Coverage Report

Created: 2025-11-14 07:32

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libtiff/libtiff/tif_dir.c
Line
Count
Source
1
/*
2
 * Copyright (c) 1988-1997 Sam Leffler
3
 * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4
 *
5
 * Permission to use, copy, modify, distribute, and sell this software and
6
 * its documentation for any purpose is hereby granted without fee, provided
7
 * that (i) the above copyright notices and this permission notice appear in
8
 * all copies of the software and related documentation, and (ii) the names of
9
 * Sam Leffler and Silicon Graphics may not be used in any advertising or
10
 * publicity relating to the software without the specific, prior written
11
 * permission of Sam Leffler and Silicon Graphics.
12
 *
13
 * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14
 * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15
 * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16
 *
17
 * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18
 * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19
 * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20
 * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21
 * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22
 * OF THIS SOFTWARE.
23
 */
24
25
/*
26
 * TIFF Library.
27
 *
28
 * Directory Tag Get & Set Routines.
29
 * (and also some miscellaneous stuff)
30
 */
31
#include "tiffiop.h"
32
#include <float.h> /*--: for Rational2Double */
33
#include <limits.h>
34
35
/*
36
 * These are used in the backwards compatibility code...
37
 */
38
307
#define DATATYPE_VOID 0   /* !untyped data */
39
441
#define DATATYPE_INT 1    /* !signed integer data */
40
23
#define DATATYPE_UINT 2   /* !unsigned integer data */
41
203
#define DATATYPE_IEEEFP 3 /* !IEEE floating point data */
42
43
static void setByteArray(TIFF *tif, void **vpp, const void *vp, size_t nmemb,
44
                         size_t elem_size)
45
102k
{
46
102k
    if (*vpp)
47
683
    {
48
683
        _TIFFfreeExt(tif, *vpp);
49
683
        *vpp = 0;
50
683
    }
51
102k
    if (vp)
52
89.5k
    {
53
89.5k
        tmsize_t bytes = _TIFFMultiplySSize(NULL, nmemb, elem_size, NULL);
54
89.5k
        if (bytes)
55
89.5k
            *vpp = (void *)_TIFFmallocExt(tif, bytes);
56
89.5k
        if (*vpp)
57
89.5k
            _TIFFmemcpy(*vpp, vp, bytes);
58
89.5k
    }
59
102k
}
60
void _TIFFsetByteArray(void **vpp, const void *vp, uint32_t n)
61
0
{
62
0
    setByteArray(NULL, vpp, vp, n, 1);
63
0
}
64
void _TIFFsetByteArrayExt(TIFF *tif, void **vpp, const void *vp, uint32_t n)
65
261
{
66
261
    setByteArray(tif, vpp, vp, n, 1);
67
261
}
68
69
static void _TIFFsetNString(TIFF *tif, char **cpp, const char *cp, uint32_t n)
70
1.27k
{
71
1.27k
    setByteArray(tif, (void **)cpp, cp, n, 1);
72
1.27k
}
73
74
void _TIFFsetShortArray(uint16_t **wpp, const uint16_t *wp, uint32_t n)
75
0
{
76
0
    setByteArray(NULL, (void **)wpp, wp, n, sizeof(uint16_t));
77
0
}
78
void _TIFFsetShortArrayExt(TIFF *tif, uint16_t **wpp, const uint16_t *wp,
79
                           uint32_t n)
80
37.1k
{
81
37.1k
    setByteArray(tif, (void **)wpp, wp, n, sizeof(uint16_t));
82
37.1k
}
83
84
void _TIFFsetLongArray(uint32_t **lpp, const uint32_t *lp, uint32_t n)
85
0
{
86
0
    setByteArray(NULL, (void **)lpp, lp, n, sizeof(uint32_t));
87
0
}
88
void _TIFFsetLongArrayExt(TIFF *tif, uint32_t **lpp, const uint32_t *lp,
89
                          uint32_t n)
90
0
{
91
0
    setByteArray(tif, (void **)lpp, lp, n, sizeof(uint32_t));
92
0
}
93
94
static void _TIFFsetLong8Array(TIFF *tif, uint64_t **lpp, const uint64_t *lp,
95
                               uint32_t n)
96
608
{
97
608
    setByteArray(tif, (void **)lpp, lp, n, sizeof(uint64_t));
98
608
}
99
100
void _TIFFsetFloatArray(float **fpp, const float *fp, uint32_t n)
101
0
{
102
0
    setByteArray(NULL, (void **)fpp, fp, n, sizeof(float));
103
0
}
104
void _TIFFsetFloatArrayExt(TIFF *tif, float **fpp, const float *fp, uint32_t n)
105
1.34k
{
106
1.34k
    setByteArray(tif, (void **)fpp, fp, n, sizeof(float));
107
1.34k
}
108
109
void _TIFFsetDoubleArray(double **dpp, const double *dp, uint32_t n)
110
0
{
111
0
    setByteArray(NULL, (void **)dpp, dp, n, sizeof(double));
112
0
}
113
void _TIFFsetDoubleArrayExt(TIFF *tif, double **dpp, const double *dp,
114
                            uint32_t n)
115
4.06k
{
116
4.06k
    setByteArray(tif, (void **)dpp, dp, n, sizeof(double));
117
4.06k
}
118
119
static void setDoubleArrayOneValue(TIFF *tif, double **vpp, double value,
120
                                   size_t nmemb)
121
2.43k
{
122
2.43k
    if (*vpp)
123
0
        _TIFFfreeExt(tif, *vpp);
124
2.43k
    *vpp = _TIFFmallocExt(tif, nmemb * sizeof(double));
125
2.43k
    if (*vpp)
126
2.43k
    {
127
10.0k
        while (nmemb--)
128
7.63k
            ((double *)*vpp)[nmemb] = value;
129
2.43k
    }
130
2.43k
}
131
132
/*
133
 * Install extra samples information.
134
 */
135
static int setExtraSamples(TIFF *tif, va_list ap, uint32_t *v)
136
15.6k
{
137
/* XXX: Unassociated alpha data == 999 is a known Corel Draw bug, see below */
138
15.6k
#define EXTRASAMPLE_COREL_UNASSALPHA 999
139
140
15.6k
    uint16_t *va;
141
15.6k
    uint32_t i;
142
15.6k
    TIFFDirectory *td = &tif->tif_dir;
143
15.6k
    static const char module[] = "setExtraSamples";
144
145
15.6k
    *v = (uint16_t)va_arg(ap, uint16_vap);
146
15.6k
    if ((uint16_t)*v > td->td_samplesperpixel)
147
63
        return 0;
148
15.5k
    va = va_arg(ap, uint16_t *);
149
15.5k
    if (*v > 0 && va == NULL) /* typically missing param */
150
0
        return 0;
151
29.7k
    for (i = 0; i < *v; i++)
152
14.3k
    {
153
14.3k
        if (va[i] > EXTRASAMPLE_UNASSALPHA)
154
212
        {
155
            /*
156
             * XXX: Corel Draw is known to produce incorrect
157
             * ExtraSamples tags which must be patched here if we
158
             * want to be able to open some of the damaged TIFF
159
             * files:
160
             */
161
212
            if (va[i] == EXTRASAMPLE_COREL_UNASSALPHA)
162
25
                va[i] = EXTRASAMPLE_UNASSALPHA;
163
187
            else
164
187
                return 0;
165
212
        }
166
14.3k
    }
167
168
15.3k
    if (td->td_transferfunction[0] != NULL &&
169
0
        (td->td_samplesperpixel - *v > 1) &&
170
0
        !(td->td_samplesperpixel - td->td_extrasamples > 1))
171
0
    {
172
0
        TIFFWarningExtR(tif, module,
173
0
                        "ExtraSamples tag value is changing, "
174
0
                        "but TransferFunction was read with a different value. "
175
0
                        "Canceling it");
176
0
        TIFFClrFieldBit(tif, FIELD_TRANSFERFUNCTION);
177
0
        _TIFFfreeExt(tif, td->td_transferfunction[0]);
178
0
        td->td_transferfunction[0] = NULL;
179
0
    }
180
181
15.3k
    td->td_extrasamples = (uint16_t)*v;
182
15.3k
    _TIFFsetShortArrayExt(tif, &td->td_sampleinfo, va, td->td_extrasamples);
183
15.3k
    return 1;
184
185
15.5k
#undef EXTRASAMPLE_COREL_UNASSALPHA
186
15.5k
}
187
188
/*
189
 * Count ink names separated by \0.  Returns
190
 * zero if the ink names are not as expected.
191
 */
192
static uint16_t countInkNamesString(TIFF *tif, uint32_t slen, const char *s)
193
1.38k
{
194
1.38k
    uint16_t i = 0;
195
196
1.38k
    if (slen > 0)
197
1.27k
    {
198
1.27k
        const char *ep = s + slen;
199
1.27k
        const char *cp = s;
200
1.27k
        do
201
13.3k
        {
202
35.1k
            for (; cp < ep && *cp != '\0'; cp++)
203
21.7k
            {
204
21.7k
            }
205
13.3k
            if (cp >= ep)
206
0
                goto bad;
207
13.3k
            cp++; /* skip \0 */
208
13.3k
            i++;
209
13.3k
        } while (cp < ep);
210
1.27k
        return (i);
211
1.27k
    }
212
105
bad:
213
105
    TIFFErrorExtR(tif, "TIFFSetField",
214
105
                  "%s: Invalid InkNames value; no null at given buffer end "
215
105
                  "location %" PRIu32 ", after %" PRIu16 " ink",
216
105
                  tif->tif_name, slen, i);
217
105
    return (0);
218
1.38k
}
219
220
static int _TIFFVSetField(TIFF *tif, uint32_t tag, va_list ap)
221
2.19M
{
222
2.19M
    static const char module[] = "_TIFFVSetField";
223
224
2.19M
    TIFFDirectory *td = &tif->tif_dir;
225
2.19M
    int status = 1;
226
2.19M
    uint32_t v32, v;
227
2.19M
    double dblval;
228
2.19M
    char *s;
229
2.19M
    const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
230
2.19M
    uint32_t standard_tag = tag;
231
2.19M
    if (fip == NULL) /* cannot happen since OkToChangeTag() already checks it */
232
0
        return 0;
233
    /*
234
     * We want to force the custom code to be used for custom
235
     * fields even if the tag happens to match a well known
236
     * one - important for reinterpreted handling of standard
237
     * tag values in custom directories (i.e. EXIF)
238
     */
239
2.19M
    if (fip->field_bit == FIELD_CUSTOM)
240
500k
    {
241
500k
        standard_tag = 0;
242
500k
    }
243
244
2.19M
    switch (standard_tag)
245
2.19M
    {
246
2.38k
        case TIFFTAG_SUBFILETYPE:
247
2.38k
            td->td_subfiletype = (uint32_t)va_arg(ap, uint32_t);
248
2.38k
            break;
249
185k
        case TIFFTAG_IMAGEWIDTH:
250
185k
            td->td_imagewidth = (uint32_t)va_arg(ap, uint32_t);
251
185k
            break;
252
175k
        case TIFFTAG_IMAGELENGTH:
253
175k
            td->td_imagelength = (uint32_t)va_arg(ap, uint32_t);
254
175k
            break;
255
99.1k
        case TIFFTAG_BITSPERSAMPLE:
256
99.1k
            td->td_bitspersample = (uint16_t)va_arg(ap, uint16_vap);
257
            /*
258
             * If the data require post-decoding processing to byte-swap
259
             * samples, set it up here.  Note that since tags are required
260
             * to be ordered, compression code can override this behavior
261
             * in the setup method if it wants to roll the post decoding
262
             * work in with its normal work.
263
             */
264
99.1k
            if (tif->tif_flags & TIFF_SWAB)
265
29.2k
            {
266
29.2k
                if (td->td_bitspersample == 8)
267
17.2k
                    tif->tif_postdecode = _TIFFNoPostDecode;
268
11.9k
                else if (td->td_bitspersample == 16)
269
1.76k
                    tif->tif_postdecode = _TIFFSwab16BitData;
270
10.2k
                else if (td->td_bitspersample == 24)
271
780
                    tif->tif_postdecode = _TIFFSwab24BitData;
272
9.44k
                else if (td->td_bitspersample == 32)
273
1.65k
                    tif->tif_postdecode = _TIFFSwab32BitData;
274
7.79k
                else if (td->td_bitspersample == 64)
275
658
                    tif->tif_postdecode = _TIFFSwab64BitData;
276
7.13k
                else if (td->td_bitspersample == 128) /* two 64's */
277
9
                    tif->tif_postdecode = _TIFFSwab64BitData;
278
29.2k
            }
279
99.1k
            break;
280
441k
        case TIFFTAG_COMPRESSION:
281
441k
            v = (uint16_t)va_arg(ap, uint16_vap);
282
            /*
283
             * If we're changing the compression scheme, notify the
284
             * previous module so that it can cleanup any state it's
285
             * setup.
286
             */
287
441k
            if (TIFFFieldSet(tif, FIELD_COMPRESSION))
288
203k
            {
289
203k
                if ((uint32_t)td->td_compression == v)
290
98.2k
                    break;
291
105k
                (*tif->tif_cleanup)(tif);
292
105k
                tif->tif_flags &= ~TIFF_CODERSETUP;
293
105k
            }
294
            /*
295
             * Setup new compression routine state.
296
             */
297
343k
            if ((status = TIFFSetCompressionScheme(tif, v)) != 0)
298
343k
                td->td_compression = (uint16_t)v;
299
0
            else
300
0
                status = 0;
301
343k
            break;
302
163k
        case TIFFTAG_PHOTOMETRIC:
303
163k
            td->td_photometric = (uint16_t)va_arg(ap, uint16_vap);
304
163k
            break;
305
654
        case TIFFTAG_THRESHHOLDING:
306
654
            td->td_threshholding = (uint16_t)va_arg(ap, uint16_vap);
307
654
            break;
308
10.8k
        case TIFFTAG_FILLORDER:
309
10.8k
            v = (uint16_t)va_arg(ap, uint16_vap);
310
10.8k
            if (v != FILLORDER_LSB2MSB && v != FILLORDER_MSB2LSB)
311
334
                goto badvalue;
312
10.5k
            td->td_fillorder = (uint16_t)v;
313
10.5k
            break;
314
27.5k
        case TIFFTAG_ORIENTATION:
315
27.5k
            v = (uint16_t)va_arg(ap, uint16_vap);
316
27.5k
            if (v < ORIENTATION_TOPLEFT || ORIENTATION_LEFTBOT < v)
317
537
                goto badvalue;
318
27.0k
            else
319
27.0k
                td->td_orientation = (uint16_t)v;
320
27.0k
            break;
321
102k
        case TIFFTAG_SAMPLESPERPIXEL:
322
102k
            v = (uint16_t)va_arg(ap, uint16_vap);
323
102k
            if (v == 0)
324
8
                goto badvalue;
325
102k
            if (v != td->td_samplesperpixel)
326
85.8k
            {
327
                /* See http://bugzilla.maptools.org/show_bug.cgi?id=2500 */
328
85.8k
                if (td->td_sminsamplevalue != NULL)
329
402
                {
330
402
                    TIFFWarningExtR(tif, module,
331
402
                                    "SamplesPerPixel tag value is changing, "
332
402
                                    "but SMinSampleValue tag was read with a "
333
402
                                    "different value. Canceling it");
334
402
                    TIFFClrFieldBit(tif, FIELD_SMINSAMPLEVALUE);
335
402
                    _TIFFfreeExt(tif, td->td_sminsamplevalue);
336
402
                    td->td_sminsamplevalue = NULL;
337
402
                }
338
85.8k
                if (td->td_smaxsamplevalue != NULL)
339
486
                {
340
486
                    TIFFWarningExtR(tif, module,
341
486
                                    "SamplesPerPixel tag value is changing, "
342
486
                                    "but SMaxSampleValue tag was read with a "
343
486
                                    "different value. Canceling it");
344
486
                    TIFFClrFieldBit(tif, FIELD_SMAXSAMPLEVALUE);
345
486
                    _TIFFfreeExt(tif, td->td_smaxsamplevalue);
346
486
                    td->td_smaxsamplevalue = NULL;
347
486
                }
348
                /* Test if 3 transfer functions instead of just one are now
349
                   needed See http://bugzilla.maptools.org/show_bug.cgi?id=2820
350
                 */
351
85.8k
                if (td->td_transferfunction[0] != NULL &&
352
15
                    (v - td->td_extrasamples > 1) &&
353
15
                    !(td->td_samplesperpixel - td->td_extrasamples > 1))
354
15
                {
355
15
                    TIFFWarningExtR(tif, module,
356
15
                                    "SamplesPerPixel tag value is changing, "
357
15
                                    "but TransferFunction was read with a "
358
15
                                    "different value. Canceling it");
359
15
                    TIFFClrFieldBit(tif, FIELD_TRANSFERFUNCTION);
360
15
                    _TIFFfreeExt(tif, td->td_transferfunction[0]);
361
15
                    td->td_transferfunction[0] = NULL;
362
15
                }
363
85.8k
            }
364
102k
            td->td_samplesperpixel = (uint16_t)v;
365
102k
            break;
366
86.7k
        case TIFFTAG_ROWSPERSTRIP:
367
86.7k
            v32 = (uint32_t)va_arg(ap, uint32_t);
368
86.7k
            if (v32 == 0)
369
2.98k
                goto badvalue32;
370
83.8k
            td->td_rowsperstrip = v32;
371
83.8k
            if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS))
372
83.3k
            {
373
83.3k
                td->td_tilelength = v32;
374
83.3k
                td->td_tilewidth = td->td_imagewidth;
375
83.3k
            }
376
83.8k
            break;
377
1.52k
        case TIFFTAG_MINSAMPLEVALUE:
378
1.52k
            td->td_minsamplevalue = (uint16_t)va_arg(ap, uint16_vap);
379
1.52k
            break;
380
969
        case TIFFTAG_MAXSAMPLEVALUE:
381
969
            td->td_maxsamplevalue = (uint16_t)va_arg(ap, uint16_vap);
382
969
            break;
383
3.44k
        case TIFFTAG_SMINSAMPLEVALUE:
384
3.44k
            if (tif->tif_flags & TIFF_PERSAMPLE)
385
2.22k
                _TIFFsetDoubleArrayExt(tif, &td->td_sminsamplevalue,
386
2.22k
                                       va_arg(ap, double *),
387
2.22k
                                       td->td_samplesperpixel);
388
1.21k
            else
389
1.21k
                setDoubleArrayOneValue(tif, &td->td_sminsamplevalue,
390
1.21k
                                       va_arg(ap, double),
391
1.21k
                                       td->td_samplesperpixel);
392
3.44k
            break;
393
3.05k
        case TIFFTAG_SMAXSAMPLEVALUE:
394
3.05k
            if (tif->tif_flags & TIFF_PERSAMPLE)
395
1.83k
                _TIFFsetDoubleArrayExt(tif, &td->td_smaxsamplevalue,
396
1.83k
                                       va_arg(ap, double *),
397
1.83k
                                       td->td_samplesperpixel);
398
1.21k
            else
399
1.21k
                setDoubleArrayOneValue(tif, &td->td_smaxsamplevalue,
400
1.21k
                                       va_arg(ap, double),
401
1.21k
                                       td->td_samplesperpixel);
402
3.05k
            break;
403
5.68k
        case TIFFTAG_XRESOLUTION:
404
5.68k
            dblval = va_arg(ap, double);
405
5.68k
            if (dblval != dblval || dblval < 0)
406
155
                goto badvaluedouble;
407
5.52k
            td->td_xresolution = _TIFFClampDoubleToFloat(dblval);
408
5.52k
            break;
409
5.96k
        case TIFFTAG_YRESOLUTION:
410
5.96k
            dblval = va_arg(ap, double);
411
5.96k
            if (dblval != dblval || dblval < 0)
412
185
                goto badvaluedouble;
413
5.78k
            td->td_yresolution = _TIFFClampDoubleToFloat(dblval);
414
5.78k
            break;
415
229k
        case TIFFTAG_PLANARCONFIG:
416
229k
            v = (uint16_t)va_arg(ap, uint16_vap);
417
229k
            if (v != PLANARCONFIG_CONTIG && v != PLANARCONFIG_SEPARATE)
418
54
                goto badvalue;
419
229k
            td->td_planarconfig = (uint16_t)v;
420
229k
            break;
421
3.60k
        case TIFFTAG_XPOSITION:
422
3.60k
            td->td_xposition = _TIFFClampDoubleToFloat(va_arg(ap, double));
423
3.60k
            break;
424
2.36k
        case TIFFTAG_YPOSITION:
425
2.36k
            td->td_yposition = _TIFFClampDoubleToFloat(va_arg(ap, double));
426
2.36k
            break;
427
3.78k
        case TIFFTAG_RESOLUTIONUNIT:
428
3.78k
            v = (uint16_t)va_arg(ap, uint16_vap);
429
3.78k
            if (v < RESUNIT_NONE || RESUNIT_CENTIMETER < v)
430
461
                goto badvalue;
431
3.32k
            td->td_resolutionunit = (uint16_t)v;
432
3.32k
            break;
433
17.5k
        case TIFFTAG_PAGENUMBER:
434
17.5k
            td->td_pagenumber[0] = (uint16_t)va_arg(ap, uint16_vap);
435
17.5k
            td->td_pagenumber[1] = (uint16_t)va_arg(ap, uint16_vap);
436
17.5k
            break;
437
176
        case TIFFTAG_HALFTONEHINTS:
438
176
            td->td_halftonehints[0] = (uint16_t)va_arg(ap, uint16_vap);
439
176
            td->td_halftonehints[1] = (uint16_t)va_arg(ap, uint16_vap);
440
176
            break;
441
2.20k
        case TIFFTAG_COLORMAP:
442
2.20k
            v32 = (uint32_t)(1L << td->td_bitspersample);
443
2.20k
            _TIFFsetShortArrayExt(tif, &td->td_colormap[0],
444
2.20k
                                  va_arg(ap, uint16_t *), v32);
445
2.20k
            _TIFFsetShortArrayExt(tif, &td->td_colormap[1],
446
2.20k
                                  va_arg(ap, uint16_t *), v32);
447
2.20k
            _TIFFsetShortArrayExt(tif, &td->td_colormap[2],
448
2.20k
                                  va_arg(ap, uint16_t *), v32);
449
2.20k
            break;
450
15.6k
        case TIFFTAG_EXTRASAMPLES:
451
15.6k
            if (!setExtraSamples(tif, ap, &v))
452
250
                goto badvalue;
453
15.3k
            break;
454
15.3k
        case TIFFTAG_MATTEING:
455
673
            td->td_extrasamples = (((uint16_t)va_arg(ap, uint16_vap)) != 0);
456
673
            if (td->td_extrasamples)
457
560
            {
458
560
                uint16_t sv = EXTRASAMPLE_ASSOCALPHA;
459
560
                _TIFFsetShortArrayExt(tif, &td->td_sampleinfo, &sv, 1);
460
560
            }
461
673
            break;
462
22.2k
        case TIFFTAG_TILEWIDTH:
463
22.2k
            v32 = (uint32_t)va_arg(ap, uint32_t);
464
22.2k
            if (v32 % 16)
465
19.1k
            {
466
19.1k
                if (tif->tif_mode != O_RDONLY)
467
0
                    goto badvalue32;
468
19.1k
                TIFFWarningExtR(
469
19.1k
                    tif, tif->tif_name,
470
19.1k
                    "Nonstandard tile width %" PRIu32 ", convert file", v32);
471
19.1k
            }
472
22.2k
            td->td_tilewidth = v32;
473
22.2k
            tif->tif_flags |= TIFF_ISTILED;
474
22.2k
            break;
475
21.5k
        case TIFFTAG_TILELENGTH:
476
21.5k
            v32 = (uint32_t)va_arg(ap, uint32_t);
477
21.5k
            if (v32 % 16)
478
17.1k
            {
479
17.1k
                if (tif->tif_mode != O_RDONLY)
480
0
                    goto badvalue32;
481
17.1k
                TIFFWarningExtR(
482
17.1k
                    tif, tif->tif_name,
483
17.1k
                    "Nonstandard tile length %" PRIu32 ", convert file", v32);
484
17.1k
            }
485
21.5k
            td->td_tilelength = v32;
486
21.5k
            tif->tif_flags |= TIFF_ISTILED;
487
21.5k
            break;
488
492
        case TIFFTAG_TILEDEPTH:
489
492
            v32 = (uint32_t)va_arg(ap, uint32_t);
490
492
            if (v32 == 0)
491
7
                goto badvalue32;
492
485
            td->td_tiledepth = v32;
493
485
            break;
494
982
        case TIFFTAG_DATATYPE:
495
982
            v = (uint16_t)va_arg(ap, uint16_vap);
496
982
            switch (v)
497
982
            {
498
307
                case DATATYPE_VOID:
499
307
                    v = SAMPLEFORMAT_VOID;
500
307
                    break;
501
441
                case DATATYPE_INT:
502
441
                    v = SAMPLEFORMAT_INT;
503
441
                    break;
504
23
                case DATATYPE_UINT:
505
23
                    v = SAMPLEFORMAT_UINT;
506
23
                    break;
507
203
                case DATATYPE_IEEEFP:
508
203
                    v = SAMPLEFORMAT_IEEEFP;
509
203
                    break;
510
8
                default:
511
8
                    goto badvalue;
512
982
            }
513
974
            td->td_sampleformat = (uint16_t)v;
514
974
            break;
515
21.3k
        case TIFFTAG_SAMPLEFORMAT:
516
21.3k
            v = (uint16_t)va_arg(ap, uint16_vap);
517
21.3k
            if (v < SAMPLEFORMAT_UINT || SAMPLEFORMAT_COMPLEXIEEEFP < v)
518
50
                goto badvalue;
519
21.3k
            td->td_sampleformat = (uint16_t)v;
520
521
            /*  Try to fix up the SWAB function for complex data. */
522
21.3k
            if (td->td_sampleformat == SAMPLEFORMAT_COMPLEXINT &&
523
3.43k
                td->td_bitspersample == 32 &&
524
124
                tif->tif_postdecode == _TIFFSwab32BitData)
525
14
                tif->tif_postdecode = _TIFFSwab16BitData;
526
21.3k
            else if ((td->td_sampleformat == SAMPLEFORMAT_COMPLEXINT ||
527
17.8k
                      td->td_sampleformat == SAMPLEFORMAT_COMPLEXIEEEFP) &&
528
3.64k
                     td->td_bitspersample == 64 &&
529
12
                     tif->tif_postdecode == _TIFFSwab64BitData)
530
7
                tif->tif_postdecode = _TIFFSwab32BitData;
531
21.3k
            break;
532
719
        case TIFFTAG_IMAGEDEPTH:
533
719
            td->td_imagedepth = (uint32_t)va_arg(ap, uint32_t);
534
719
            break;
535
608
        case TIFFTAG_SUBIFD:
536
608
            if ((tif->tif_flags & TIFF_INSUBIFD) == 0)
537
608
            {
538
608
                td->td_nsubifd = (uint16_t)va_arg(ap, uint16_vap);
539
608
                _TIFFsetLong8Array(tif, &td->td_subifd,
540
608
                                   (uint64_t *)va_arg(ap, uint64_t *),
541
608
                                   (uint32_t)td->td_nsubifd);
542
608
            }
543
0
            else
544
0
            {
545
0
                TIFFErrorExtR(tif, module, "%s: Sorry, cannot nest SubIFDs",
546
0
                              tif->tif_name);
547
0
                status = 0;
548
0
            }
549
608
            break;
550
433
        case TIFFTAG_YCBCRPOSITIONING:
551
433
            td->td_ycbcrpositioning = (uint16_t)va_arg(ap, uint16_vap);
552
433
            break;
553
26.7k
        case TIFFTAG_YCBCRSUBSAMPLING:
554
26.7k
            td->td_ycbcrsubsampling[0] = (uint16_t)va_arg(ap, uint16_vap);
555
26.7k
            td->td_ycbcrsubsampling[1] = (uint16_t)va_arg(ap, uint16_vap);
556
26.7k
            break;
557
118
        case TIFFTAG_TRANSFERFUNCTION:
558
118
        {
559
118
            uint32_t i;
560
118
            v = (td->td_samplesperpixel - td->td_extrasamples) > 1 ? 3 : 1;
561
326
            for (i = 0; i < v; i++)
562
208
                _TIFFsetShortArrayExt(tif, &td->td_transferfunction[i],
563
208
                                      va_arg(ap, uint16_t *),
564
208
                                      1U << td->td_bitspersample);
565
118
            break;
566
21.3k
        }
567
1.34k
        case TIFFTAG_REFERENCEBLACKWHITE:
568
            /* XXX should check for null range */
569
1.34k
            _TIFFsetFloatArrayExt(tif, &td->td_refblackwhite,
570
1.34k
                                  va_arg(ap, float *), 6);
571
1.34k
            break;
572
1.38k
        case TIFFTAG_INKNAMES:
573
1.38k
        {
574
1.38k
            v = (uint16_t)va_arg(ap, uint16_vap);
575
1.38k
            s = va_arg(ap, char *);
576
1.38k
            uint16_t ninksinstring;
577
1.38k
            ninksinstring = countInkNamesString(tif, v, s);
578
1.38k
            status = ninksinstring > 0;
579
1.38k
            if (ninksinstring > 0)
580
1.27k
            {
581
1.27k
                _TIFFsetNString(tif, &td->td_inknames, s, v);
582
1.27k
                td->td_inknameslen = v;
583
                /* Set NumberOfInks to the value ninksinstring */
584
1.27k
                if (TIFFFieldSet(tif, FIELD_NUMBEROFINKS))
585
107
                {
586
107
                    if (td->td_numberofinks != ninksinstring)
587
55
                    {
588
55
                        TIFFErrorExtR(
589
55
                            tif, module,
590
55
                            "Warning %s; Tag %s:\n  Value %" PRIu16
591
55
                            " of NumberOfInks is different from the number of "
592
55
                            "inks %" PRIu16
593
55
                            ".\n  -> NumberOfInks value adapted to %" PRIu16 "",
594
55
                            tif->tif_name, fip->field_name, td->td_numberofinks,
595
55
                            ninksinstring, ninksinstring);
596
55
                        td->td_numberofinks = ninksinstring;
597
55
                    }
598
107
                }
599
1.16k
                else
600
1.16k
                {
601
1.16k
                    td->td_numberofinks = ninksinstring;
602
1.16k
                    TIFFSetFieldBit(tif, FIELD_NUMBEROFINKS);
603
1.16k
                }
604
1.27k
                if (TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL))
605
361
                {
606
361
                    if (td->td_numberofinks != td->td_samplesperpixel)
607
194
                    {
608
194
                        TIFFErrorExtR(tif, module,
609
194
                                      "Warning %s; Tag %s:\n  Value %" PRIu16
610
194
                                      " of NumberOfInks is different from the "
611
194
                                      "SamplesPerPixel value %" PRIu16 "",
612
194
                                      tif->tif_name, fip->field_name,
613
194
                                      td->td_numberofinks,
614
194
                                      td->td_samplesperpixel);
615
194
                    }
616
361
                }
617
1.27k
            }
618
1.38k
        }
619
1.38k
        break;
620
799
        case TIFFTAG_NUMBEROFINKS:
621
799
            v = (uint16_t)va_arg(ap, uint16_vap);
622
            /* If InkNames already set also NumberOfInks is set accordingly and
623
             * should be equal */
624
799
            if (TIFFFieldSet(tif, FIELD_INKNAMES))
625
132
            {
626
132
                if (v != td->td_numberofinks)
627
60
                {
628
60
                    TIFFErrorExtR(
629
60
                        tif, module,
630
60
                        "Error %s; Tag %s:\n  It is not possible to set the "
631
60
                        "value %" PRIu32
632
60
                        " for NumberOfInks\n  which is different from the "
633
60
                        "number of inks in the InkNames tag (%" PRIu16 ")",
634
60
                        tif->tif_name, fip->field_name, v, td->td_numberofinks);
635
                    /* Do not set / overwrite number of inks already set by
636
                     * InkNames case accordingly. */
637
60
                    status = 0;
638
60
                }
639
132
            }
640
667
            else
641
667
            {
642
667
                td->td_numberofinks = (uint16_t)v;
643
667
                if (TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL))
644
269
                {
645
269
                    if (td->td_numberofinks != td->td_samplesperpixel)
646
205
                    {
647
205
                        TIFFErrorExtR(tif, module,
648
205
                                      "Warning %s; Tag %s:\n  Value %" PRIu32
649
205
                                      " of NumberOfInks is different from the "
650
205
                                      "SamplesPerPixel value %" PRIu16 "",
651
205
                                      tif->tif_name, fip->field_name, v,
652
205
                                      td->td_samplesperpixel);
653
205
                    }
654
269
                }
655
667
            }
656
799
            break;
657
0
        case TIFFTAG_PERSAMPLE:
658
0
            v = (uint16_t)va_arg(ap, uint16_vap);
659
0
            if (v == PERSAMPLE_MULTI)
660
0
                tif->tif_flags |= TIFF_PERSAMPLE;
661
0
            else
662
0
                tif->tif_flags &= ~TIFF_PERSAMPLE;
663
0
            break;
664
500k
        default:
665
500k
        {
666
500k
            TIFFTagValue *tv;
667
500k
            int tv_size, iCustom;
668
669
            /*
670
             * This can happen if multiple images are open with different
671
             * codecs which have private tags.  The global tag information
672
             * table may then have tags that are valid for one file but not
673
             * the other. If the client tries to set a tag that is not valid
674
             * for the image's codec then we'll arrive here.  This
675
             * happens, for example, when tiffcp is used to convert between
676
             * compression schemes and codec-specific tags are blindly copied.
677
             *
678
             * This also happens when a FIELD_IGNORE tag is written.
679
             */
680
500k
            if (fip->field_bit == FIELD_IGNORE)
681
0
            {
682
0
                TIFFErrorExtR(
683
0
                    tif, module,
684
0
                    "%s: Ignored %stag \"%s\" (not supported by libtiff)",
685
0
                    tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
686
0
                    fip->field_name);
687
0
                status = 0;
688
0
                break;
689
0
            }
690
500k
            if (fip->field_bit != FIELD_CUSTOM)
691
0
            {
692
0
                TIFFErrorExtR(
693
0
                    tif, module,
694
0
                    "%s: Invalid %stag \"%s\" (not supported by codec)",
695
0
                    tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
696
0
                    fip->field_name);
697
0
                status = 0;
698
0
                break;
699
0
            }
700
701
            /*
702
             * Find the existing entry for this custom value.
703
             */
704
500k
            tv = NULL;
705
2.68M
            for (iCustom = 0; iCustom < td->td_customValueCount; iCustom++)
706
2.18M
            {
707
2.18M
                if (td->td_customValues[iCustom].info->field_tag == tag)
708
0
                {
709
0
                    tv = td->td_customValues + iCustom;
710
0
                    if (tv->value != NULL)
711
0
                    {
712
0
                        _TIFFfreeExt(tif, tv->value);
713
0
                        tv->value = NULL;
714
0
                    }
715
0
                    break;
716
0
                }
717
2.18M
            }
718
719
            /*
720
             * Grow the custom list if the entry was not found.
721
             */
722
500k
            if (tv == NULL)
723
500k
            {
724
500k
                TIFFTagValue *new_customValues;
725
726
500k
                new_customValues = (TIFFTagValue *)_TIFFreallocExt(
727
500k
                    tif, td->td_customValues,
728
500k
                    sizeof(TIFFTagValue) * (td->td_customValueCount + 1));
729
500k
                if (!new_customValues)
730
0
                {
731
0
                    TIFFErrorExtR(tif, module,
732
0
                                  "%s: Failed to allocate space for list of "
733
0
                                  "custom values",
734
0
                                  tif->tif_name);
735
0
                    status = 0;
736
0
                    goto end;
737
0
                }
738
739
500k
                td->td_customValueCount++;
740
500k
                td->td_customValues = new_customValues;
741
742
500k
                tv = td->td_customValues + (td->td_customValueCount - 1);
743
500k
                tv->info = fip;
744
500k
                tv->value = NULL;
745
500k
                tv->count = 0;
746
500k
            }
747
748
            /*
749
             * Set custom value ... save a copy of the custom tag value.
750
             */
751
            /*--: Rational2Double: For Rationals evaluate "set_get_field_type"
752
             * to determine internal storage size. */
753
500k
            tv_size = TIFFFieldSetGetSize(fip);
754
500k
            if (tv_size == 0)
755
0
            {
756
0
                status = 0;
757
0
                TIFFErrorExtR(tif, module, "%s: Bad field type %d for \"%s\"",
758
0
                              tif->tif_name, fip->field_type, fip->field_name);
759
0
                goto end;
760
0
            }
761
762
500k
            if (fip->field_type == TIFF_ASCII)
763
57.5k
            {
764
57.5k
                uint32_t ma;
765
57.5k
                const char *mb;
766
57.5k
                if (fip->field_passcount)
767
33.2k
                {
768
33.2k
                    assert(fip->field_writecount == TIFF_VARIABLE2);
769
33.2k
                    ma = (uint32_t)va_arg(ap, uint32_t);
770
33.2k
                    mb = (const char *)va_arg(ap, const char *);
771
33.2k
                }
772
24.3k
                else
773
24.3k
                {
774
24.3k
                    mb = (const char *)va_arg(ap, const char *);
775
24.3k
                    size_t len = strlen(mb) + 1;
776
24.3k
                    if (len >= 0x80000000U)
777
0
                    {
778
0
                        status = 0;
779
0
                        TIFFErrorExtR(tif, module,
780
0
                                      "%s: Too long string value for \"%s\". "
781
0
                                      "Maximum supported is 2147483647 bytes",
782
0
                                      tif->tif_name, fip->field_name);
783
0
                        goto end;
784
0
                    }
785
24.3k
                    ma = (uint32_t)len;
786
24.3k
                }
787
57.5k
                tv->count = ma;
788
57.5k
                setByteArray(tif, &tv->value, mb, ma, 1);
789
57.5k
            }
790
442k
            else
791
442k
            {
792
442k
                if (fip->field_passcount)
793
326k
                {
794
326k
                    if (fip->field_writecount == TIFF_VARIABLE2)
795
316k
                        tv->count = (uint32_t)va_arg(ap, uint32_t);
796
9.69k
                    else
797
9.69k
                        tv->count = (int)va_arg(ap, int);
798
326k
                }
799
116k
                else if (fip->field_writecount == TIFF_VARIABLE ||
800
116k
                         fip->field_writecount == TIFF_VARIABLE2)
801
0
                    tv->count = 1;
802
116k
                else if (fip->field_writecount == TIFF_SPP)
803
0
                    tv->count = td->td_samplesperpixel;
804
116k
                else
805
116k
                    tv->count = fip->field_writecount;
806
807
442k
                if (tv->count == 0)
808
60.6k
                {
809
60.6k
                    TIFFWarningExtR(tif, module,
810
60.6k
                                    "%s: Null count for \"%s\" (type "
811
60.6k
                                    "%d, writecount %d, passcount %d)",
812
60.6k
                                    tif->tif_name, fip->field_name,
813
60.6k
                                    fip->field_type, fip->field_writecount,
814
60.6k
                                    fip->field_passcount);
815
60.6k
                    break;
816
60.6k
                }
817
818
382k
                tv->value = _TIFFCheckMalloc(tif, tv->count, tv_size,
819
382k
                                             "custom tag binary object");
820
382k
                if (!tv->value)
821
0
                {
822
0
                    status = 0;
823
0
                    goto end;
824
0
                }
825
826
382k
                if (fip->field_tag == TIFFTAG_DOTRANGE &&
827
719
                    strcmp(fip->field_name, "DotRange") == 0)
828
308
                {
829
                    /* TODO: This is an evil exception and should not have been
830
                       handled this way ... likely best if we move it into
831
                       the directory structure with an explicit field in
832
                       libtiff 4.1 and assign it a FIELD_ value */
833
308
                    uint16_t v2[2];
834
308
                    v2[0] = (uint16_t)va_arg(ap, int);
835
308
                    v2[1] = (uint16_t)va_arg(ap, int);
836
308
                    _TIFFmemcpy(tv->value, &v2, 4);
837
308
                }
838
839
381k
                else if (fip->field_passcount ||
840
116k
                         fip->field_writecount == TIFF_VARIABLE ||
841
116k
                         fip->field_writecount == TIFF_VARIABLE2 ||
842
116k
                         fip->field_writecount == TIFF_SPP || tv->count > 1)
843
284k
                {
844
                    /*--: Rational2Double: For Rationals tv_size is set above to
845
                     * 4 or 8 according to fip->set_get_field_type! */
846
284k
                    _TIFFmemcpy(tv->value, va_arg(ap, void *),
847
284k
                                tv->count * tv_size);
848
                    /* Test here for too big values for LONG8, SLONG8 in
849
                     * ClassicTIFF and delete custom field from custom list */
850
284k
                    if (!(tif->tif_flags & TIFF_BIGTIFF))
851
281k
                    {
852
281k
                        if (tv->info->field_type == TIFF_LONG8)
853
3.89k
                        {
854
3.89k
                            uint64_t *pui64 = (uint64_t *)tv->value;
855
8.75k
                            for (int i = 0; i < tv->count; i++)
856
8.20k
                            {
857
8.20k
                                if (pui64[i] > 0xffffffffu)
858
3.34k
                                {
859
3.34k
                                    TIFFErrorExtR(
860
3.34k
                                        tif, module,
861
3.34k
                                        "%s: Bad LONG8 value %" PRIu64
862
3.34k
                                        " at %d. array position for \"%s\" tag "
863
3.34k
                                        "%d in ClassicTIFF. Tag won't be "
864
3.34k
                                        "written to file",
865
3.34k
                                        tif->tif_name, pui64[i], i,
866
3.34k
                                        fip->field_name, tag);
867
3.34k
                                    goto badvalueifd8long8;
868
3.34k
                                }
869
8.20k
                            }
870
3.89k
                        }
871
277k
                        else if (tv->info->field_type == TIFF_SLONG8)
872
4.07k
                        {
873
4.07k
                            int64_t *pi64 = (int64_t *)tv->value;
874
9.05k
                            for (int i = 0; i < tv->count; i++)
875
8.16k
                            {
876
8.16k
                                if (pi64[i] > 2147483647 ||
877
6.18k
                                    pi64[i] < (-2147483647 - 1))
878
3.18k
                                {
879
3.18k
                                    TIFFErrorExtR(
880
3.18k
                                        tif, module,
881
3.18k
                                        "%s: Bad SLONG8 value %" PRIi64
882
3.18k
                                        " at %d. array position for \"%s\" tag "
883
3.18k
                                        "%d in ClassicTIFF. Tag won't be "
884
3.18k
                                        "written to file",
885
3.18k
                                        tif->tif_name, pi64[i], i,
886
3.18k
                                        fip->field_name, tag);
887
3.18k
                                    goto badvalueifd8long8;
888
3.18k
                                }
889
8.16k
                            }
890
4.07k
                        }
891
281k
                    }
892
284k
                }
893
97.0k
                else
894
97.0k
                {
895
97.0k
                    char *val = (char *)tv->value;
896
97.0k
                    assert(tv->count == 1);
897
898
97.0k
                    switch (fip->field_type)
899
97.0k
                    {
900
2.12k
                        case TIFF_BYTE:
901
2.16k
                        case TIFF_UNDEFINED:
902
2.16k
                        {
903
2.16k
                            uint8_t v2 = (uint8_t)va_arg(ap, int);
904
2.16k
                            _TIFFmemcpy(val, &v2, tv_size);
905
2.16k
                        }
906
2.16k
                        break;
907
0
                        case TIFF_SBYTE:
908
0
                        {
909
0
                            int8_t v2 = (int8_t)va_arg(ap, int);
910
0
                            _TIFFmemcpy(val, &v2, tv_size);
911
0
                        }
912
0
                        break;
913
7.08k
                        case TIFF_SHORT:
914
7.08k
                        {
915
7.08k
                            uint16_t v2 = (uint16_t)va_arg(ap, int);
916
7.08k
                            _TIFFmemcpy(val, &v2, tv_size);
917
7.08k
                        }
918
7.08k
                        break;
919
0
                        case TIFF_SSHORT:
920
0
                        {
921
0
                            int16_t v2 = (int16_t)va_arg(ap, int);
922
0
                            _TIFFmemcpy(val, &v2, tv_size);
923
0
                        }
924
0
                        break;
925
1.05k
                        case TIFF_LONG:
926
1.05k
                        case TIFF_IFD:
927
1.05k
                        {
928
1.05k
                            uint32_t v2 = va_arg(ap, uint32_t);
929
1.05k
                            _TIFFmemcpy(val, &v2, tv_size);
930
1.05k
                        }
931
1.05k
                        break;
932
0
                        case TIFF_SLONG:
933
0
                        {
934
0
                            int32_t v2 = va_arg(ap, int32_t);
935
0
                            _TIFFmemcpy(val, &v2, tv_size);
936
0
                        }
937
0
                        break;
938
0
                        case TIFF_LONG8:
939
80.7k
                        case TIFF_IFD8:
940
80.7k
                        {
941
80.7k
                            uint64_t v2 = va_arg(ap, uint64_t);
942
80.7k
                            _TIFFmemcpy(val, &v2, tv_size);
943
                            /* Test here for too big values for ClassicTIFF and
944
                             * delete custom field from custom list */
945
80.7k
                            if (!(tif->tif_flags & TIFF_BIGTIFF) &&
946
80.7k
                                (v2 > 0xffffffffu))
947
421
                            {
948
421
                                TIFFErrorExtR(
949
421
                                    tif, module,
950
421
                                    "%s: Bad LONG8 or IFD8 value %" PRIu64
951
421
                                    " for \"%s\" tag %d in ClassicTIFF. Tag "
952
421
                                    "won't be written to file",
953
421
                                    tif->tif_name, v2, fip->field_name, tag);
954
421
                                goto badvalueifd8long8;
955
421
                            }
956
80.7k
                        }
957
80.3k
                        break;
958
80.3k
                        case TIFF_SLONG8:
959
0
                        {
960
0
                            int64_t v2 = va_arg(ap, int64_t);
961
0
                            _TIFFmemcpy(val, &v2, tv_size);
962
                            /* Test here for too big values for ClassicTIFF and
963
                             * delete custom field from custom list */
964
0
                            if (!(tif->tif_flags & TIFF_BIGTIFF) &&
965
0
                                ((v2 > 2147483647) || (v2 < (-2147483647 - 1))))
966
0
                            {
967
0
                                TIFFErrorExtR(
968
0
                                    tif, module,
969
0
                                    "%s: Bad SLONG8 value %" PRIi64
970
0
                                    " for \"%s\" tag %d in ClassicTIFF. Tag "
971
0
                                    "won't be written to file",
972
0
                                    tif->tif_name, v2, fip->field_name, tag);
973
0
                                goto badvalueifd8long8;
974
0
                            }
975
0
                        }
976
0
                        break;
977
3.55k
                        case TIFF_RATIONAL:
978
4.80k
                        case TIFF_SRATIONAL:
979
                            /*-- Rational2Double: For Rationals tv_size is set
980
                             * above to 4 or 8 according to
981
                             * fip->set_get_field_type!
982
                             */
983
4.80k
                            {
984
4.80k
                                if (tv_size == 8)
985
295
                                {
986
295
                                    double v2 = va_arg(ap, double);
987
295
                                    _TIFFmemcpy(val, &v2, tv_size);
988
295
                                }
989
4.50k
                                else
990
4.50k
                                {
991
                                    /*-- default should be tv_size == 4 */
992
4.50k
                                    float v3 = (float)va_arg(ap, double);
993
4.50k
                                    _TIFFmemcpy(val, &v3, tv_size);
994
                                    /*-- ToDo: After Testing, this should be
995
                                     * removed and tv_size==4 should be set as
996
                                     * default. */
997
4.50k
                                    if (tv_size != 4)
998
0
                                    {
999
0
                                        TIFFErrorExtR(tif, module,
1000
0
                                                      "Rational2Double: "
1001
0
                                                      ".set_get_field_type "
1002
0
                                                      "in not 4 but %d",
1003
0
                                                      tv_size);
1004
0
                                    }
1005
4.50k
                                }
1006
4.80k
                            }
1007
4.80k
                            break;
1008
177
                        case TIFF_FLOAT:
1009
177
                        {
1010
177
                            float v2 =
1011
177
                                _TIFFClampDoubleToFloat(va_arg(ap, double));
1012
177
                            _TIFFmemcpy(val, &v2, tv_size);
1013
177
                        }
1014
177
                        break;
1015
1.06k
                        case TIFF_DOUBLE:
1016
1.06k
                        {
1017
1.06k
                            double v2 = va_arg(ap, double);
1018
1.06k
                            _TIFFmemcpy(val, &v2, tv_size);
1019
1.06k
                        }
1020
1.06k
                        break;
1021
0
                        default:
1022
0
                            _TIFFmemset(val, 0, tv_size);
1023
0
                            status = 0;
1024
0
                            break;
1025
97.0k
                    }
1026
97.0k
                }
1027
382k
            }
1028
500k
        }
1029
2.19M
    }
1030
2.17M
    if (status)
1031
2.17M
    {
1032
2.17M
        const TIFFField *fip2 = TIFFFieldWithTag(tif, tag);
1033
2.17M
        if (fip2)
1034
2.17M
            TIFFSetFieldBit(tif, fip2->field_bit);
1035
2.17M
        tif->tif_flags |= TIFF_DIRTYDIRECT;
1036
2.17M
    }
1037
1038
2.17M
end:
1039
2.17M
    va_end(ap);
1040
2.17M
    return (status);
1041
1.70k
badvalue:
1042
1.70k
{
1043
1.70k
    const TIFFField *fip2 = TIFFFieldWithTag(tif, tag);
1044
1.70k
    TIFFErrorExtR(tif, module, "%s: Bad value %" PRIu32 " for \"%s\" tag",
1045
1.70k
                  tif->tif_name, v, fip2 ? fip2->field_name : "Unknown");
1046
1.70k
    va_end(ap);
1047
1.70k
}
1048
1.70k
    return (0);
1049
2.99k
badvalue32:
1050
2.99k
{
1051
2.99k
    const TIFFField *fip2 = TIFFFieldWithTag(tif, tag);
1052
2.99k
    TIFFErrorExtR(tif, module, "%s: Bad value %" PRIu32 " for \"%s\" tag",
1053
2.99k
                  tif->tif_name, v32, fip2 ? fip2->field_name : "Unknown");
1054
2.99k
    va_end(ap);
1055
2.99k
}
1056
2.99k
    return (0);
1057
340
badvaluedouble:
1058
340
{
1059
340
    const TIFFField *fip2 = TIFFFieldWithTag(tif, tag);
1060
340
    TIFFErrorExtR(tif, module, "%s: Bad value %f for \"%s\" tag", tif->tif_name,
1061
340
                  dblval, fip2 ? fip2->field_name : "Unknown");
1062
340
    va_end(ap);
1063
340
}
1064
340
    return (0);
1065
6.94k
badvalueifd8long8:
1066
6.94k
{
1067
    /* Error message issued already above. */
1068
6.94k
    TIFFTagValue *tv2 = NULL;
1069
6.94k
    int iCustom2, iC2;
1070
    /* Find the existing entry for this custom value. */
1071
45.3k
    for (iCustom2 = 0; iCustom2 < td->td_customValueCount; iCustom2++)
1072
45.3k
    {
1073
45.3k
        if (td->td_customValues[iCustom2].info->field_tag == tag)
1074
6.94k
        {
1075
6.94k
            tv2 = td->td_customValues + (iCustom2);
1076
6.94k
            break;
1077
6.94k
        }
1078
45.3k
    }
1079
6.94k
    if (tv2 != NULL)
1080
6.94k
    {
1081
        /* Remove custom field from custom list */
1082
6.94k
        if (tv2->value != NULL)
1083
6.94k
        {
1084
6.94k
            _TIFFfreeExt(tif, tv2->value);
1085
6.94k
            tv2->value = NULL;
1086
6.94k
        }
1087
        /* Shorten list and close gap in customValues list.
1088
         * Re-allocation of td_customValues not necessary here. */
1089
6.94k
        td->td_customValueCount--;
1090
6.94k
        for (iC2 = iCustom2; iC2 < td->td_customValueCount; iC2++)
1091
0
        {
1092
0
            td->td_customValues[iC2] = td->td_customValues[iC2 + 1];
1093
0
        }
1094
6.94k
    }
1095
0
    else
1096
0
    {
1097
0
        assert(0);
1098
0
    }
1099
6.94k
    va_end(ap);
1100
6.94k
}
1101
6.94k
    return (0);
1102
6.94k
} /*-- _TIFFVSetField() --*/
1103
1104
/*
1105
 * Return 1/0 according to whether or not
1106
 * it is permissible to set the tag's value.
1107
 * Note that we allow ImageLength to be changed
1108
 * so that we can append and extend to images.
1109
 * Any other tag may not be altered once writing
1110
 * has commenced, unless its value has no effect
1111
 * on the format of the data that is written.
1112
 */
1113
static int OkToChangeTag(TIFF *tif, uint32_t tag)
1114
2.28M
{
1115
2.28M
    const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
1116
2.28M
    if (!fip)
1117
0
    { /* unknown tag */
1118
0
        TIFFErrorExtR(tif, "TIFFSetField", "%s: Unknown %stag %" PRIu32,
1119
0
                      tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "", tag);
1120
0
        return (0);
1121
0
    }
1122
2.28M
    if (tag != TIFFTAG_IMAGELENGTH && (tif->tif_flags & TIFF_BEENWRITING) &&
1123
0
        !fip->field_oktochange)
1124
0
    {
1125
        /*
1126
         * Consult info table to see if tag can be changed
1127
         * after we've started writing.  We only allow changes
1128
         * to those tags that don't/shouldn't affect the
1129
         * compression and/or format of the data.
1130
         */
1131
0
        TIFFErrorExtR(tif, "TIFFSetField",
1132
0
                      "%s: Cannot modify tag \"%s\" while writing",
1133
0
                      tif->tif_name, fip->field_name);
1134
0
        return (0);
1135
0
    }
1136
2.28M
    return (1);
1137
2.28M
}
1138
1139
/*
1140
 * Record the value of a field in the
1141
 * internal directory structure.  The
1142
 * field will be written to the file
1143
 * when/if the directory structure is
1144
 * updated.
1145
 */
1146
int TIFFSetField(TIFF *tif, uint32_t tag, ...)
1147
2.28M
{
1148
2.28M
    va_list ap;
1149
2.28M
    int status;
1150
1151
2.28M
    va_start(ap, tag);
1152
2.28M
    status = TIFFVSetField(tif, tag, ap);
1153
2.28M
    va_end(ap);
1154
2.28M
    return (status);
1155
2.28M
}
1156
1157
/*
1158
 * Clear the contents of the field in the internal structure.
1159
 */
1160
int TIFFUnsetField(TIFF *tif, uint32_t tag)
1161
0
{
1162
0
    const TIFFField *fip = TIFFFieldWithTag(tif, tag);
1163
0
    TIFFDirectory *td = &tif->tif_dir;
1164
1165
0
    if (!fip)
1166
0
        return 0;
1167
1168
0
    if (fip->field_bit != FIELD_CUSTOM)
1169
0
        TIFFClrFieldBit(tif, fip->field_bit);
1170
0
    else
1171
0
    {
1172
0
        TIFFTagValue *tv = NULL;
1173
0
        int i;
1174
1175
0
        for (i = 0; i < td->td_customValueCount; i++)
1176
0
        {
1177
1178
0
            tv = td->td_customValues + i;
1179
0
            if (tv->info->field_tag == tag)
1180
0
                break;
1181
0
        }
1182
1183
0
        if (i < td->td_customValueCount)
1184
0
        {
1185
0
            _TIFFfreeExt(tif, tv->value);
1186
0
            for (; i < td->td_customValueCount - 1; i++)
1187
0
            {
1188
0
                td->td_customValues[i] = td->td_customValues[i + 1];
1189
0
            }
1190
0
            td->td_customValueCount--;
1191
0
        }
1192
0
    }
1193
1194
0
    tif->tif_flags |= TIFF_DIRTYDIRECT;
1195
1196
0
    return (1);
1197
0
}
1198
1199
/*
1200
 * Like TIFFSetField, but taking a varargs
1201
 * parameter list.  This routine is useful
1202
 * for building higher-level interfaces on
1203
 * top of the library.
1204
 */
1205
int TIFFVSetField(TIFF *tif, uint32_t tag, va_list ap)
1206
2.28M
{
1207
2.28M
    return OkToChangeTag(tif, tag)
1208
2.28M
               ? (*tif->tif_tagmethods.vsetfield)(tif, tag, ap)
1209
2.28M
               : 0;
1210
2.28M
}
1211
1212
static int _TIFFVGetField(TIFF *tif, uint32_t tag, va_list ap)
1213
2.48M
{
1214
2.48M
    TIFFDirectory *td = &tif->tif_dir;
1215
2.48M
    int ret_val = 1;
1216
2.48M
    uint32_t standard_tag = tag;
1217
2.48M
    const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
1218
2.48M
    if (fip == NULL) /* cannot happen since TIFFGetField() already checks it */
1219
0
        return 0;
1220
1221
    /*
1222
     * We want to force the custom code to be used for custom
1223
     * fields even if the tag happens to match a well known
1224
     * one - important for reinterpreted handling of standard
1225
     * tag values in custom directories (i.e. EXIF)
1226
     */
1227
2.48M
    if (fip->field_bit == FIELD_CUSTOM)
1228
1.22M
    {
1229
1.22M
        standard_tag = 0;
1230
1.22M
    }
1231
1232
2.48M
    switch (standard_tag)
1233
2.48M
    {
1234
1.11k
        case TIFFTAG_SUBFILETYPE:
1235
1.11k
            *va_arg(ap, uint32_t *) = td->td_subfiletype;
1236
1.11k
            break;
1237
143k
        case TIFFTAG_IMAGEWIDTH:
1238
143k
            *va_arg(ap, uint32_t *) = td->td_imagewidth;
1239
143k
            break;
1240
151k
        case TIFFTAG_IMAGELENGTH:
1241
151k
            *va_arg(ap, uint32_t *) = td->td_imagelength;
1242
151k
            break;
1243
83.5k
        case TIFFTAG_BITSPERSAMPLE:
1244
83.5k
            *va_arg(ap, uint16_t *) = td->td_bitspersample;
1245
83.5k
            break;
1246
141k
        case TIFFTAG_COMPRESSION:
1247
141k
            *va_arg(ap, uint16_t *) = td->td_compression;
1248
141k
            break;
1249
323k
        case TIFFTAG_PHOTOMETRIC:
1250
323k
            *va_arg(ap, uint16_t *) = td->td_photometric;
1251
323k
            break;
1252
0
        case TIFFTAG_THRESHHOLDING:
1253
0
            *va_arg(ap, uint16_t *) = td->td_threshholding;
1254
0
            break;
1255
1.29k
        case TIFFTAG_FILLORDER:
1256
1.29k
            *va_arg(ap, uint16_t *) = td->td_fillorder;
1257
1.29k
            break;
1258
9.90k
        case TIFFTAG_ORIENTATION:
1259
9.90k
            *va_arg(ap, uint16_t *) = td->td_orientation;
1260
9.90k
            break;
1261
78.1k
        case TIFFTAG_SAMPLESPERPIXEL:
1262
78.1k
            *va_arg(ap, uint16_t *) = td->td_samplesperpixel;
1263
78.1k
            break;
1264
43.7k
        case TIFFTAG_ROWSPERSTRIP:
1265
43.7k
            *va_arg(ap, uint32_t *) = td->td_rowsperstrip;
1266
43.7k
            break;
1267
852
        case TIFFTAG_MINSAMPLEVALUE:
1268
852
            *va_arg(ap, uint16_t *) = td->td_minsamplevalue;
1269
852
            break;
1270
520
        case TIFFTAG_MAXSAMPLEVALUE:
1271
520
            *va_arg(ap, uint16_t *) = td->td_maxsamplevalue;
1272
520
            break;
1273
0
        case TIFFTAG_SMINSAMPLEVALUE:
1274
0
            if (tif->tif_flags & TIFF_PERSAMPLE)
1275
0
                *va_arg(ap, double **) = td->td_sminsamplevalue;
1276
0
            else
1277
0
            {
1278
                /* libtiff historically treats this as a single value. */
1279
0
                uint16_t i;
1280
0
                double v = td->td_sminsamplevalue[0];
1281
0
                for (i = 1; i < td->td_samplesperpixel; ++i)
1282
0
                    if (td->td_sminsamplevalue[i] < v)
1283
0
                        v = td->td_sminsamplevalue[i];
1284
0
                *va_arg(ap, double *) = v;
1285
0
            }
1286
0
            break;
1287
0
        case TIFFTAG_SMAXSAMPLEVALUE:
1288
0
            if (tif->tif_flags & TIFF_PERSAMPLE)
1289
0
                *va_arg(ap, double **) = td->td_smaxsamplevalue;
1290
0
            else
1291
0
            {
1292
                /* libtiff historically treats this as a single value. */
1293
0
                uint16_t i;
1294
0
                double v = td->td_smaxsamplevalue[0];
1295
0
                for (i = 1; i < td->td_samplesperpixel; ++i)
1296
0
                    if (td->td_smaxsamplevalue[i] > v)
1297
0
                        v = td->td_smaxsamplevalue[i];
1298
0
                *va_arg(ap, double *) = v;
1299
0
            }
1300
0
            break;
1301
3.97k
        case TIFFTAG_XRESOLUTION:
1302
3.97k
            *va_arg(ap, float *) = td->td_xresolution;
1303
3.97k
            break;
1304
3.97k
        case TIFFTAG_YRESOLUTION:
1305
3.97k
            *va_arg(ap, float *) = td->td_yresolution;
1306
3.97k
            break;
1307
141k
        case TIFFTAG_PLANARCONFIG:
1308
141k
            *va_arg(ap, uint16_t *) = td->td_planarconfig;
1309
141k
            break;
1310
1.70k
        case TIFFTAG_XPOSITION:
1311
1.70k
            *va_arg(ap, float *) = td->td_xposition;
1312
1.70k
            break;
1313
1.70k
        case TIFFTAG_YPOSITION:
1314
1.70k
            *va_arg(ap, float *) = td->td_yposition;
1315
1.70k
            break;
1316
1.53k
        case TIFFTAG_RESOLUTIONUNIT:
1317
1.53k
            *va_arg(ap, uint16_t *) = td->td_resolutionunit;
1318
1.53k
            break;
1319
678
        case TIFFTAG_PAGENUMBER:
1320
678
            *va_arg(ap, uint16_t *) = td->td_pagenumber[0];
1321
678
            *va_arg(ap, uint16_t *) = td->td_pagenumber[1];
1322
678
            break;
1323
0
        case TIFFTAG_HALFTONEHINTS:
1324
0
            *va_arg(ap, uint16_t *) = td->td_halftonehints[0];
1325
0
            *va_arg(ap, uint16_t *) = td->td_halftonehints[1];
1326
0
            break;
1327
2.49k
        case TIFFTAG_COLORMAP:
1328
2.49k
            *va_arg(ap, const uint16_t **) = td->td_colormap[0];
1329
2.49k
            *va_arg(ap, const uint16_t **) = td->td_colormap[1];
1330
2.49k
            *va_arg(ap, const uint16_t **) = td->td_colormap[2];
1331
2.49k
            break;
1332
697
        case TIFFTAG_STRIPOFFSETS:
1333
697
        case TIFFTAG_TILEOFFSETS:
1334
697
            _TIFFFillStriles(tif);
1335
697
            *va_arg(ap, const uint64_t **) = td->td_stripoffset_p;
1336
697
            if (td->td_stripoffset_p == NULL)
1337
25
                ret_val = 0;
1338
697
            break;
1339
1.25k
        case TIFFTAG_STRIPBYTECOUNTS:
1340
1.25k
        case TIFFTAG_TILEBYTECOUNTS:
1341
1.25k
            _TIFFFillStriles(tif);
1342
1.25k
            *va_arg(ap, const uint64_t **) = td->td_stripbytecount_p;
1343
1.25k
            if (td->td_stripbytecount_p == NULL)
1344
0
                ret_val = 0;
1345
1.25k
            break;
1346
0
        case TIFFTAG_MATTEING:
1347
0
            *va_arg(ap, uint16_t *) =
1348
0
                (td->td_extrasamples == 1 &&
1349
0
                 td->td_sampleinfo[0] == EXTRASAMPLE_ASSOCALPHA);
1350
0
            break;
1351
17.5k
        case TIFFTAG_EXTRASAMPLES:
1352
17.5k
            *va_arg(ap, uint16_t *) = td->td_extrasamples;
1353
17.5k
            *va_arg(ap, const uint16_t **) = td->td_sampleinfo;
1354
17.5k
            break;
1355
39.4k
        case TIFFTAG_TILEWIDTH:
1356
39.4k
            *va_arg(ap, uint32_t *) = td->td_tilewidth;
1357
39.4k
            break;
1358
39.4k
        case TIFFTAG_TILELENGTH:
1359
39.4k
            *va_arg(ap, uint32_t *) = td->td_tilelength;
1360
39.4k
            break;
1361
0
        case TIFFTAG_TILEDEPTH:
1362
0
            *va_arg(ap, uint32_t *) = td->td_tiledepth;
1363
0
            break;
1364
0
        case TIFFTAG_DATATYPE:
1365
0
            switch (td->td_sampleformat)
1366
0
            {
1367
0
                case SAMPLEFORMAT_UINT:
1368
0
                    *va_arg(ap, uint16_t *) = DATATYPE_UINT;
1369
0
                    break;
1370
0
                case SAMPLEFORMAT_INT:
1371
0
                    *va_arg(ap, uint16_t *) = DATATYPE_INT;
1372
0
                    break;
1373
0
                case SAMPLEFORMAT_IEEEFP:
1374
0
                    *va_arg(ap, uint16_t *) = DATATYPE_IEEEFP;
1375
0
                    break;
1376
0
                case SAMPLEFORMAT_VOID:
1377
0
                    *va_arg(ap, uint16_t *) = DATATYPE_VOID;
1378
0
                    break;
1379
0
            }
1380
0
            break;
1381
16.9k
        case TIFFTAG_SAMPLEFORMAT:
1382
16.9k
            *va_arg(ap, uint16_t *) = td->td_sampleformat;
1383
16.9k
            break;
1384
0
        case TIFFTAG_IMAGEDEPTH:
1385
0
            *va_arg(ap, uint32_t *) = td->td_imagedepth;
1386
0
            break;
1387
0
        case TIFFTAG_SUBIFD:
1388
0
            *va_arg(ap, uint16_t *) = td->td_nsubifd;
1389
0
            *va_arg(ap, const uint64_t **) = td->td_subifd;
1390
0
            break;
1391
0
        case TIFFTAG_YCBCRPOSITIONING:
1392
0
            *va_arg(ap, uint16_t *) = td->td_ycbcrpositioning;
1393
0
            break;
1394
9.87k
        case TIFFTAG_YCBCRSUBSAMPLING:
1395
9.87k
            *va_arg(ap, uint16_t *) = td->td_ycbcrsubsampling[0];
1396
9.87k
            *va_arg(ap, uint16_t *) = td->td_ycbcrsubsampling[1];
1397
9.87k
            break;
1398
0
        case TIFFTAG_TRANSFERFUNCTION:
1399
0
            *va_arg(ap, const uint16_t **) = td->td_transferfunction[0];
1400
0
            if (td->td_samplesperpixel - td->td_extrasamples > 1)
1401
0
            {
1402
0
                *va_arg(ap, const uint16_t **) = td->td_transferfunction[1];
1403
0
                *va_arg(ap, const uint16_t **) = td->td_transferfunction[2];
1404
0
            }
1405
0
            else
1406
0
            {
1407
0
                *va_arg(ap, const uint16_t **) = NULL;
1408
0
                *va_arg(ap, const uint16_t **) = NULL;
1409
0
            }
1410
0
            break;
1411
247
        case TIFFTAG_REFERENCEBLACKWHITE:
1412
247
            *va_arg(ap, const float **) = td->td_refblackwhite;
1413
247
            break;
1414
0
        case TIFFTAG_INKNAMES:
1415
0
            *va_arg(ap, const char **) = td->td_inknames;
1416
0
            break;
1417
0
        case TIFFTAG_NUMBEROFINKS:
1418
0
            *va_arg(ap, uint16_t *) = td->td_numberofinks;
1419
0
            break;
1420
1.22M
        default:
1421
1.22M
        {
1422
1.22M
            int i;
1423
1424
            /*
1425
             * This can happen if multiple images are open
1426
             * with different codecs which have private
1427
             * tags.  The global tag information table may
1428
             * then have tags that are valid for one file
1429
             * but not the other. If the client tries to
1430
             * get a tag that is not valid for the image's
1431
             * codec then we'll arrive here.
1432
             */
1433
1.22M
            if (fip->field_bit != FIELD_CUSTOM)
1434
0
            {
1435
0
                TIFFErrorExtR(tif, "_TIFFVGetField",
1436
0
                              "%s: Invalid %stag \"%s\" "
1437
0
                              "(not supported by codec)",
1438
0
                              tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
1439
0
                              fip->field_name);
1440
0
                ret_val = 0;
1441
0
                break;
1442
0
            }
1443
1444
            /*
1445
             * Do we have a custom value?
1446
             */
1447
1.22M
            ret_val = 0;
1448
5.24M
            for (i = 0; i < td->td_customValueCount; i++)
1449
4.22M
            {
1450
4.22M
                TIFFTagValue *tv = td->td_customValues + i;
1451
1452
4.22M
                if (tv->info->field_tag != tag)
1453
4.02M
                    continue;
1454
1455
201k
                if (fip->field_passcount)
1456
149k
                {
1457
149k
                    if (fip->field_readcount == TIFF_VARIABLE2)
1458
149k
                        *va_arg(ap, uint32_t *) = (uint32_t)tv->count;
1459
234
                    else /* Assume TIFF_VARIABLE */
1460
234
                        *va_arg(ap, uint16_t *) = (uint16_t)tv->count;
1461
149k
                    *va_arg(ap, const void **) = tv->value;
1462
149k
                    ret_val = 1;
1463
149k
                }
1464
52.2k
                else if (fip->field_tag == TIFFTAG_DOTRANGE &&
1465
0
                         strcmp(fip->field_name, "DotRange") == 0)
1466
0
                {
1467
                    /* TODO: This is an evil exception and should not have been
1468
                       handled this way ... likely best if we move it into
1469
                       the directory structure with an explicit field in
1470
                       libtiff 4.1 and assign it a FIELD_ value */
1471
0
                    *va_arg(ap, uint16_t *) = ((uint16_t *)tv->value)[0];
1472
0
                    *va_arg(ap, uint16_t *) = ((uint16_t *)tv->value)[1];
1473
0
                    ret_val = 1;
1474
0
                }
1475
52.2k
                else
1476
52.2k
                {
1477
52.2k
                    if (fip->field_type == TIFF_ASCII ||
1478
40.4k
                        fip->field_readcount == TIFF_VARIABLE ||
1479
40.4k
                        fip->field_readcount == TIFF_VARIABLE2 ||
1480
40.4k
                        fip->field_readcount == TIFF_SPP || tv->count > 1)
1481
15.6k
                    {
1482
15.6k
                        *va_arg(ap, void **) = tv->value;
1483
15.6k
                        ret_val = 1;
1484
15.6k
                    }
1485
36.5k
                    else
1486
36.5k
                    {
1487
36.5k
                        char *val = (char *)tv->value;
1488
36.5k
                        assert(tv->count == 1);
1489
36.5k
                        switch (fip->field_type)
1490
36.5k
                        {
1491
943
                            case TIFF_BYTE:
1492
991
                            case TIFF_UNDEFINED:
1493
991
                                *va_arg(ap, uint8_t *) = *(uint8_t *)val;
1494
991
                                ret_val = 1;
1495
991
                                break;
1496
0
                            case TIFF_SBYTE:
1497
0
                                *va_arg(ap, int8_t *) = *(int8_t *)val;
1498
0
                                ret_val = 1;
1499
0
                                break;
1500
2.86k
                            case TIFF_SHORT:
1501
2.86k
                                *va_arg(ap, uint16_t *) = *(uint16_t *)val;
1502
2.86k
                                ret_val = 1;
1503
2.86k
                                break;
1504
0
                            case TIFF_SSHORT:
1505
0
                                *va_arg(ap, int16_t *) = *(int16_t *)val;
1506
0
                                ret_val = 1;
1507
0
                                break;
1508
165
                            case TIFF_LONG:
1509
165
                            case TIFF_IFD:
1510
165
                                *va_arg(ap, uint32_t *) = *(uint32_t *)val;
1511
165
                                ret_val = 1;
1512
165
                                break;
1513
0
                            case TIFF_SLONG:
1514
0
                                *va_arg(ap, int32_t *) = *(int32_t *)val;
1515
0
                                ret_val = 1;
1516
0
                                break;
1517
0
                            case TIFF_LONG8:
1518
30.7k
                            case TIFF_IFD8:
1519
30.7k
                                *va_arg(ap, uint64_t *) = *(uint64_t *)val;
1520
30.7k
                                ret_val = 1;
1521
30.7k
                                break;
1522
0
                            case TIFF_SLONG8:
1523
0
                                *va_arg(ap, int64_t *) = *(int64_t *)val;
1524
0
                                ret_val = 1;
1525
0
                                break;
1526
1.35k
                            case TIFF_RATIONAL:
1527
1.81k
                            case TIFF_SRATIONAL:
1528
1.81k
                            {
1529
                                /*-- Rational2Double: For Rationals evaluate
1530
                                 * "set_get_field_type" to determine internal
1531
                                 * storage size and return value size. */
1532
1.81k
                                int tv_size = TIFFFieldSetGetSize(fip);
1533
1.81k
                                if (tv_size == 8)
1534
295
                                {
1535
295
                                    *va_arg(ap, double *) = *(double *)val;
1536
295
                                    ret_val = 1;
1537
295
                                }
1538
1.51k
                                else
1539
1.51k
                                {
1540
                                    /*-- default should be tv_size == 4  */
1541
1.51k
                                    *va_arg(ap, float *) = *(float *)val;
1542
1.51k
                                    ret_val = 1;
1543
                                    /*-- ToDo: After Testing, this should be
1544
                                     * removed and tv_size==4 should be set as
1545
                                     * default. */
1546
1.51k
                                    if (tv_size != 4)
1547
0
                                    {
1548
0
                                        TIFFErrorExtR(tif, "_TIFFVGetField",
1549
0
                                                      "Rational2Double: "
1550
0
                                                      ".set_get_field_type "
1551
0
                                                      "in not 4 but %d",
1552
0
                                                      tv_size);
1553
0
                                    }
1554
1.51k
                                }
1555
1.81k
                            }
1556
1.81k
                            break;
1557
0
                            case TIFF_FLOAT:
1558
0
                                *va_arg(ap, float *) = *(float *)val;
1559
0
                                ret_val = 1;
1560
0
                                break;
1561
0
                            case TIFF_DOUBLE:
1562
0
                                *va_arg(ap, double *) = *(double *)val;
1563
0
                                ret_val = 1;
1564
0
                                break;
1565
0
                            default:
1566
0
                                ret_val = 0;
1567
0
                                break;
1568
36.5k
                        }
1569
36.5k
                    }
1570
52.2k
                }
1571
201k
                break;
1572
201k
            }
1573
1.22M
        }
1574
2.48M
    }
1575
2.48M
    return (ret_val);
1576
2.48M
}
1577
1578
/*
1579
 * Return the value of a field in the
1580
 * internal directory structure.
1581
 */
1582
int TIFFGetField(TIFF *tif, uint32_t tag, ...)
1583
3.29M
{
1584
3.29M
    int status;
1585
3.29M
    va_list ap;
1586
1587
3.29M
    va_start(ap, tag);
1588
3.29M
    status = TIFFVGetField(tif, tag, ap);
1589
3.29M
    va_end(ap);
1590
3.29M
    return (status);
1591
3.29M
}
1592
1593
/*
1594
 * Like TIFFGetField, but taking a varargs
1595
 * parameter list.  This routine is useful
1596
 * for building higher-level interfaces on
1597
 * top of the library.
1598
 */
1599
int TIFFVGetField(TIFF *tif, uint32_t tag, va_list ap)
1600
5.24M
{
1601
5.24M
    const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
1602
5.24M
    return (fip && (isPseudoTag(tag) || TIFFFieldSet(tif, fip->field_bit))
1603
5.24M
                ? (*tif->tif_tagmethods.vgetfield)(tif, tag, ap)
1604
5.24M
                : 0);
1605
5.24M
}
1606
1607
#define CleanupField(member)                                                   \
1608
6.10M
    {                                                                          \
1609
6.10M
        if (td->member)                                                        \
1610
6.10M
        {                                                                      \
1611
469k
            _TIFFfreeExt(tif, td->member);                                     \
1612
469k
            td->member = 0;                                                    \
1613
469k
        }                                                                      \
1614
6.10M
    }
1615
1616
/*
1617
 * Release storage associated with a directory.
1618
 */
1619
void TIFFFreeDirectory(TIFF *tif)
1620
406k
{
1621
406k
    TIFFDirectory *td = &tif->tif_dir;
1622
406k
    int i;
1623
1624
406k
    (*tif->tif_cleanup)(tif);
1625
406k
    _TIFFmemset(td->td_fieldsset, 0, sizeof(td->td_fieldsset));
1626
406k
    CleanupField(td_sminsamplevalue);
1627
406k
    CleanupField(td_smaxsamplevalue);
1628
406k
    CleanupField(td_colormap[0]);
1629
406k
    CleanupField(td_colormap[1]);
1630
406k
    CleanupField(td_colormap[2]);
1631
406k
    CleanupField(td_sampleinfo);
1632
406k
    CleanupField(td_subifd);
1633
406k
    CleanupField(td_inknames);
1634
406k
    CleanupField(td_refblackwhite);
1635
406k
    CleanupField(td_transferfunction[0]);
1636
406k
    CleanupField(td_transferfunction[1]);
1637
406k
    CleanupField(td_transferfunction[2]);
1638
406k
    CleanupField(td_stripoffset_p);
1639
406k
    CleanupField(td_stripbytecount_p);
1640
406k
    td->td_stripoffsetbyteallocsize = 0;
1641
406k
    TIFFClrFieldBit(tif, FIELD_YCBCRSUBSAMPLING);
1642
406k
    TIFFClrFieldBit(tif, FIELD_YCBCRPOSITIONING);
1643
1644
    /* Cleanup custom tag values */
1645
900k
    for (i = 0; i < td->td_customValueCount; i++)
1646
493k
    {
1647
493k
        if (td->td_customValues[i].value)
1648
422k
            _TIFFfreeExt(tif, td->td_customValues[i].value);
1649
493k
    }
1650
1651
406k
    td->td_customValueCount = 0;
1652
406k
    CleanupField(td_customValues);
1653
1654
406k
    _TIFFmemset(&(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry));
1655
406k
    _TIFFmemset(&(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry));
1656
1657
    /* Reset some internal parameters for IFD data size checking. */
1658
406k
    tif->tif_dir.td_dirdatasize_read = 0;
1659
406k
    tif->tif_dir.td_dirdatasize_write = 0;
1660
406k
    if (tif->tif_dir.td_dirdatasize_offsets != NULL)
1661
211k
    {
1662
211k
        _TIFFfreeExt(tif, tif->tif_dir.td_dirdatasize_offsets);
1663
211k
        tif->tif_dir.td_dirdatasize_offsets = NULL;
1664
211k
        tif->tif_dir.td_dirdatasize_Noffsets = 0;
1665
211k
    }
1666
406k
    tif->tif_dir.td_iswrittentofile = FALSE;
1667
406k
}
1668
#undef CleanupField
1669
1670
/*
1671
 * Client Tag extension support (from Niles Ritter).
1672
 */
1673
static TIFFExtendProc _TIFFextender = (TIFFExtendProc)NULL;
1674
1675
TIFFExtendProc TIFFSetTagExtender(TIFFExtendProc extender)
1676
16
{
1677
16
    TIFFExtendProc prev = _TIFFextender;
1678
16
    _TIFFextender = extender;
1679
16
    return (prev);
1680
16
}
1681
1682
/*
1683
 * Setup for a new directory.  Should we automatically call
1684
 * TIFFWriteDirectory() if the current one is dirty?
1685
 *
1686
 * The newly created directory will not exist on the file till
1687
 * TIFFWriteDirectory(), TIFFFlush() or TIFFClose() is called.
1688
 */
1689
int TIFFCreateDirectory(TIFF *tif)
1690
13.1k
{
1691
    /* Free previously allocated memory and setup default values. */
1692
13.1k
    TIFFFreeDirectory(tif);
1693
13.1k
    TIFFDefaultDirectory(tif);
1694
13.1k
    tif->tif_diroff = 0;
1695
13.1k
    tif->tif_nextdiroff = 0;
1696
13.1k
    tif->tif_curoff = 0;
1697
13.1k
    tif->tif_row = (uint32_t)-1;
1698
13.1k
    tif->tif_curstrip = (uint32_t)-1;
1699
13.1k
    tif->tif_dir.td_iswrittentofile = FALSE;
1700
1701
13.1k
    return 0;
1702
13.1k
}
1703
1704
int TIFFCreateCustomDirectory(TIFF *tif, const TIFFFieldArray *infoarray)
1705
0
{
1706
    /* Free previously allocated memory and setup default values. */
1707
0
    TIFFFreeDirectory(tif);
1708
0
    TIFFDefaultDirectory(tif);
1709
1710
    /*
1711
     * Reset the field definitions to match the application provided list.
1712
     * Hopefully TIFFDefaultDirectory() won't have done anything irreversible
1713
     * based on it's assumption this is an image directory.
1714
     */
1715
0
    _TIFFSetupFields(tif, infoarray);
1716
1717
0
    tif->tif_diroff = 0;
1718
0
    tif->tif_nextdiroff = 0;
1719
0
    tif->tif_curoff = 0;
1720
0
    tif->tif_row = (uint32_t)-1;
1721
0
    tif->tif_curstrip = (uint32_t)-1;
1722
    /* invalidate directory index */
1723
0
    tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
1724
    /* invalidate IFD loop lists */
1725
0
    _TIFFCleanupIFDOffsetAndNumberMaps(tif);
1726
    /* To be able to return from SubIFD or custom-IFD to main-IFD */
1727
0
    tif->tif_setdirectory_force_absolute = TRUE;
1728
1729
0
    return 0;
1730
0
}
1731
1732
int TIFFCreateEXIFDirectory(TIFF *tif)
1733
0
{
1734
0
    const TIFFFieldArray *exifFieldArray;
1735
0
    exifFieldArray = _TIFFGetExifFields();
1736
0
    return TIFFCreateCustomDirectory(tif, exifFieldArray);
1737
0
}
1738
1739
/*
1740
 * Creates the EXIF GPS custom directory
1741
 */
1742
int TIFFCreateGPSDirectory(TIFF *tif)
1743
0
{
1744
0
    const TIFFFieldArray *gpsFieldArray;
1745
0
    gpsFieldArray = _TIFFGetGpsFields();
1746
0
    return TIFFCreateCustomDirectory(tif, gpsFieldArray);
1747
0
}
1748
1749
/*
1750
 * Setup a default directory structure.
1751
 */
1752
int TIFFDefaultDirectory(TIFF *tif)
1753
237k
{
1754
237k
    register TIFFDirectory *td = &tif->tif_dir;
1755
237k
    const TIFFFieldArray *tiffFieldArray;
1756
1757
237k
    tiffFieldArray = _TIFFGetFields();
1758
237k
    _TIFFSetupFields(tif, tiffFieldArray);
1759
1760
237k
    _TIFFmemset(td, 0, sizeof(*td));
1761
237k
    td->td_fillorder = FILLORDER_MSB2LSB;
1762
237k
    td->td_bitspersample = 1;
1763
237k
    td->td_threshholding = THRESHHOLD_BILEVEL;
1764
237k
    td->td_orientation = ORIENTATION_TOPLEFT;
1765
237k
    td->td_samplesperpixel = 1;
1766
237k
    td->td_rowsperstrip = (uint32_t)-1;
1767
237k
    td->td_tilewidth = 0;
1768
237k
    td->td_tilelength = 0;
1769
237k
    td->td_tiledepth = 1;
1770
#ifdef STRIPBYTECOUNTSORTED_UNUSED
1771
    td->td_stripbytecountsorted = 1; /* Our own arrays always sorted. */
1772
#endif
1773
237k
    td->td_resolutionunit = RESUNIT_INCH;
1774
237k
    td->td_sampleformat = SAMPLEFORMAT_UINT;
1775
237k
    td->td_imagedepth = 1;
1776
237k
    td->td_ycbcrsubsampling[0] = 2;
1777
237k
    td->td_ycbcrsubsampling[1] = 2;
1778
237k
    td->td_ycbcrpositioning = YCBCRPOSITION_CENTERED;
1779
237k
    tif->tif_postdecode = _TIFFNoPostDecode;
1780
237k
    tif->tif_foundfield = NULL;
1781
237k
    tif->tif_tagmethods.vsetfield = _TIFFVSetField;
1782
237k
    tif->tif_tagmethods.vgetfield = _TIFFVGetField;
1783
237k
    tif->tif_tagmethods.printdir = NULL;
1784
    /* additional default values */
1785
237k
    td->td_planarconfig = PLANARCONFIG_CONTIG;
1786
237k
    td->td_compression = COMPRESSION_NONE;
1787
237k
    td->td_subfiletype = 0;
1788
237k
    td->td_minsamplevalue = 0;
1789
    /* td_bitspersample=1 is always set in TIFFDefaultDirectory().
1790
     * Therefore, td_maxsamplevalue has to be re-calculated in
1791
     * TIFFGetFieldDefaulted(). */
1792
237k
    td->td_maxsamplevalue = 1; /* Default for td_bitspersample=1 */
1793
237k
    td->td_extrasamples = 0;
1794
237k
    td->td_sampleinfo = NULL;
1795
1796
    /*
1797
     *  Give client code a chance to install their own
1798
     *  tag extensions & methods, prior to compression overloads,
1799
     *  but do some prior cleanup first.
1800
     * (http://trac.osgeo.org/gdal/ticket/5054)
1801
     */
1802
237k
    if (tif->tif_nfieldscompat > 0)
1803
74.1k
    {
1804
74.1k
        uint32_t i;
1805
1806
148k
        for (i = 0; i < tif->tif_nfieldscompat; i++)
1807
74.1k
        {
1808
74.1k
            if (tif->tif_fieldscompat[i].allocated_size)
1809
74.1k
                _TIFFfreeExt(tif, tif->tif_fieldscompat[i].fields);
1810
74.1k
        }
1811
74.1k
        _TIFFfreeExt(tif, tif->tif_fieldscompat);
1812
74.1k
        tif->tif_nfieldscompat = 0;
1813
74.1k
        tif->tif_fieldscompat = NULL;
1814
74.1k
    }
1815
237k
    if (_TIFFextender)
1816
237k
        (*_TIFFextender)(tif);
1817
237k
    (void)TIFFSetField(tif, TIFFTAG_COMPRESSION, COMPRESSION_NONE);
1818
    /*
1819
     * NB: The directory is marked dirty as a result of setting
1820
     * up the default compression scheme.  However, this really
1821
     * isn't correct -- we want TIFF_DIRTYDIRECT to be set only
1822
     * if the user does something.  We could just do the setup
1823
     * by hand, but it seems better to use the normal mechanism
1824
     * (i.e. TIFFSetField).
1825
     */
1826
237k
    tif->tif_flags &= ~TIFF_DIRTYDIRECT;
1827
1828
    /*
1829
     * As per http://bugzilla.remotesensing.org/show_bug.cgi?id=19
1830
     * we clear the ISTILED flag when setting up a new directory.
1831
     * Should we also be clearing stuff like INSUBIFD?
1832
     */
1833
237k
    tif->tif_flags &= ~TIFF_ISTILED;
1834
1835
237k
    return (1);
1836
237k
}
1837
1838
static int TIFFAdvanceDirectory(TIFF *tif, uint64_t *nextdiroff, uint64_t *off,
1839
                                tdir_t *nextdirnum)
1840
53.8k
{
1841
53.8k
    static const char module[] = "TIFFAdvanceDirectory";
1842
1843
    /* Add this directory to the directory list, if not already in. */
1844
53.8k
    if (!_TIFFCheckDirNumberAndOffset(tif, *nextdirnum, *nextdiroff))
1845
0
    {
1846
0
        TIFFErrorExtR(tif, module,
1847
0
                      "Starting directory %u at offset 0x%" PRIx64 " (%" PRIu64
1848
0
                      ") might cause an IFD loop",
1849
0
                      *nextdirnum, *nextdiroff, *nextdiroff);
1850
0
        *nextdiroff = 0;
1851
0
        *nextdirnum = 0;
1852
0
        return (0);
1853
0
    }
1854
1855
53.8k
    if (isMapped(tif))
1856
53.8k
    {
1857
53.8k
        uint64_t poff = *nextdiroff;
1858
53.8k
        if (!(tif->tif_flags & TIFF_BIGTIFF))
1859
53.8k
        {
1860
53.8k
            tmsize_t poffa, poffb, poffc, poffd;
1861
53.8k
            uint16_t dircount;
1862
53.8k
            uint32_t nextdir32;
1863
53.8k
            poffa = (tmsize_t)poff;
1864
53.8k
            poffb = poffa + sizeof(uint16_t);
1865
53.8k
            if (((uint64_t)poffa != poff) || (poffb < poffa) ||
1866
53.8k
                (poffb < (tmsize_t)sizeof(uint16_t)) || (poffb > tif->tif_size))
1867
3.04k
            {
1868
3.04k
                TIFFErrorExtR(tif, module,
1869
3.04k
                              "%s:%d: %s: Error fetching directory count",
1870
3.04k
                              __FILE__, __LINE__, tif->tif_name);
1871
3.04k
                *nextdiroff = 0;
1872
3.04k
                return (0);
1873
3.04k
            }
1874
50.7k
            _TIFFmemcpy(&dircount, tif->tif_base + poffa, sizeof(uint16_t));
1875
50.7k
            if (tif->tif_flags & TIFF_SWAB)
1876
35.7k
                TIFFSwabShort(&dircount);
1877
50.7k
            poffc = poffb + dircount * 12;
1878
50.7k
            poffd = poffc + sizeof(uint32_t);
1879
50.7k
            if ((poffc < poffb) || (poffc < dircount * 12) || (poffd < poffc) ||
1880
50.7k
                (poffd < (tmsize_t)sizeof(uint32_t)) || (poffd > tif->tif_size))
1881
735
            {
1882
735
                TIFFErrorExtR(tif, module, "Error fetching directory link");
1883
735
                return (0);
1884
735
            }
1885
50.0k
            if (off != NULL)
1886
0
                *off = (uint64_t)poffc;
1887
50.0k
            _TIFFmemcpy(&nextdir32, tif->tif_base + poffc, sizeof(uint32_t));
1888
50.0k
            if (tif->tif_flags & TIFF_SWAB)
1889
35.1k
                TIFFSwabLong(&nextdir32);
1890
50.0k
            *nextdiroff = nextdir32;
1891
50.0k
        }
1892
0
        else
1893
0
        {
1894
0
            tmsize_t poffa, poffb, poffc, poffd;
1895
0
            uint64_t dircount64;
1896
0
            uint16_t dircount16;
1897
0
            if (poff > (uint64_t)TIFF_TMSIZE_T_MAX - sizeof(uint64_t))
1898
0
            {
1899
0
                TIFFErrorExtR(tif, module,
1900
0
                              "%s:%d: %s: Error fetching directory count",
1901
0
                              __FILE__, __LINE__, tif->tif_name);
1902
0
                return (0);
1903
0
            }
1904
0
            poffa = (tmsize_t)poff;
1905
0
            poffb = poffa + sizeof(uint64_t);
1906
0
            if (poffb > tif->tif_size)
1907
0
            {
1908
0
                TIFFErrorExtR(tif, module,
1909
0
                              "%s:%d: %s: Error fetching directory count",
1910
0
                              __FILE__, __LINE__, tif->tif_name);
1911
0
                return (0);
1912
0
            }
1913
0
            _TIFFmemcpy(&dircount64, tif->tif_base + poffa, sizeof(uint64_t));
1914
0
            if (tif->tif_flags & TIFF_SWAB)
1915
0
                TIFFSwabLong8(&dircount64);
1916
0
            if (dircount64 > 0xFFFF)
1917
0
            {
1918
0
                TIFFErrorExtR(tif, module,
1919
0
                              "Sanity check on directory count failed");
1920
0
                return (0);
1921
0
            }
1922
0
            dircount16 = (uint16_t)dircount64;
1923
0
            if (poffb > TIFF_TMSIZE_T_MAX - (tmsize_t)(dircount16 * 20) -
1924
0
                            (tmsize_t)sizeof(uint64_t))
1925
0
            {
1926
0
                TIFFErrorExtR(tif, module, "Error fetching directory link");
1927
0
                return (0);
1928
0
            }
1929
0
            poffc = poffb + dircount16 * 20;
1930
0
            poffd = poffc + sizeof(uint64_t);
1931
0
            if (poffd > tif->tif_size)
1932
0
            {
1933
0
                TIFFErrorExtR(tif, module, "Error fetching directory link");
1934
0
                return (0);
1935
0
            }
1936
0
            if (off != NULL)
1937
0
                *off = (uint64_t)poffc;
1938
0
            _TIFFmemcpy(nextdiroff, tif->tif_base + poffc, sizeof(uint64_t));
1939
0
            if (tif->tif_flags & TIFF_SWAB)
1940
0
                TIFFSwabLong8(nextdiroff);
1941
0
        }
1942
53.8k
    }
1943
0
    else
1944
0
    {
1945
0
        if (!(tif->tif_flags & TIFF_BIGTIFF))
1946
0
        {
1947
0
            uint16_t dircount;
1948
0
            uint32_t nextdir32;
1949
0
            if (!SeekOK(tif, *nextdiroff) ||
1950
0
                !ReadOK(tif, &dircount, sizeof(uint16_t)))
1951
0
            {
1952
0
                TIFFErrorExtR(tif, module,
1953
0
                              "%s:%d: %s: Error fetching directory count",
1954
0
                              __FILE__, __LINE__, tif->tif_name);
1955
0
                return (0);
1956
0
            }
1957
0
            if (tif->tif_flags & TIFF_SWAB)
1958
0
                TIFFSwabShort(&dircount);
1959
0
            if (off != NULL)
1960
0
                *off = TIFFSeekFile(tif, dircount * 12, SEEK_CUR);
1961
0
            else
1962
0
                (void)TIFFSeekFile(tif, dircount * 12, SEEK_CUR);
1963
0
            if (!ReadOK(tif, &nextdir32, sizeof(uint32_t)))
1964
0
            {
1965
0
                TIFFErrorExtR(tif, module, "%s: Error fetching directory link",
1966
0
                              tif->tif_name);
1967
0
                return (0);
1968
0
            }
1969
0
            if (tif->tif_flags & TIFF_SWAB)
1970
0
                TIFFSwabLong(&nextdir32);
1971
0
            *nextdiroff = nextdir32;
1972
0
        }
1973
0
        else
1974
0
        {
1975
0
            uint64_t dircount64;
1976
0
            uint16_t dircount16;
1977
0
            if (!SeekOK(tif, *nextdiroff) ||
1978
0
                !ReadOK(tif, &dircount64, sizeof(uint64_t)))
1979
0
            {
1980
0
                TIFFErrorExtR(tif, module,
1981
0
                              "%s:%d: %s: Error fetching directory count",
1982
0
                              __FILE__, __LINE__, tif->tif_name);
1983
0
                return (0);
1984
0
            }
1985
0
            if (tif->tif_flags & TIFF_SWAB)
1986
0
                TIFFSwabLong8(&dircount64);
1987
0
            if (dircount64 > 0xFFFF)
1988
0
            {
1989
0
                TIFFErrorExtR(tif, module,
1990
0
                              "%s:%d: %s: Error fetching directory count",
1991
0
                              __FILE__, __LINE__, tif->tif_name);
1992
0
                return (0);
1993
0
            }
1994
0
            dircount16 = (uint16_t)dircount64;
1995
0
            if (off != NULL)
1996
0
                *off = TIFFSeekFile(tif, dircount16 * 20, SEEK_CUR);
1997
0
            else
1998
0
                (void)TIFFSeekFile(tif, dircount16 * 20, SEEK_CUR);
1999
0
            if (!ReadOK(tif, nextdiroff, sizeof(uint64_t)))
2000
0
            {
2001
0
                TIFFErrorExtR(tif, module, "%s: Error fetching directory link",
2002
0
                              tif->tif_name);
2003
0
                return (0);
2004
0
            }
2005
0
            if (tif->tif_flags & TIFF_SWAB)
2006
0
                TIFFSwabLong8(nextdiroff);
2007
0
        }
2008
0
    }
2009
50.0k
    if (*nextdiroff != 0)
2010
26.1k
    {
2011
26.1k
        (*nextdirnum)++;
2012
        /* Check next directory for IFD looping and if so, set it as last
2013
         * directory. */
2014
26.1k
        if (!_TIFFCheckDirNumberAndOffset(tif, *nextdirnum, *nextdiroff))
2015
736
        {
2016
736
            TIFFWarningExtR(
2017
736
                tif, module,
2018
736
                "the next directory %u at offset 0x%" PRIx64 " (%" PRIu64
2019
736
                ") might be an IFD loop. Treating directory %d as "
2020
736
                "last directory",
2021
736
                *nextdirnum, *nextdiroff, *nextdiroff, (int)(*nextdirnum) - 1);
2022
736
            *nextdiroff = 0;
2023
736
            (*nextdirnum)--;
2024
736
        }
2025
26.1k
    }
2026
50.0k
    return (1);
2027
53.8k
}
2028
2029
/*
2030
 * Count the number of directories in a file.
2031
 */
2032
tdir_t TIFFNumberOfDirectories(TIFF *tif)
2033
28.4k
{
2034
28.4k
    uint64_t nextdiroff;
2035
28.4k
    tdir_t nextdirnum;
2036
28.4k
    tdir_t n;
2037
28.4k
    if (!(tif->tif_flags & TIFF_BIGTIFF))
2038
28.4k
        nextdiroff = tif->tif_header.classic.tiff_diroff;
2039
0
    else
2040
0
        nextdiroff = tif->tif_header.big.tiff_diroff;
2041
28.4k
    nextdirnum = 0;
2042
28.4k
    n = 0;
2043
56.9k
    while (nextdiroff != 0 &&
2044
32.2k
           TIFFAdvanceDirectory(tif, &nextdiroff, NULL, &nextdirnum))
2045
28.4k
    {
2046
28.4k
        ++n;
2047
28.4k
    }
2048
    /* Update number of main-IFDs in file. */
2049
28.4k
    tif->tif_curdircount = n;
2050
28.4k
    return (n);
2051
28.4k
}
2052
2053
/*
2054
 * Set the n-th directory as the current directory.
2055
 * NB: Directories are numbered starting at 0.
2056
 */
2057
int TIFFSetDirectory(TIFF *tif, tdir_t dirn)
2058
30.7k
{
2059
30.7k
    uint64_t nextdiroff;
2060
30.7k
    tdir_t nextdirnum = 0;
2061
30.7k
    tdir_t n;
2062
2063
30.7k
    if (tif->tif_setdirectory_force_absolute)
2064
16.5k
    {
2065
        /* tif_setdirectory_force_absolute=1 will force parsing the main IFD
2066
         * chain from the beginning, thus IFD directory list needs to be cleared
2067
         * from possible SubIFD offsets.
2068
         */
2069
16.5k
        _TIFFCleanupIFDOffsetAndNumberMaps(tif); /* invalidate IFD loop lists */
2070
16.5k
    }
2071
2072
    /* Even faster path, if offset is available within IFD loop hash list. */
2073
30.7k
    if (!tif->tif_setdirectory_force_absolute &&
2074
14.1k
        _TIFFGetOffsetFromDirNumber(tif, dirn, &nextdiroff))
2075
14.1k
    {
2076
        /* Set parameters for following TIFFReadDirectory() below. */
2077
14.1k
        tif->tif_nextdiroff = nextdiroff;
2078
14.1k
        tif->tif_curdir = dirn;
2079
        /* Reset to relative stepping */
2080
14.1k
        tif->tif_setdirectory_force_absolute = FALSE;
2081
14.1k
    }
2082
16.5k
    else
2083
16.5k
    {
2084
2085
        /* Fast path when we just advance relative to the current directory:
2086
         * start at the current dir offset and continue to seek from there.
2087
         * Check special cases when relative is not allowed:
2088
         * - jump back from SubIFD or custom directory
2089
         * - right after TIFFWriteDirectory() jump back to that directory
2090
         *   using TIFFSetDirectory() */
2091
16.5k
        const int relative = (dirn >= tif->tif_curdir) &&
2092
16.5k
                             (tif->tif_diroff != 0) &&
2093
16.5k
                             !tif->tif_setdirectory_force_absolute;
2094
2095
16.5k
        if (relative)
2096
0
        {
2097
0
            nextdiroff = tif->tif_diroff;
2098
0
            dirn -= tif->tif_curdir;
2099
0
            nextdirnum = tif->tif_curdir;
2100
0
        }
2101
16.5k
        else if (!(tif->tif_flags & TIFF_BIGTIFF))
2102
16.5k
            nextdiroff = tif->tif_header.classic.tiff_diroff;
2103
0
        else
2104
0
            nextdiroff = tif->tif_header.big.tiff_diroff;
2105
2106
        /* Reset to relative stepping */
2107
16.5k
        tif->tif_setdirectory_force_absolute = FALSE;
2108
2109
38.0k
        for (n = dirn; n > 0 && nextdiroff != 0; n--)
2110
21.5k
            if (!TIFFAdvanceDirectory(tif, &nextdiroff, NULL, &nextdirnum))
2111
0
                return (0);
2112
        /* If the n-th directory could not be reached (does not exist),
2113
         * return here without touching anything further. */
2114
16.5k
        if (nextdiroff == 0 || n > 0)
2115
0
            return (0);
2116
2117
16.5k
        tif->tif_nextdiroff = nextdiroff;
2118
2119
        /* Set curdir to the actual directory index. */
2120
16.5k
        if (relative)
2121
0
            tif->tif_curdir += dirn - n;
2122
16.5k
        else
2123
16.5k
            tif->tif_curdir = dirn - n;
2124
16.5k
    }
2125
2126
    /* The -1 decrement is because TIFFReadDirectory will increment
2127
     * tif_curdir after successfully reading the directory. */
2128
30.7k
    if (tif->tif_curdir == 0)
2129
14.8k
        tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2130
15.8k
    else
2131
15.8k
        tif->tif_curdir--;
2132
2133
30.7k
    tdir_t curdir = tif->tif_curdir;
2134
2135
30.7k
    int retval = TIFFReadDirectory(tif);
2136
2137
30.7k
    if (!retval && tif->tif_curdir == curdir)
2138
0
    {
2139
        /* If tif_curdir has not be incremented, TIFFFetchDirectory() in
2140
         * TIFFReadDirectory() has failed and tif_curdir shall be set
2141
         * specifically. */
2142
0
        tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2143
0
    }
2144
30.7k
    return (retval);
2145
30.7k
}
2146
2147
/*
2148
 * Set the current directory to be the directory
2149
 * located at the specified file offset.  This interface
2150
 * is used mainly to access directories linked with
2151
 * the SubIFD tag (e.g. thumbnail images).
2152
 */
2153
int TIFFSetSubDirectory(TIFF *tif, uint64_t diroff)
2154
0
{
2155
    /* Match nextdiroff and curdir for consistent IFD-loop checking.
2156
     * Only with TIFFSetSubDirectory() the IFD list can be corrupted with
2157
     * invalid offsets within the main IFD tree. In the case of several subIFDs
2158
     * of a main image, there are two possibilities that are not even mutually
2159
     * exclusive. a.) The subIFD tag contains an array with all offsets of the
2160
     * subIFDs. b.) The SubIFDs are concatenated with their NextIFD parameters.
2161
     * (refer to
2162
     * https://www.awaresystems.be/imaging/tiff/specification/TIFFPM6.pdf.)
2163
     */
2164
0
    int retval;
2165
0
    uint32_t curdir = 0;
2166
0
    int8_t probablySubIFD = 0;
2167
0
    if (diroff == 0)
2168
0
    {
2169
        /* Special case to set tif_diroff=0, which is done in
2170
         * TIFFReadDirectory() below to indicate that the currently read IFD is
2171
         * treated as a new, fresh IFD. */
2172
0
        tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2173
0
        tif->tif_dir.td_iswrittentofile = FALSE;
2174
0
    }
2175
0
    else
2176
0
    {
2177
0
        if (!_TIFFGetDirNumberFromOffset(tif, diroff, &curdir))
2178
0
        {
2179
            /* Non-existing offsets might point to a SubIFD or invalid IFD.*/
2180
0
            probablySubIFD = 1;
2181
0
        }
2182
        /* -1 because TIFFReadDirectory() will increment tif_curdir. */
2183
0
        if (curdir >= 1)
2184
0
            tif->tif_curdir = curdir - 1;
2185
0
        else
2186
0
            tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2187
0
    }
2188
0
    curdir = tif->tif_curdir;
2189
2190
0
    tif->tif_nextdiroff = diroff;
2191
0
    retval = TIFFReadDirectory(tif);
2192
2193
    /* tif_curdir is incremented in TIFFReadDirectory(), but if it has not been
2194
     * incremented, TIFFFetchDirectory() has failed there and tif_curdir shall
2195
     * be set specifically. */
2196
0
    if (!retval && diroff != 0 && tif->tif_curdir == curdir)
2197
0
    {
2198
0
        tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2199
0
    }
2200
2201
0
    if (probablySubIFD)
2202
0
    {
2203
0
        if (retval)
2204
0
        {
2205
            /* Reset IFD list to start new one for SubIFD chain and also start
2206
             * SubIFD chain with tif_curdir=0 for IFD loop checking. */
2207
            /* invalidate IFD loop lists */
2208
0
            _TIFFCleanupIFDOffsetAndNumberMaps(tif);
2209
0
            tif->tif_curdir = 0; /* first directory of new chain */
2210
            /* add this offset to new IFD list */
2211
0
            retval = _TIFFCheckDirNumberAndOffset(tif, tif->tif_curdir, diroff);
2212
0
        }
2213
        /* To be able to return from SubIFD or custom-IFD to main-IFD */
2214
0
        tif->tif_setdirectory_force_absolute = TRUE;
2215
0
    }
2216
2217
0
    return (retval);
2218
0
}
2219
2220
/*
2221
 * Return file offset of the current directory.
2222
 */
2223
0
uint64_t TIFFCurrentDirOffset(TIFF *tif) { return (tif->tif_diroff); }
2224
2225
/*
2226
 * Return an indication of whether or not we are
2227
 * at the last directory in the file.
2228
 */
2229
0
int TIFFLastDirectory(TIFF *tif) { return (tif->tif_nextdiroff == 0); }
2230
2231
/*
2232
 * Unlink the specified directory from the directory chain.
2233
 * Note: First directory starts with number dirn=1.
2234
 * This is different to TIFFSetDirectory() where the first directory starts with
2235
 * zero.
2236
 */
2237
int TIFFUnlinkDirectory(TIFF *tif, tdir_t dirn)
2238
0
{
2239
0
    static const char module[] = "TIFFUnlinkDirectory";
2240
0
    uint64_t nextdir;
2241
0
    tdir_t nextdirnum;
2242
0
    uint64_t off;
2243
0
    tdir_t n;
2244
2245
0
    if (tif->tif_mode == O_RDONLY)
2246
0
    {
2247
0
        TIFFErrorExtR(tif, module,
2248
0
                      "Can not unlink directory in read-only file");
2249
0
        return (0);
2250
0
    }
2251
0
    if (dirn == 0)
2252
0
    {
2253
0
        TIFFErrorExtR(tif, module,
2254
0
                      "For TIFFUnlinkDirectory() first directory starts with "
2255
0
                      "number 1 and not 0");
2256
0
        return (0);
2257
0
    }
2258
    /*
2259
     * Go to the directory before the one we want
2260
     * to unlink and nab the offset of the link
2261
     * field we'll need to patch.
2262
     */
2263
0
    if (!(tif->tif_flags & TIFF_BIGTIFF))
2264
0
    {
2265
0
        nextdir = tif->tif_header.classic.tiff_diroff;
2266
0
        off = 4;
2267
0
    }
2268
0
    else
2269
0
    {
2270
0
        nextdir = tif->tif_header.big.tiff_diroff;
2271
0
        off = 8;
2272
0
    }
2273
0
    nextdirnum = 0; /* First directory is dirn=0 */
2274
2275
0
    for (n = dirn - 1; n > 0; n--)
2276
0
    {
2277
0
        if (nextdir == 0)
2278
0
        {
2279
0
            TIFFErrorExtR(tif, module, "Directory %u does not exist", dirn);
2280
0
            return (0);
2281
0
        }
2282
0
        if (!TIFFAdvanceDirectory(tif, &nextdir, &off, &nextdirnum))
2283
0
            return (0);
2284
0
    }
2285
    /*
2286
     * Advance to the directory to be unlinked and fetch
2287
     * the offset of the directory that follows.
2288
     */
2289
0
    if (!TIFFAdvanceDirectory(tif, &nextdir, NULL, &nextdirnum))
2290
0
        return (0);
2291
    /*
2292
     * Go back and patch the link field of the preceding
2293
     * directory to point to the offset of the directory
2294
     * that follows.
2295
     */
2296
0
    (void)TIFFSeekFile(tif, off, SEEK_SET);
2297
0
    if (!(tif->tif_flags & TIFF_BIGTIFF))
2298
0
    {
2299
0
        uint32_t nextdir32;
2300
0
        nextdir32 = (uint32_t)nextdir;
2301
0
        assert((uint64_t)nextdir32 == nextdir);
2302
0
        if (tif->tif_flags & TIFF_SWAB)
2303
0
            TIFFSwabLong(&nextdir32);
2304
0
        if (!WriteOK(tif, &nextdir32, sizeof(uint32_t)))
2305
0
        {
2306
0
            TIFFErrorExtR(tif, module, "Error writing directory link");
2307
0
            return (0);
2308
0
        }
2309
0
    }
2310
0
    else
2311
0
    {
2312
        /* Need local swap because nextdir has to be used unswapped below. */
2313
0
        uint64_t nextdir64 = nextdir;
2314
0
        if (tif->tif_flags & TIFF_SWAB)
2315
0
            TIFFSwabLong8(&nextdir64);
2316
0
        if (!WriteOK(tif, &nextdir64, sizeof(uint64_t)))
2317
0
        {
2318
0
            TIFFErrorExtR(tif, module, "Error writing directory link");
2319
0
            return (0);
2320
0
        }
2321
0
    }
2322
2323
    /* For dirn=1 (first directory) also update the libtiff internal
2324
     * base offset variables. */
2325
0
    if (dirn == 1)
2326
0
    {
2327
0
        if (!(tif->tif_flags & TIFF_BIGTIFF))
2328
0
            tif->tif_header.classic.tiff_diroff = (uint32_t)nextdir;
2329
0
        else
2330
0
            tif->tif_header.big.tiff_diroff = nextdir;
2331
0
    }
2332
2333
    /*
2334
     * Leave directory state setup safely.  We don't have
2335
     * facilities for doing inserting and removing directories,
2336
     * so it's safest to just invalidate everything.  This
2337
     * means that the caller can only append to the directory
2338
     * chain.
2339
     */
2340
0
    if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata)
2341
0
    {
2342
0
        _TIFFfreeExt(tif, tif->tif_rawdata);
2343
0
        tif->tif_rawdata = NULL;
2344
0
        tif->tif_rawcc = 0;
2345
0
        tif->tif_rawcp = NULL;
2346
0
        tif->tif_rawdataoff = 0;
2347
0
        tif->tif_rawdataloaded = 0;
2348
0
    }
2349
0
    tif->tif_flags &= ~(TIFF_BEENWRITING | TIFF_BUFFERSETUP | TIFF_POSTENCODE |
2350
0
                        TIFF_BUF4WRITE);
2351
0
    TIFFFreeDirectory(tif);
2352
0
    TIFFDefaultDirectory(tif);
2353
0
    tif->tif_diroff = 0;     /* force link on next write */
2354
0
    tif->tif_nextdiroff = 0; /* next write must be at end */
2355
0
    tif->tif_lastdiroff = 0; /* will be updated on next link */
2356
0
    tif->tif_curoff = 0;
2357
0
    tif->tif_row = (uint32_t)-1;
2358
0
    tif->tif_curstrip = (uint32_t)-1;
2359
0
    tif->tif_curdir = TIFF_NON_EXISTENT_DIR_NUMBER;
2360
0
    if (tif->tif_curdircount > 0)
2361
0
        tif->tif_curdircount--;
2362
0
    else
2363
0
        tif->tif_curdircount = TIFF_NON_EXISTENT_DIR_NUMBER;
2364
0
    _TIFFCleanupIFDOffsetAndNumberMaps(tif); /* invalidate IFD loop lists */
2365
0
    return (1);
2366
0
}