Coverage Report

Created: 2024-06-18 06:05

/src/libtiff/libtiff/tif_aux.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright (c) 1991-1997 Sam Leffler
3
 * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4
 *
5
 * Permission to use, copy, modify, distribute, and sell this software and
6
 * its documentation for any purpose is hereby granted without fee, provided
7
 * that (i) the above copyright notices and this permission notice appear in
8
 * all copies of the software and related documentation, and (ii) the names of
9
 * Sam Leffler and Silicon Graphics may not be used in any advertising or
10
 * publicity relating to the software without the specific, prior written
11
 * permission of Sam Leffler and Silicon Graphics.
12
 *
13
 * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14
 * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15
 * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16
 *
17
 * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18
 * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19
 * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20
 * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21
 * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22
 * OF THIS SOFTWARE.
23
 */
24
25
/*
26
 * TIFF Library.
27
 *
28
 * Auxiliary Support Routines.
29
 */
30
#include "tif_predict.h"
31
#include "tiffiop.h"
32
#include <float.h>
33
#include <math.h>
34
35
uint32_t _TIFFMultiply32(TIFF *tif, uint32_t first, uint32_t second,
36
                         const char *where)
37
0
{
38
0
    if (second && first > UINT32_MAX / second)
39
0
    {
40
0
        TIFFErrorExtR(tif, where, "Integer overflow in %s", where);
41
0
        return 0;
42
0
    }
43
44
0
    return first * second;
45
0
}
46
47
uint64_t _TIFFMultiply64(TIFF *tif, uint64_t first, uint64_t second,
48
                         const char *where)
49
0
{
50
0
    if (second && first > UINT64_MAX / second)
51
0
    {
52
0
        TIFFErrorExtR(tif, where, "Integer overflow in %s", where);
53
0
        return 0;
54
0
    }
55
56
0
    return first * second;
57
0
}
58
59
tmsize_t _TIFFMultiplySSize(TIFF *tif, tmsize_t first, tmsize_t second,
60
                            const char *where)
61
0
{
62
0
    if (first <= 0 || second <= 0)
63
0
    {
64
0
        if (tif != NULL && where != NULL)
65
0
        {
66
0
            TIFFErrorExtR(tif, where,
67
0
                          "Invalid argument to _TIFFMultiplySSize() in %s",
68
0
                          where);
69
0
        }
70
0
        return 0;
71
0
    }
72
73
0
    if (first > TIFF_TMSIZE_T_MAX / second)
74
0
    {
75
0
        if (tif != NULL && where != NULL)
76
0
        {
77
0
            TIFFErrorExtR(tif, where, "Integer overflow in %s", where);
78
0
        }
79
0
        return 0;
80
0
    }
81
0
    return first * second;
82
0
}
83
84
tmsize_t _TIFFCastUInt64ToSSize(TIFF *tif, uint64_t val, const char *module)
85
0
{
86
0
    if (val > (uint64_t)TIFF_TMSIZE_T_MAX)
87
0
    {
88
0
        if (tif != NULL && module != NULL)
89
0
        {
90
0
            TIFFErrorExtR(tif, module, "Integer overflow");
91
0
        }
92
0
        return 0;
93
0
    }
94
0
    return (tmsize_t)val;
95
0
}
96
97
void *_TIFFCheckRealloc(TIFF *tif, void *buffer, tmsize_t nmemb,
98
                        tmsize_t elem_size, const char *what)
99
0
{
100
0
    void *cp = NULL;
101
0
    tmsize_t count = _TIFFMultiplySSize(tif, nmemb, elem_size, NULL);
102
    /*
103
     * Check for integer overflow.
104
     */
105
0
    if (count != 0)
106
0
    {
107
0
        cp = _TIFFreallocExt(tif, buffer, count);
108
0
    }
109
110
0
    if (cp == NULL)
111
0
    {
112
0
        TIFFErrorExtR(tif, tif->tif_name,
113
0
                      "Failed to allocate memory for %s "
114
0
                      "(%" TIFF_SSIZE_FORMAT " elements of %" TIFF_SSIZE_FORMAT
115
0
                      " bytes each)",
116
0
                      what, nmemb, elem_size);
117
0
    }
118
119
0
    return cp;
120
0
}
121
122
void *_TIFFCheckMalloc(TIFF *tif, tmsize_t nmemb, tmsize_t elem_size,
123
                       const char *what)
124
0
{
125
0
    return _TIFFCheckRealloc(tif, NULL, nmemb, elem_size, what);
126
0
}
127
128
static int TIFFDefaultTransferFunction(TIFF *tif, TIFFDirectory *td)
129
0
{
130
0
    uint16_t **tf = td->td_transferfunction;
131
0
    tmsize_t i, n, nbytes;
132
133
0
    tf[0] = tf[1] = tf[2] = 0;
134
0
    if (td->td_bitspersample >= sizeof(tmsize_t) * 8 - 2)
135
0
        return 0;
136
137
0
    n = ((tmsize_t)1) << td->td_bitspersample;
138
0
    nbytes = n * sizeof(uint16_t);
139
0
    tf[0] = (uint16_t *)_TIFFmallocExt(tif, nbytes);
140
0
    if (tf[0] == NULL)
141
0
        return 0;
142
0
    tf[0][0] = 0;
143
0
    for (i = 1; i < n; i++)
144
0
    {
145
0
        double t = (double)i / ((double)n - 1.);
146
0
        tf[0][i] = (uint16_t)floor(65535. * pow(t, 2.2) + .5);
147
0
    }
148
149
0
    if (td->td_samplesperpixel - td->td_extrasamples > 1)
150
0
    {
151
0
        tf[1] = (uint16_t *)_TIFFmallocExt(tif, nbytes);
152
0
        if (tf[1] == NULL)
153
0
            goto bad;
154
0
        _TIFFmemcpy(tf[1], tf[0], nbytes);
155
0
        tf[2] = (uint16_t *)_TIFFmallocExt(tif, nbytes);
156
0
        if (tf[2] == NULL)
157
0
            goto bad;
158
0
        _TIFFmemcpy(tf[2], tf[0], nbytes);
159
0
    }
160
0
    return 1;
161
162
0
bad:
163
0
    if (tf[0])
164
0
        _TIFFfreeExt(tif, tf[0]);
165
0
    if (tf[1])
166
0
        _TIFFfreeExt(tif, tf[1]);
167
0
    if (tf[2])
168
0
        _TIFFfreeExt(tif, tf[2]);
169
0
    tf[0] = tf[1] = tf[2] = 0;
170
0
    return 0;
171
0
}
172
173
static int TIFFDefaultRefBlackWhite(TIFF *tif, TIFFDirectory *td)
174
0
{
175
0
    int i;
176
177
0
    td->td_refblackwhite = (float *)_TIFFmallocExt(tif, 6 * sizeof(float));
178
0
    if (td->td_refblackwhite == NULL)
179
0
        return 0;
180
0
    if (td->td_photometric == PHOTOMETRIC_YCBCR)
181
0
    {
182
        /*
183
         * YCbCr (Class Y) images must have the ReferenceBlackWhite
184
         * tag set. Fix the broken images, which lacks that tag.
185
         */
186
0
        td->td_refblackwhite[0] = 0.0F;
187
0
        td->td_refblackwhite[1] = td->td_refblackwhite[3] =
188
0
            td->td_refblackwhite[5] = 255.0F;
189
0
        td->td_refblackwhite[2] = td->td_refblackwhite[4] = 128.0F;
190
0
    }
191
0
    else
192
0
    {
193
        /*
194
         * Assume RGB (Class R)
195
         */
196
0
        for (i = 0; i < 3; i++)
197
0
        {
198
0
            td->td_refblackwhite[2 * i + 0] = 0;
199
0
            td->td_refblackwhite[2 * i + 1] =
200
0
                (float)((1L << td->td_bitspersample) - 1L);
201
0
        }
202
0
    }
203
0
    return 1;
204
0
}
205
206
/*
207
 * Like TIFFGetField, but return any default
208
 * value if the tag is not present in the directory.
209
 *
210
 * NB:  We use the value in the directory, rather than
211
 *  explicit values so that defaults exist only one
212
 *  place in the library -- in TIFFDefaultDirectory.
213
 */
214
int TIFFVGetFieldDefaulted(TIFF *tif, uint32_t tag, va_list ap)
215
0
{
216
0
    TIFFDirectory *td = &tif->tif_dir;
217
218
0
    if (TIFFVGetField(tif, tag, ap))
219
0
        return (1);
220
0
    switch (tag)
221
0
    {
222
0
        case TIFFTAG_SUBFILETYPE:
223
0
            *va_arg(ap, uint32_t *) = td->td_subfiletype;
224
0
            return (1);
225
0
        case TIFFTAG_BITSPERSAMPLE:
226
0
            *va_arg(ap, uint16_t *) = td->td_bitspersample;
227
0
            return (1);
228
0
        case TIFFTAG_THRESHHOLDING:
229
0
            *va_arg(ap, uint16_t *) = td->td_threshholding;
230
0
            return (1);
231
0
        case TIFFTAG_FILLORDER:
232
0
            *va_arg(ap, uint16_t *) = td->td_fillorder;
233
0
            return (1);
234
0
        case TIFFTAG_ORIENTATION:
235
0
            *va_arg(ap, uint16_t *) = td->td_orientation;
236
0
            return (1);
237
0
        case TIFFTAG_SAMPLESPERPIXEL:
238
0
            *va_arg(ap, uint16_t *) = td->td_samplesperpixel;
239
0
            return (1);
240
0
        case TIFFTAG_ROWSPERSTRIP:
241
0
            *va_arg(ap, uint32_t *) = td->td_rowsperstrip;
242
0
            return (1);
243
0
        case TIFFTAG_MINSAMPLEVALUE:
244
0
            *va_arg(ap, uint16_t *) = td->td_minsamplevalue;
245
0
            return (1);
246
0
        case TIFFTAG_MAXSAMPLEVALUE:
247
0
        {
248
0
            uint16_t maxsamplevalue;
249
            /* td_bitspersample=1 is always set in TIFFDefaultDirectory().
250
             * Therefore, td_maxsamplevalue has to be re-calculated in
251
             * TIFFGetFieldDefaulted(). */
252
0
            if (td->td_bitspersample > 0)
253
0
            {
254
                /* This shift operation into a uint16_t limits the value to
255
                 * 65535 even if td_bitspersamle is > 16 */
256
0
                if (td->td_bitspersample <= 16)
257
0
                {
258
0
                    maxsamplevalue = (1 << td->td_bitspersample) -
259
0
                                     1; /* 2**(BitsPerSample) - 1 */
260
0
                }
261
0
                else
262
0
                {
263
0
                    maxsamplevalue = 65535;
264
0
                }
265
0
            }
266
0
            else
267
0
            {
268
0
                maxsamplevalue = 0;
269
0
            }
270
0
            *va_arg(ap, uint16_t *) = maxsamplevalue;
271
0
            return (1);
272
0
        }
273
0
        case TIFFTAG_PLANARCONFIG:
274
0
            *va_arg(ap, uint16_t *) = td->td_planarconfig;
275
0
            return (1);
276
0
        case TIFFTAG_RESOLUTIONUNIT:
277
0
            *va_arg(ap, uint16_t *) = td->td_resolutionunit;
278
0
            return (1);
279
0
        case TIFFTAG_PREDICTOR:
280
0
        {
281
0
            TIFFPredictorState *sp = (TIFFPredictorState *)tif->tif_data;
282
0
            if (sp == NULL)
283
0
            {
284
0
                TIFFErrorExtR(
285
0
                    tif, tif->tif_name,
286
0
                    "Cannot get \"Predictor\" tag as plugin is not configured");
287
0
                *va_arg(ap, uint16_t *) = 0;
288
0
                return 0;
289
0
            }
290
0
            *va_arg(ap, uint16_t *) = (uint16_t)sp->predictor;
291
0
            return 1;
292
0
        }
293
0
        case TIFFTAG_DOTRANGE:
294
0
            *va_arg(ap, uint16_t *) = 0;
295
0
            *va_arg(ap, uint16_t *) = (1 << td->td_bitspersample) - 1;
296
0
            return (1);
297
0
        case TIFFTAG_INKSET:
298
0
            *va_arg(ap, uint16_t *) = INKSET_CMYK;
299
0
            return 1;
300
0
        case TIFFTAG_NUMBEROFINKS:
301
0
            *va_arg(ap, uint16_t *) = 4;
302
0
            return (1);
303
0
        case TIFFTAG_EXTRASAMPLES:
304
0
            *va_arg(ap, uint16_t *) = td->td_extrasamples;
305
0
            *va_arg(ap, const uint16_t **) = td->td_sampleinfo;
306
0
            return (1);
307
0
        case TIFFTAG_MATTEING:
308
0
            *va_arg(ap, uint16_t *) =
309
0
                (td->td_extrasamples == 1 &&
310
0
                 td->td_sampleinfo[0] == EXTRASAMPLE_ASSOCALPHA);
311
0
            return (1);
312
0
        case TIFFTAG_TILEDEPTH:
313
0
            *va_arg(ap, uint32_t *) = td->td_tiledepth;
314
0
            return (1);
315
0
        case TIFFTAG_DATATYPE:
316
0
            *va_arg(ap, uint16_t *) = td->td_sampleformat - 1;
317
0
            return (1);
318
0
        case TIFFTAG_SAMPLEFORMAT:
319
0
            *va_arg(ap, uint16_t *) = td->td_sampleformat;
320
0
            return (1);
321
0
        case TIFFTAG_IMAGEDEPTH:
322
0
            *va_arg(ap, uint32_t *) = td->td_imagedepth;
323
0
            return (1);
324
0
        case TIFFTAG_YCBCRCOEFFICIENTS:
325
0
        {
326
            /* defaults are from CCIR Recommendation 601-1 */
327
0
            static const float ycbcrcoeffs[] = {0.299f, 0.587f, 0.114f};
328
0
            *va_arg(ap, const float **) = ycbcrcoeffs;
329
0
            return 1;
330
0
        }
331
0
        case TIFFTAG_YCBCRSUBSAMPLING:
332
0
            *va_arg(ap, uint16_t *) = td->td_ycbcrsubsampling[0];
333
0
            *va_arg(ap, uint16_t *) = td->td_ycbcrsubsampling[1];
334
0
            return (1);
335
0
        case TIFFTAG_YCBCRPOSITIONING:
336
0
            *va_arg(ap, uint16_t *) = td->td_ycbcrpositioning;
337
0
            return (1);
338
0
        case TIFFTAG_WHITEPOINT:
339
0
        {
340
            /* TIFF 6.0 specification tells that it is no default
341
               value for the WhitePoint, but AdobePhotoshop TIFF
342
               Technical Note tells that it should be CIE D50. */
343
0
            static const float whitepoint[] = {
344
0
                D50_X0 / (D50_X0 + D50_Y0 + D50_Z0),
345
0
                D50_Y0 / (D50_X0 + D50_Y0 + D50_Z0)};
346
0
            *va_arg(ap, const float **) = whitepoint;
347
0
            return 1;
348
0
        }
349
0
        case TIFFTAG_TRANSFERFUNCTION:
350
0
            if (!td->td_transferfunction[0] &&
351
0
                !TIFFDefaultTransferFunction(tif, td))
352
0
            {
353
0
                TIFFErrorExtR(tif, tif->tif_name,
354
0
                              "No space for \"TransferFunction\" tag");
355
0
                return (0);
356
0
            }
357
0
            *va_arg(ap, const uint16_t **) = td->td_transferfunction[0];
358
0
            if (td->td_samplesperpixel - td->td_extrasamples > 1)
359
0
            {
360
0
                *va_arg(ap, const uint16_t **) = td->td_transferfunction[1];
361
0
                *va_arg(ap, const uint16_t **) = td->td_transferfunction[2];
362
0
            }
363
0
            return (1);
364
0
        case TIFFTAG_REFERENCEBLACKWHITE:
365
0
            if (!td->td_refblackwhite && !TIFFDefaultRefBlackWhite(tif, td))
366
0
                return (0);
367
0
            *va_arg(ap, const float **) = td->td_refblackwhite;
368
0
            return (1);
369
0
    }
370
0
    return 0;
371
0
}
372
373
/*
374
 * Like TIFFGetField, but return any default
375
 * value if the tag is not present in the directory.
376
 */
377
int TIFFGetFieldDefaulted(TIFF *tif, uint32_t tag, ...)
378
0
{
379
0
    int ok;
380
0
    va_list ap;
381
382
0
    va_start(ap, tag);
383
0
    ok = TIFFVGetFieldDefaulted(tif, tag, ap);
384
0
    va_end(ap);
385
0
    return (ok);
386
0
}
387
388
float _TIFFClampDoubleToFloat(double val)
389
0
{
390
0
    if (val > FLT_MAX)
391
0
        return FLT_MAX;
392
0
    if (val < -FLT_MAX)
393
0
        return -FLT_MAX;
394
0
    return (float)val;
395
0
}
396
397
uint32_t _TIFFClampDoubleToUInt32(double val)
398
0
{
399
0
    if (val < 0)
400
0
        return 0;
401
0
    if (val > 0xFFFFFFFFU || val != val)
402
0
        return 0xFFFFFFFFU;
403
0
    return (uint32_t)val;
404
0
}
405
406
int _TIFFSeekOK(TIFF *tif, toff_t off)
407
0
{
408
    /* Huge offsets, especially -1 / UINT64_MAX, can cause issues */
409
    /* See http://bugzilla.maptools.org/show_bug.cgi?id=2726 */
410
0
    return off <= (~(uint64_t)0) / 2 && TIFFSeekFile(tif, off, SEEK_SET) == off;
411
0
}