOK(tif, &dircount64, sizeof(uint64_t)))
1979
0
            {
1980
0
                TIFFErrorExtR(tif, module,
1981
0
                              "%s:%d: %s: Error fetching directory count",
1982
0
                              __FILE__, __LINE__, tif->tif_name);
1983
0
                return (0);
1984
0
            }
1985
0
            if (tif->tif_flags & TIFF_SWAB)
1986
0
                TIFFSwabLong8(&dircount64);
1987
0
            if (dircount64 > 0xFFFF)
1988
0
            {
1989
0
                TIFFErrorExtR(tif, module,
1990
0
                              "%s:%d: %s: Error fetching directory count",
1991
0
                              __FILE__, __LINE__, tif->tif_name);
1992
0
                return (0);
1993
0
            }
1994
0
            dircount16 = (uint16_t)dircount64;
1995
0
            if (off != NULL)
1996
0
                *off = TIFFSeekFile(tif, dircount16 * 20, SEEK_CUR);
1997
0
            else
1998
0
                (void)TIFFSeekFile(tif, dircount16 * 20, SEEK_CUR);
1999
0
            if (!ReadOK(tif, nextdiroff, sizeof(uint64_t)))
2000
0
            {
2001
0
                TIFFErrorExtR(tif, module, "%s: Error fetching directory link",
2002
0
                              tif->tif_name);
2003
0
                return (0);
2004
0
            }
2005
0
            if (tif->tif_flags & TIFF_SWAB)
2006
0
                TIFFSwabLong8(nextdiroff);
2007
0
        }
2008
0
    }
2009
0
    if (*nextdiroff != 0)
2010
0
    {
2011
0
        (*nextdirnum)++;
2012
        /* Check next directory for IFD looping and if so, set it as last
2013
         * directory. */
2014
0
        if (!_TIFFCheckDirNumberAndOffset(tif, *nextdirnum, *nextdiroff))
2015
0
        {
2016
0
            TIFFWarningExtR(
2017
0
                tif, module,
2018
0
                "the next directory %u at offset 0x%" PRIx64 " (%" PRIu64
2019
0
                ") might be an IFD loop. Treating directory %d as "
2020
0
                "last directory",
2021
0
                *nextdirnum, *nextdiroff, *nextdiroff, (int)(*nextdirnum) - 1);
2022
0
            *nextdiroff = 0;
2023
0
            (*nextdirnum)--;
2024
0
        }
2025
0
    }
2026
0
    return (1);
2027
0
}
2028
2029
/*
2030
 * Count the number of directories in a file.
2031
 */
2032
tdir_t TIFFNumberOfDirectories(TIFF *tif)
2033
0
{
2034
0
    uint64_t nextdiroff;
2035
0
    tdir_t nextdirnum;
2036
0
    tdir_t n;
2037
0
    if (!(tif->tif_flags & TIFF_BIGTIFF))
2038
0
        nextdiroff = tif->tif_header.classic.tiff_diroff;
2039
0
    else
2040
0
        nextdiroff = tif->tif_header.big.tiff_diroff;
2041
0
    nextdirnum = 0;
2042
0
    n = 0;
2043
0
    while (nextdiroff != 0 &&
2044
0
           TIFFAdvanceDirectory(tif, &nextdiroff, NULL, &nextdirnum))
2045
0
    {
2046
0
        ++n;
2047
0
    }
2048
    /* Update number of main-IFDs in file. */
2049
0
    tif->tif_curdircount = n;
2050
0
    return (n);
2051
0
}
2052
2053
/*
2054
 * Set the n-th directory as the current directory.
2055
 * NB: Directories are numbered starting at 0.
2056
 */
2057
int TIFFSetDirectory(TIFF *tif, tdir_t dirn)
2058
0
{
2059
0
    uint64_t nextdiroff;
2060
0
    tdir_t nextdirnum = 0;
2061
0
    tdir_t n;
2062
2063
0
    if (tif->tif_setdirectory_force_absolute)
2064
0
    {
2065
        /* tif_setdirectory_force_absolute=1 will force parsing the main IFD
2066
         * chain from the beginning, thus IFD directory list needs to be cleared
2067
         * from possible SubIFD offsets.
2068
         */
2069
0
        _TIFFCleanupIFDOffsetAndNumberMaps(tif); /* invalidate IFD loop lists */
2070
0
    }
2071
2072
    /* Even faster path, if offset is available within IFD loop hash list. */
2073
0
    if (!tif->tif_setdirectory_force_absolute &&
2074
0
        _TIFFGetOffsetFromDirNumber(tif, dirn, &nextdiroff))
2075
0
    {
2076
        /* Set parameters for following TIFFReadDirectory() below. */
2077
0
        tif->tif_nextdiroff = nextdiroff;
2078
0
        tif->tif_curdir = dirn;
2079
        /* Reset to relative stepping */
2080
0
        tif->tif_setdirectory_force_absolute = FALSE;
2081
0
    }
2082
0
    else
2083
0
    {
2084
2085
        /* Fast path when we just advance relative to the current directory:
2086
         * start at the current dir offset and continue to seek from there.
2087
         * Check special cases when relative is not allowed:
2088
         * - jump back from SubIFD or custom directory
2089
         * - right after TIFFWriteDirectory() jump back to that directory
2090
         *   using TIFFSetDirectory() */
2091
0
        const int relative = (dirn >= tif->tif_curdir) &&
2092
0
                             (tif->tif_diroff != 0) &&
2093
0
                             !tif->tif_setdirectory_force_absolute;
2094
2095
0
        if (relative)
2096
0
        {
2097
0
            nextdiroff = tif->tif_diroff;
2098
0
            dirn -= tif->tif_curdir;
2099
0
            nextdirnum = tif->tif_curdir;
2100
0
        }
2101
0
        else if (!(tif->tif_flags & TIFF_BIGTIFF))
2102
0
            nextdiroff = tif->tif_header.classic.tiff_diroff;
2103
0
        else
2104
0
            nextdiroff = tif->tif_header.big.tiff_diroff;
2105
2106
        /* Reset to relative stepping */
2107
0
        tif->tif_setdirectory_force_absolute = FALSE;
2108
2109
0
        for (n = dirn; n > 0 && nextdiroff != 0; n--)
2110
0
            if (!TIFFAdvanceDirectory(tif, &nextdiroff, NULL, &nextdirnum))
2111
0
                return (0);
2112
        /* If the n-th directory could not be reached (does not exist),
2113
         * return here without touching anything further. */
2114
0
        if (nextdiroff == 0 || n > 0)
2115
0
            return (0);
2116
2117
0
        tif->tif_nextdiroff = nextdiroff;
2118
2119
        /* Set curdir to the actual directory index. */
2120
0
        if (relative)
2121
0
            tif->tif_curdir += dirn - n;
2122
0
        else
2123
0
            tif->tif_curdir = dirn - n;
2124
0
    }
2125
2126
    /* The -1 decrement is because TIFFReadDirectory will increment
2127
     * tif_curdir after successfully reading the directory. */
2128
0
    if (tif->tif_curdir == 0)
2129
0
        tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2130
0
    else
2131
0
        tif->tif_curdir--;
2132
2133
0
    tdir_t curdir = tif->tif_curdir;
2134
2135
0
    int retval = TIFFReadDirectory(tif);
2136
2137
0
    if (!retval && tif->tif_curdir == curdir)
2138
0
    {
2139
        /* If tif_curdir has not be incremented, TIFFFetchDirectory() in
2140
         * TIFFReadDirectory() has failed and tif_curdir shall be set
2141
         * specifically. */
2142
0
        tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2143
0
    }
2144
0
    return (retval);
2145
0
}
2146
2147
/*
2148
 * Set the current directory to be the directory
2149
 * located at the specified file offset.  This interface
2150
 * is used mainly to access directories linked with
2151
 * the SubIFD tag (e.g. thumbnail images).
2152
 */
2153
int TIFFSetSubDirectory(TIFF *tif, uint64_t diroff)
2154
0
{
2155
    /* Match nextdiroff and curdir for consistent IFD-loop checking.
2156
     * Only with TIFFSetSubDirectory() the IFD list can be corrupted with
2157
     * invalid offsets within the main IFD tree. In the case of several subIFDs
2158
     * of a main image, there are two possibilities that are not even mutually
2159
     * exclusive. a.) The subIFD tag contains an array with all offsets of the
2160
     * subIFDs. b.) The SubIFDs are concatenated with their NextIFD parameters.
2161
     * (refer to
2162
     * https://www.awaresystems.be/imaging/tiff/specification/TIFFPM6.pdf.)
2163
     */
2164
0
    int retval;
2165
0
    uint32_t curdir = 0;
2166
0
    int8_t probablySubIFD = 0;
2167
0
    if (diroff == 0)
2168
0
    {
2169
        /* Special case to set tif_diroff=0, which is done in
2170
         * TIFFReadDirectory() below to indicate that the currently read IFD is
2171
         * treated as a new, fresh IFD. */
2172
0
        tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2173
0
        tif->tif_dir.td_iswrittentofile = FALSE;
2174
0
    }
2175
0
    else
2176
0
    {
2177
0
        if (!_TIFFGetDirNumberFromOffset(tif, diroff, &curdir))
2178
0
        {
2179
            /* Non-existing offsets might point to a SubIFD or invalid IFD.*/
2180
0
            probablySubIFD = 1;
2181
0
        }
2182
        /* -1 because TIFFReadDirectory() will increment tif_curdir. */
2183
0
        if (curdir >= 1)
2184
0
            tif->tif_curdir = curdir - 1;
2185
0
        else
2186
0
            tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2187
0
    }
2188
0
    curdir = tif->tif_curdir;
2189
2190
0
    tif->tif_nextdiroff = diroff;
2191
0
    retval = TIFFReadDirectory(tif);
2192
2193
    /* tif_curdir is incremented in TIFFReadDirectory(), but if it has not been
2194
     * incremented, TIFFFetchDirectory() has failed there and tif_curdir shall
2195
     * be set specifically. */
2196
0
    if (!retval && diroff != 0 && tif->tif_curdir == curdir)
2197
0
    {
2198
0
        tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2199
0
    }
2200
2201
0
    if (probablySubIFD)
2202
0
    {
2203
0
        if (retval)
2204
0
        {
2205
            /* Reset IFD list to start new one for SubIFD chain and also start
2206
             * SubIFD chain with tif_curdir=0 for IFD loop checking. */
2207
            /* invalidate IFD loop lists */
2208
0
            _TIFFCleanupIFDOffsetAndNumberMaps(tif);
2209
0
            tif->tif_curdir = 0; /* first directory of new chain */
2210
            /* add this offset to new IFD list */
2211
0
            retval = _TIFFCheckDirNumberAndOffset(tif, tif->tif_curdir, diroff);
2212
0
        }
2213
        /* To be able to return from SubIFD or custom-IFD to main-IFD */
2214
0
        tif->tif_setdirectory_force_absolute = TRUE;
2215
0
    }
2216
2217
0
    return (retval);
2218
0
}
2219
2220
/*
2221
 * Return file offset of the current directory.
2222
 */
2223
0
uint64_t TIFFCurrentDirOffset(TIFF *tif) { return (tif->tif_diroff); }
2224
2225
/*
2226
 * Return an indication of whether or not we are
2227
 * at the last directory in the file.
2228
 */
2229
0
int TIFFLastDirectory(TIFF *tif) { return (tif->tif_nextdiroff == 0); }
2230
2231
/*
2232
 * Unlink the specified directory from the directory chain.
2233
 * Note: First directory starts with number dirn=1.
2234
 * This is different to TIFFSetDirectory() where the first directory starts with
2235
 * zero.
2236
 */
2237
int TIFFUnlinkDirectory(TIFF *tif, tdir_t dirn)
2238
0
{
2239
0
    static const char module[] = "TIFFUnlinkDirectory";
2240
0
    uint64_t nextdir;
2241
0
    tdir_t nextdirnum;
2242
0
    uint64_t off;
2243
0
    tdir_t n;
2244
2245
0
    if (tif->tif_mode == O_RDONLY)
2246
0
    {
2247
0
        TIFFErrorExtR(tif, module,
2248
0
                      "Can not unlink directory in read-only file");
2249
0
        return (0);
2250
0
    }
2251
0
    if (dirn == 0)
2252
0
    {
2253
0
        TIFFErrorExtR(tif, module,
2254
0
                      "For TIFFUnlinkDirectory() first directory starts with "
2255
0
                      "number 1 and not 0");
2256
0
        return (0);
2257
0
    }
2258
    /*
2259
     * Go to the directory before the one we want
2260
     * to unlink and nab the offset of the link
2261
     * field we'll need to patch.
2262
     */
2263
0
    if (!(tif->tif_flags & TIFF_BIGTIFF))
2264
0
    {
2265
0
        nextdir = tif->tif_header.classic.tiff_diroff;
2266
0
        off = 4;
2267
0
    }
2268
0
    else
2269
0
    {
2270
0
        nextdir = tif->tif_header.big.tiff_diroff;
2271
0
        off = 8;
2272
0
    }
2273
0
    nextdirnum = 0; /* First directory is dirn=0 */
2274
2275
0
    for (n = dirn - 1; n > 0; n--)
2276
0
    {
2277
0
        if (nextdir == 0)
2278
0
        {
2279
0
            TIFFErrorExtR(tif, module, "Directory %u does not exist", dirn);
2280
0
            return (0);
2281
0
        }
2282
0
        if (!TIFFAdvanceDirectory(tif, &nextdir, &off, &nextdirnum))
2283
0
            return (0);
2284
0
    }
2285
    /*
2286
     * Advance to the directory to be unlinked and fetch
2287
     * the offset of the directory that follows.
2288
     */
2289
0
    if (!TIFFAdvanceDirectory(tif, &nextdir, NULL, &nextdirnum))
2290
0
        return (0);
2291
    /*
2292
     * Go back and patch the link field of the preceding
2293
     * directory to point to the offset of the directory
2294
     * that follows.
2295
     */
2296
0
    (void)TIFFSeekFile(tif, off, SEEK_SET);
2297
0
    if (!(tif->tif_flags & TIFF_BIGTIFF))
2298
0
    {
2299
0
        uint32_t nextdir32;
2300
0
        nextdir32 = (uint32_t)nextdir;
2301
0
        assert((uint64_t)nextdir32 == nextdir);
2302
0
        if (tif->tif_flags & TIFF_SWAB)
2303
0
            TIFFSwabLong(&nextdir32);
2304
0
        if (!WriteOK(tif, &nextdir32, sizeof(uint32_t)))
2305
0
        {
2306
0
            TIFFErrorExtR(tif, module, "Error writing directory link");
2307
0
            return (0);
2308
0
        }
2309
0
    }
2310
0
    else
2311
0
    {
2312
        /* Need local swap because nextdir has to be used unswapped below. */
2313
0
        uint64_t nextdir64 = nextdir;
2314
0
        if (tif->tif_flags & TIFF_SWAB)
2315
0
            TIFFSwabLong8(&nextdir64);
2316
0
        if (!WriteOK(tif, &nextdir64, sizeof(uint64_t)))
2317
0
        {
2318
0
            TIFFErrorExtR(tif, module, "Error writing directory link");
2319
0
            return (0);
2320
0
        }
2321
0
    }
2322
2323
    /* For dirn=1 (first directory) also update the libtiff internal
2324
     * base offset variables. */
2325
0
    if (dirn == 1)
2326
0
    {
2327
0
        if (!(tif->tif_flags & TIFF_BIGTIFF))
2328
0
            tif->tif_header.classic.tiff_diroff = (uint32_t)nextdir;
2329
0
        else
2330
0
            tif->tif_header.big.tiff_diroff = nextdir;
2331
0
    }
2332
2333
    /*
2334
     * Leave directory state setup safely.  We don't have
2335
     * facilities for doing inserting and removing directories,
2336
     * so it's safest to just invalidate everything.  This
2337
     * means that the caller can only append to the directory
2338
     * chain.
2339
     */
2340
0
    if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata)
2341
0
    {
2342
0
        _TIFFfreeExt(tif, tif->tif_rawdata);
2343
0
        tif->tif_rawdata = NULL;
2344
0
        tif->tif_rawcc = 0;
2345
0
        tif->tif_rawcp = NULL;
2346
0
        tif->tif_rawdataoff = 0;
2347
0
        tif->tif_rawdataloaded = 0;
2348
0
    }
2349
0
    tif->tif_flags &= ~(TIFF_BEENWRITING | TIFF_BUFFERSETUP | TIFF_POSTENCODE |
2350
0
                        TIFF_BUF4WRITE);
2351
0
    TIFFFreeDirectory(tif);
2352
0
    TIFFDefaultDirectory(tif);
2353
0
    tif->tif_diroff = 0;     /* force link on next write */
2354
0
    tif->tif_nextdiroff = 0; /* next write must be at end */
2355
0
    tif->tif_lastdiroff = 0; /* will be updated on next link */
2356
0
    tif->tif_curoff = 0;
2357
0
    tif->tif_row = (uint32_t)-1;
2358
0
    tif->tif_curstrip = (uint32_t)-1;
2359
0
    tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2360
0
    if (tif->tif_curdircount > 0)
2361
0
        tif->tif_curdircount--;
2362
0
    else
2363
0
        tif->tif_curdircount = TIFF_NON_EXISTENT_DIR_NUMBER;
2364
0
    _TIFFCleanupIFDOffsetAndNumberMaps(tif); /* invalidate IFD loop lists */
2365
0
    return (1);
2366
0
}