Coverage Report

Created: 2026-10-28 07:26

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libtiff/libtiff/tif_next.c
Line
Count
Source
1
/*
2
 * Copyright (c) 1988-1997 Sam Leffler
3
 * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4
 *
5
 * Permission to use, copy, modify, distribute, and sell this software and
6
 * its documentation for any purpose is hereby granted without fee, provided
7
 * that (i) the above copyright notices and this permission notice appear in
8
 * all copies of the software and related documentation, and (ii) the names of
9
 * Sam Leffler and Silicon Graphics may not be used in any advertising or
10
 * publicity relating to the software without the specific, prior written
11
 * permission of Sam Leffler and Silicon Graphics.
12
 *
13
 * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14
 * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15
 * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16
 *
17
 * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18
 * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19
 * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20
 * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21
 * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22
 * OF THIS SOFTWARE.
23
 */
24
25
#include "tiffiop.h"
26
#ifdef NEXT_SUPPORT
27
/*
28
 * TIFF Library.
29
 *
30
 * NeXT 2-bit Grey Scale Compression Algorithm Support
31
 */
32
33
#define SETPIXEL(op, v)                                                        \
34
8.83M
    {                                                                          \
35
8.83M
        switch (npixels++ & 3)                                                 \
36
8.83M
        {                                                                      \
37
2.21M
            case 0:                                                            \
38
2.21M
                op[0] = (unsigned char)((v) << 6);                             \
39
2.21M
                break;                                                         \
40
2.20M
            case 1:                                                            \
41
2.20M
                op[0] |= (unsigned char)((v) << 4);                            \
42
2.20M
                break;                                                         \
43
2.20M
            case 2:                                                            \
44
2.20M
                op[0] |= (unsigned char)((v) << 2);                            \
45
2.20M
                break;                                                         \
46
2.20M
            case 3:                                                            \
47
2.20M
                *op++ |= (unsigned char)(v);                                   \
48
2.20M
                op_offset++;                                                   \
49
2.20M
                break;                                                         \
50
0
            default:                                                           \
51
0
                break;                                                         \
52
8.83M
        }                                                                      \
53
8.83M
    }
54
55
4.07k
#define LITERALROW 0x00
56
871
#define LITERALSPAN 0x40
57
58
static int NeXTDecode(TIFF *tif, uint8_t *buf, tmsize_t occ, uint16_t s)
59
73.1k
{
60
73.1k
    static const char module[] = "NeXTDecode";
61
73.1k
    unsigned char *bp, *op;
62
73.1k
    tmsize_t cc;
63
73.1k
    uint8_t *row;
64
73.1k
    tmsize_t scanline, n;
65
66
73.1k
    (void)s;
67
    /*
68
     * Each scanline is assumed to start off as all
69
     * white (we assume a PhotometricInterpretation
70
     * of ``min-is-black'').
71
     */
72
31.1M
    for (op = (unsigned char *)buf, cc = occ; cc-- > 0;)
73
31.0M
        *op++ = 0xff;
74
75
73.1k
    bp = (unsigned char *)tif->tif_rawcp;
76
73.1k
    cc = tif->tif_rawcc;
77
73.1k
    scanline = tif->tif_dir.td_scanlinesize;
78
73.1k
    if (occ % scanline)
79
0
    {
80
0
        TIFFErrorExtR(tif, module, "Fractional scanlines cannot be read");
81
0
        return (0);
82
0
    }
83
91.2k
    for (row = buf; cc > 0 && occ > 0; occ -= scanline, row += scanline)
84
18.2k
    {
85
18.2k
        n = *bp++;
86
18.2k
        cc--;
87
18.2k
        switch (n)
88
18.2k
        {
89
4.07k
            case LITERALROW:
90
                /*
91
                 * The entire scanline is given as literal values.
92
                 */
93
4.07k
                if (cc < scanline)
94
23
                    goto bad;
95
4.05k
                _TIFFmemcpy(row, bp, scanline);
96
4.05k
                bp += scanline;
97
4.05k
                cc -= scanline;
98
4.05k
                break;
99
871
            case LITERALSPAN:
100
871
            {
101
871
                tmsize_t off;
102
                /*
103
                 * The scanline has a literal span that begins at some
104
                 * offset.
105
                 */
106
871
                if (cc < 4)
107
3
                    goto bad;
108
868
                off = (bp[0] * 256) + bp[1];
109
868
                n = (bp[2] * 256) + bp[3];
110
868
                if (cc < 4 + n || off + n > scanline)
111
18
                    goto bad;
112
850
                _TIFFmemcpy(row + off, bp + 4, n);
113
850
                bp += 4 + n;
114
850
                cc -= 4 + n;
115
850
                break;
116
868
            }
117
13.3k
            default:
118
13.3k
            {
119
13.3k
                uint32_t npixels = 0, grey;
120
13.3k
                tmsize_t op_offset = 0;
121
13.3k
                uint32_t imagewidth = tif->tif_dir.td_imagewidth;
122
13.3k
                if (isTiled(tif))
123
239
                    imagewidth = tif->tif_dir.td_tilewidth;
124
125
                /*
126
                 * The scanline is composed of a sequence of constant
127
                 * color ``runs''.  We shift into ``run mode'' and
128
                 * interpret bytes as codes of the form
129
                 * <color><npixels> until we've filled the scanline.
130
                 */
131
13.3k
                op = row;
132
13.3k
                for (;;)
133
288k
                {
134
288k
                    grey = (uint32_t)((n >> 6) & 0x3);
135
288k
                    n &= 0x3f;
136
                    /*
137
                     * Ensure the run does not exceed the scanline
138
                     * bounds, potentially resulting in a security
139
                     * issue.
140
                     */
141
9.12M
                    while (n-- > 0 && npixels < imagewidth &&
142
8.83M
                           op_offset < scanline)
143
8.83M
                        SETPIXEL(op, grey);
144
288k
                    if (npixels >= imagewidth)
145
13.2k
                        break;
146
275k
                    if (op_offset >= scanline)
147
0
                    {
148
0
                        TIFFErrorExtR(tif, module,
149
0
                                      "Invalid data for scanline %" PRIu32,
150
0
                                      tif->tif_dir.td_row);
151
0
                        return (0);
152
0
                    }
153
275k
                    if (cc == 0)
154
76
                        goto bad;
155
275k
                    n = *bp++;
156
275k
                    cc--;
157
275k
                }
158
13.2k
                break;
159
13.3k
            }
160
18.2k
        }
161
18.2k
    }
162
72.9k
    tif->tif_rawcp = (uint8_t *)bp;
163
72.9k
    tif->tif_rawcc = cc;
164
72.9k
    return (1);
165
120
bad:
166
120
    TIFFErrorExtR(tif, module, "Not enough data for scanline %" PRIu32,
167
120
                  tif->tif_dir.td_row);
168
120
    return (0);
169
73.1k
}
170
171
static int NeXTPreDecode(TIFF *tif, uint16_t s)
172
447
{
173
447
    static const char module[] = "NeXTPreDecode";
174
447
    TIFFDirectory *td = &tif->tif_dir;
175
447
    (void)s;
176
177
447
    if (td->td_bitspersample != 2)
178
9
    {
179
9
        TIFFErrorExtR(tif, module, "Unsupported BitsPerSample = %" PRIu16,
180
9
                      td->td_bitspersample);
181
9
        return (0);
182
9
    }
183
438
    return (1);
184
447
}
185
186
int TIFFInitNeXT(TIFF *tif, int scheme)
187
479
{
188
479
    (void)scheme;
189
479
    tif->tif_predecode = NeXTPreDecode;
190
479
    tif->tif_decoderow = NeXTDecode;
191
479
    tif->tif_decodestrip = NeXTDecode;
192
479
    tif->tif_decodetile = NeXTDecode;
193
479
    return (1);
194
479
}
195
#endif /* NEXT_SUPPORT */